Loi 25 compliance = GDPR with maple syrup? No, thanks. Here is the 60-day battle plan.
Look, I’ll be honest with you. When I first heard about Quebec’s Loi 25 (formerly Bill 64), I panic. It sounded like GDPR but with maple syrup, and honestly, none of us in the SaaS world has time for more red tape. But here we are. If you have customers in Quebec—and lets be real, if your a Canadian SaaS, you do—you cant ignore this. The fines are insane (up to $25 million or 4% of your global revenue, whichever is bigger), and honestly, the reputational risk is worse.
So, I sat down with my team, and we figured out a way to tackle this beast without hiring a army of lawyers. You can actually automate about 80% of this stuff if your smart about it. We did it in roughly two months. Here is exactly how we did it, warts and all. Maybe it helps you sleep better at night.
The Reality Check (Day 0)
First off, stop thinking you can manual this. You cant. Spreadsheets are where compliance dreams go to die. Loi 25 requires you to track consent, log every single “confidentiality incident” (thats fancy talk for data breach), and handle data portability requests. If you try to do this with Excel, you will fail. And you will cry.
So, the goal here is Automation. We need tools that talk to each other. We need a plan.
Here is the 60-day roadmap we used. Its tight, but its doable.
Days 1–14
Phase 1: The “Oh God, Where Is Our Data?” Phase
The first two weeks are purely about visibility. You cant protect what you dont know you have.
1. Appoint the “Fall Guy” (Privacy Officer)
Under Loi 25, if you dont appoint a Privacy Officer, the CEO is automatically responsible. Trust me, your CEO does not want this job. They are busy raising funds or yelling about churn.
Action: Appoint someone. It can be your CTO, a complience manager, or even a lead dev who lost a bet. Just make it official.
2. Data Mapping (The Hard Part)
You need to know where Quebec user data lives. Is it in AWS? HubSpot? That random Google Sheet the marketing intern made three years ago?
Goal: By day 14, you should have a “Record of Processing Activities” (ROPA). It sounds boring because it is, but its legally required.
Days 15–30
Phase 2: The “Please Click Yes” Phase
Now that we know where the data is, we have to ask people if we can keep it. Loi 25 is strict. You cant use “implied consent” anymore. No more pre-checked boxes. That stuff is illegal now.
3. The Cookie Banner from Hell
You know those annoying popups? You need one. But for Quebec, it has to be specific. You have to give them a choice to say NO to everything except essential cookies.
The Fix: We implemented a Consent Management Platform (CMP). There’s a bunch of them—OneTrust, Cookiebot, Osano. Important: You must set the default to “OFF” for tracking.
4. Update Privacy Policies
Your privacy policy probably looks like it was written in 2015. It needs an update. It has to be written in “clear and simple language.” Loi 25 specifically says you cant use legalese that no one understands.
Human Tip: Write it like you are explaining it to your grandma. “We collect your email so we can send you invoices.” Simple.
Days 31–45
Phase 3: The “What If Everything Goes Wrong?” Phase
This is where Loi 25 gets really specific about risk.
5. Automate Privacy Impact Assessments (PIAs)
This is the big one. Loi 25 says if you move data outside Quebec (which you do, because your servers are probably in US East-1), you need a PIA. If you launch a new feature? PIA.
Why this matters: If the government audits you, they want to see that you thought about privacy before you shipped code. You dont need to be perfect, you just need to show your work.
6. The Incident Log
You need a registry of all “confidentiality incidents.”
Automation: Connect your PagerDuty or Sentry to a compliance log. If a database is accidentally exposed, log it automatically.
Warning: The law says you have to notify the commission (CAI) if there is a “risk of serious injury.” Not physical injury, but like… identity theft. Having this log automated saves you from scrambling when a breach happens.
Days 46–60
Phase 4: The “Let Me Out” Phase
The final stretch. This is about giving power back to the users.
7. DSAR Automation (Data Subject Access Requests)
Users have the right to ask “What do you know about me?” and “Delete me.”
The Fix: Build a self-serve portal. Or use a privacy tool that has a “Data Subject Portal.”
Loi 25 Nuance: As of September 2024, you also need “Data Portability.” This means giving them their data in a structured format (like JSON or CSV), not just a PDF.
8. The “Right to be Forgotten” Button
Quebec residents can ask you to de-index them or delete them.
Strategy: We set up a webhook. When a user clicks “Delete Account,” it fires a signal to Stripe (cancel sub), Intercom (delete chat logs), and our production DB.
🛠 Summary of the Tech Stack
To pull this off in 60 days without loosing our minds, here is what we used:
Conclusion: It’s Not About Being Perfect
Look, Loi 25 is scary on paper. But in reality, its just forcing us to have better data hygeine. The biggest hurdle wasn’t the technology; it was the culture. Getting engineers to care about “Privacy Impact Assessments” is hard. But once we explained that not doing it could cost us $10 million, they got on board pretty quick.
You have 60 days. Start with the Privacy Officer appointment today. Then get the cookie banner up. Then worry about the complex backend stuff. You can do this. And if you mess up a little? Just make sure you logged it in the Incident Register. The regulators are human too (I think), they just want to see that your trying.
Good luck. Your going to need it.
