Services

Service 01

Law 25 Compliance Audit

A bounded audit of your tool stack: which tools hold personal information, where that data actually lives, and what Law 25 requires you to change. Report only.

Start this engagement Estimate your project
Typical range:
4,500–9,500 CAD
Typical duration
2–3 Weeks

Target outcomes

  • 2–3 wk discovery call to written report
  • 100% of in-scope tools inventoried, data residency included
  • 0 obligation to buy the remediation from us

This is right for you if

  • You operate in Quebec and use Google Analytics, Typeform, SurveyMonkey, or Google Drive on systems that handle personal information
  • You've received or anticipate a CAI audit notice
  • You need to know where you actually stand before committing a remediation budget

Why TSI

  • Report only, and no lock-in: the audit stands on its own and does not oblige you to buy the remediation from us
  • Even a “you are already compliant” finding is a complete, valid deliverable
  • Fixed price agreed before the audit starts, scope bounded in writing

Reference scenario

A typical Quebec municipal services provider running Google Analytics on public portals, SurveyMonkey for citizen surveys, and Google Drive for document sharing. That is the CAI audit-risk profile this service line targets.

The audit returns a written report naming each non-compliant tool, where its data actually resides, a filled privacy impact assessment (PIA) checklist, and a remediation roadmap ordered by exposure. Implementing that roadmap is a separate engagement, scoped and quoted once you have the findings.

Illustrative reference scenario, not a completed TSI engagement.

What to expect

  • Week 1: Discovery call and scope confirmation, then a full inventory of your tools and the personal data flowing through each.
  • Week 2: Technical validation of data residency and API behaviour, tool by tool.
  • Weeks 2–3: Written audit report, filled PIA checklist, and a remediation roadmap ordered by exposure.
  • Implementation, if you want it, is scoped and quoted separately after the audit closes.

Delivery phases

  1. Discovery Call
  2. Tool & Data-Flow Inventory
  3. Technical Validation
  4. Audit Report
  5. Remediation Roadmap

Deliverables and technology

What you receive

  • Written compliance audit report
  • Inventory of every tool and where its data resides
  • List of non-compliant tools
  • Data residency gap analysis
  • Privacy impact assessment (PIA, EFVP in French) checklist, filled, for your legal team
  • Remediation roadmap ordered by exposure

Typical technology

  • Self-hosted web analytics, in place of Google Analytics
  • A self-hosted survey tool, in place of SurveyMonkey or Typeform
  • Self-hosted file sharing, in place of Google Drive
  • OVHcloud hosting in Beauharnois (Quebec)

What drives the price

Lower end

  • Single site
  • Under 500 users
  • Fewer than 10 tools in scope
  • No formal PIA support required

Upper end

  • Multi-site or multi-department
  • 2,000+ users
  • 20 or more tools in scope
  • Formal PIA package for your legal team

Biggest variable: Number of tools in scope × number of sites × PIA and documentation depth

Ready to talk about it?

Describe your situation, a person reads every message and answers with a proposed scope for the first phase.

Start this engagement All services