Deliver Quebec Law 25 Compliance as a Managed Service
Every business serving Quebec residents falls under Loi 25 — Canada's toughest private-sector privacy law, with fines up to $25M. Nuronus gives your MSP the platform to appoint a Privacy Officer, run privacy impact assessments, manage confidentiality-incident reporting, and deliver audit-ready readiness reports — fully in French, as a high-margin recurring service.
Free for 2 clients. All features included. No credit card required.
The Problem
Quebec Businesses Must Comply With Loi 25. Most US Platforms Don't Even Cover It.
Loi 25 — Quebec's Act to modernize legislative provisions as regards the protection of personal information (formerly Bill 64) — phased in from 2022 to 2024 and is enforced by the Commission d'accès à l'information (CAI). It carries administrative monetary penalties up to $10M or 2% of worldwide turnover and penal fines up to $25M or 4%. Your Quebec clients need help getting compliant, many must operate in French, and few compliance platforms cover Loi 25 at all. MSPs that can deliver Loi 25 readiness own a recurring, high-margin revenue stream that US-centric tools simply can't touch.
- Quebec clients are exposed to Loi 25 penalties up to $25M but have no idea where to start
- US-built compliance platforms omit Loi 25 entirely, leaving a gap you can't fill for Quebec clients
- Loi 25 requires a named Privacy Officer, PIAs (EFVP), and confidentiality-incident reporting to the CAI — obligations most SMBs have never operationalized
- Cross-border transfers of personal information now demand a documented assessment before data leaves Quebec
- Deliverables and client communications often need to be in French, which most tools can't produce
Capabilities
Loi 25 Readiness, Automated and Billable
Nuronus handles the heavy lifting of Loi 25 preparation — governance, consent, incidents, individual rights, and transfers — so you can focus on delivering value to Quebec clients and growing your compliance practice.
Privacy Governance & Officer Setup
Establish the Privacy Officer role (by default the highest authority within the business) and build the governance policies Loi 25 requires under art. 3.1–3.3, tracked per client.
Stand up a defensible privacy program clients can point to
Privacy Impact Assessments (EFVP)
Run structured privacy impact assessments for new projects and for any transfer of personal information outside Quebec, with documented findings you can hand to the client or the CAI.
Turn each PIA into a scoped, fixed-fee engagement
Confidentiality-Incident Management
Track confidentiality incidents end to end, assess the risk of serious injury, and document notification to the CAI and affected individuals within Loi 25's reporting obligations (art. 3.5–3.8).
Give clients a ready incident-response process before they need it
French-Language Readiness Reporting
Map security measures (art. 10), consent, retention, and individual-rights obligations to one control set, then deliver a white-label readiness report — produced fully in Canadian French.
Provide ongoing Loi 25 monitoring as a monthly service
The Law
The Core Obligations of Loi 25, Covered
Nuronus maps every Loi 25 obligation to a single underlying control set, so a client's one assessment feeds Loi 25 and every other framework they fall under.
Governance & Accountability (art. 3.1–3.3)
- ✓Appoint a Privacy Officer — by default the highest authority within the business
- ✓Establish and publish personal-information governance policies and practices
- ✓Assign clear internal responsibility for protecting personal information
Consent & Transparency (art. 8, 9.1)
- ✓Obtain clear, free, and informed consent for collection and use
- ✓Inform individuals of the purposes and means of collection
- ✓Enable privacy by default in products and services
Confidentiality Incidents (art. 3.5–3.8)
- ✓Assess the risk of serious injury when a confidentiality incident occurs
- ✓Notify the Commission d'accès à l'information (CAI) when required
- ✓Notify affected individuals and maintain an incident register
Individual Rights (art. 27–28)
- ✓Honor access and correction requests for personal information
- ✓Provide data portability in a structured, commonly used technological format
- ✓Support de-indexing and cessation-of-dissemination requests
Security Measures (art. 10)
- ✓Implement security measures appropriate to the sensitivity of the data
- ✓Protect personal information across its lifecycle
- ✓Evidence technical and organizational safeguards (scored automatically in Nuronus)
Retention & Cross-Border Transfers (art. 17, 23)
- ✓Destroy or anonymize personal information once purposes are fulfilled
- ✓Assess privacy factors before transferring data outside Quebec
- ✓Document retention schedules and transfer safeguards
How It Works
Loi 25 Readiness in Four Phases
Scope & Assign the Privacy Officer
Identify each client's personal-information holdings and formally assign the Privacy Officer role, the anchor of every Loi 25 program.
Assess Against Loi 25
Run an assessment across governance, consent, incidents, individual rights, security measures, and transfers. Automatically score security measures and flag documentation gaps.
Build Policies & Run PIAs
Use the AI policy generator to build governance and consent documentation, and complete privacy impact assessments (EFVP) for projects and cross-border transfers.
Deliver & Monitor
Hand off an audit-ready readiness report in French, then run continuous monitoring and incident tracking to keep the client compliant between reviews.
FAQ
Loi 25 Compliance for MSPs, Answered
What is Quebec Loi 25?
Loi 25 is Quebec's Act to modernize legislative provisions as regards the protection of personal information, formerly known as Bill 64. It's the toughest private-sector privacy law in Canada, phased in from 2022 to 2024 and enforced by the Commission d'accès à l'information (CAI). It sets obligations for privacy governance, consent, confidentiality-incident reporting, individual rights, security measures, and transfers of personal information outside Quebec.
Who has to comply with Loi 25?
Any business that collects, uses, or holds the personal information of Quebec residents falls under Loi 25 — regardless of where the business itself is located. Because obligations and client communications often need to be handled in French, Quebec businesses frequently need a compliance provider that operates in French, which Nuronus does.
What are the penalties under Loi 25?
Penalties are severe. The CAI can impose administrative monetary penalties of up to $10M or 2% of worldwide turnover, whichever is greater, and penal fines can reach $25M or 4% of worldwide turnover. That makes Loi 25 readiness a genuine risk-management need for Quebec clients, not a nice-to-have.
Can an MSP deliver Loi 25 compliance as a service?
Yes. MSPs are well positioned to deliver Loi 25 readiness — appointing a Privacy Officer, running privacy impact assessments, mapping security measures, managing confidentiality incidents, and producing a readiness report. Nuronus gives you the platform to do this repeatably across clients, in French, and charge for it as a managed service. Loi 25 is a documentation and policy program alongside the automatically scored security measures under art. 10.
Does Nuronus support other frameworks besides Loi 25?
Yes — eleven frameworks in total: HIPAA, SOC 2, PCI DSS, NIST CSF, ISO 27001, CIS Controls v8, CJIS, CMMC, FERPA, PIPEDA, and Loi 25 (Quebec Law 25). All map to one underlying control set, so a single assessment covers every framework a client falls under. Nuronus is also fully localized in Canadian French (fr-CA), so Quebec deliverables are produced in French.
Own Loi 25 Compliance for Quebec MSPs
Add a service most compliance platforms can't even offer. Deliver Loi 25 readiness in French, keep your Quebec clients out of the CAI's crosshairs, and bill it as recurring revenue. Start free with 2 clients — the full platform, no credit card.
Free for 2 clients. Then flat per-client pricing from $99/month — no per-endpoint fees.