Action Plan - Bill 25
Are you conforming with Bill 25?
At Propulsio 360, we believe that your company’s compliance with Bill 25 depends, above all, on personalized support and an understanding of your internal practices. That’s why we offer to draw up a concise, precise compliance plan tailored to your company’s practices.
Being proactive and documenting your compliance with Bill 25 is certainly the first step in avoiding the new monetary penalties from the Commission d’Accès à l’Information, which can run into the millions of dollars. Protecting personal information is also essential to your company’s reputation and credibility with your customers.
Action Plan - Bill 25
Taxes not included- Meeting with a lawyer
- A simplified account of your privacy and data protection practices
- Clear benchmarks for compliance with legal requirements
- A detailed action plan for your compliance
Are you looking to implement your action plan, or have you already identified specific needs?
Please refer to our additional services:
In addition to being a legal obligation, a company’s internal policies are the starting point for compliance with privacy legislation.
- Recommendations on your practices throughout the life cycle of personal information in your company (collection, access, use, retention, destruction)
- Drafting of fundamental and essential policies with regards to Bill 25
- Your privacy policy must accurately reflect your internal practices. It is an essential tool for informing people about your practices, but also for fulfilling your obligation to inform when collecting information from an individual.
- The new consent obligations require a review of your various means of collecting personal information.
- Have you received a complaint from one of your customers or a communication from the Commission d’Accès à l’Information? We’ll be happy to advise and support you.
Perhaps you’ve heard that your company is now required to have a confidentiality incident register in place? But did you know that in certain situations, your company must also notify the people affected by a confidentiality incident, as well as the Commission d’Accès à l’Information?
- Review of your procedures to identify a confidentiality incident and assess the legal need to inform the persons concerned.
- Drafting of a sample incident log and sample incident letters in line with current regulations and adapted to your business practices.
- Drafting of internal policies to recognize situations where there is a legal obligation to carry out such an assessment.
- Draft a PIA process and template adapted to your practice.
Some disclosures of personal information legally require an agreement between you and the company for which the information is intended. It’s also important to review your contractual protections (legal liability) in such a communication situation, whether your company is the communicating party or the one receiving the information.
Your customers can assert their rights under the Act respecting the protection of personal information. Putting a protocol in place to identify the nature of the request and the personal information concerned is therefore essential.
- Support in setting up a complaints handling process.
- Support in setting up a process for the various rights of data subjects (right of access, right of rectification, right to withdraw consent, etc.).
