Québec Law 25 compliance platform — assessment engine, gap analysis, action planning, evidence vault, and template library

The problem

Québec's Law 25 requires private-sector organisations to document, assess, and act on personal data practices across nine compliance domains. Most businesses have no idea where to start, lack internal expertise to run a structured assessment, and can't afford legal consultants for the full process.

Approach

• Guided assessment organized around the major Law 25 readiness themes, with conditional questions and save-and-resume support
• Automated gap analysis that turns incomplete controls into prioritized, understandable findings
• Phased action planning with ownership, due dates, priority, and progress tracking
• Evidence management linked to assessments and remediation work
• Starter document library covering common privacy-governance needs
• Team access and bilingual reporting designed for accountable collaboration
• Portable FastAPI and PostgreSQL architecture with authorization enforced throughout the application

Outcome

• End-to-end Law 25 compliance workflow in one product — structured assessment, prioritised findings, phased action plan, and supporting documentation without a consultant
• Business-type-specific guidance (website, office, salon) ensures recommendations are relevant rather than generic — the platform adapts its findings and action items to the organisation's actual context
• Portable deployment model supports client-owned hosting and documented handoff