Law 25, PIPEDA, SOC 2, ISO 27001 and PCI DSS compliance, in French and English

---

In two weeks, know which Law 25 and PIPEDA obligations you meet, which you do not, and the five actions that matter most.

Call us when:

• You operate in Quebec or serve Quebec customers
• Nobody is named as person in charge of personal information
• A customer or a partner asks for your privacy practices

You get:

• A gap check against each obligation, by the date it came into force
• An outline of the personal information you hold and where
• A check of your website: privacy policy, cookies, published contact
• Your five priority actions, with effort and owner

Duration and format: 2 weeks. Remote, in French or English.

Built on: Commission d'accès à l'information du Québec guidance on Law 25; Office of the Privacy Commissioner of Canada, PIPEDA.

Fee: per diem rate; number of days agreed in writing before work starts.

A privacy program you can show to a customer, a regulator or a court, in French and English.

Call us when:

• The readiness check found gaps
• You move data to a cloud provider outside Quebec
• You had a confidentiality incident

You get:

• Governance policies and a privacy policy in French and English
• A register of confidentiality incidents and a breach procedure
• A privacy impact assessment method, and the first assessments, including transfers outside Quebec
• Consent, retention and destruction rules, and clauses for your service providers
• Training for your teams and a 90-day plan

Duration and format: 8 to 12 weeks. Remote, with workshops on site.

Built on: Law 25 (Quebec); PIPEDA; ISO/IEC 27701:2025.

Fee: per diem rate; number of days agreed in writing before work starts.

Walk into the audit ready, with one set of controls that answers several frameworks.

Call us when:

• A customer or a request for proposals requires a SOC 2 report or an ISO 27001 certificate
• Your acquiring bank asks for PCI DSS v4.0.1 compliance
• Each framework became its own project

You get:

• Scope and a gap analysis
• One control set mapped across SOC 2, ISO 27001:2022 and PCI DSS v4.0.1, with the Statement of Applicability
• An evidence plan and owners
• An internal audit rehearsal
• Help choosing the auditor; the audit itself stays with an independent firm

Duration and format: 3 to 6 months. Remote, with workshops on site.

Built on: AICPA Trust Services Criteria; ISO/IEC 27001:2022; PCI DSS v4.0.1 (2024).

Fee: per diem rate; number of days agreed in writing before work starts.

A complete set of policies and standards your auditors accept and your Quebec teams can read in French, from one master, at the same version in both languages.

Call us when:

• Your policies exist in one language only, or not at all
• A customer, an insurer or an auditor asks for your standards, not only your policies
• Your policies were written for another company, or for another decade

You get:

• Policies that state intent, and standards under them that set binding, testable requirements, with procedures where needed
• Every requirement mapped to NIST CSF 2.0, the CIS Controls, ISO 27001, SOC 2, PCI DSS, Law 25 and PIPEDA
• French and English produced from one master, with the same document numbers and versions
• An approval workflow, a revision history and a review calendar

Duration and format: 8 to 12 weeks. Remote, with review workshops.

Built on: ISO/IEC 27001:2022; NIST CSF 2.0 (2024); Charter of the French Language, section 41.

Fee: fixed, agreed in writing before work starts.

One standard moved from paper to daily practice, with the first evidence an auditor will ask for.

Call us when:

• A standard exists on paper but not in practice
• An audit finding, an insurer or a customer points at one domain
• You want progress you can show without launching a large program

You get:

• A gap assessment of the standard against what actually happens, requirement by requirement
• The registers, forms, reviews and records the standard requires, set up with their owners
• The first cycle of evidence: a completed review, a signed recertification, a filed test
• A handover so your team runs it, and a short report to management

Standards you can start with:

• Vendor and third-party risk
• Identity and privileged access
• Backup, recovery and restore testing
• Incident response and breach notification
• Vulnerability and patch management
• Logging and monitoring
• Data classification and handling
• Records retention and secure disposal
• Artificial intelligence use
• Endpoint, mobile and wearable devices
• Cloud security
• Security awareness and training

Duration and format: 3 to 6 weeks per standard. On site and remote, with the owners of the standard.

Built on: NIST CSF 2.0 (2024); CIS Controls v8.1 (2024); ISO/IEC 27001:2022.

Fee: per diem rate; number of days agreed in writing before work starts.