Most of the technical baseline overlaps with what you run for frameworks like HIPAA, SOC 2, or CIS Controls. The Quebec-specific part is the paperwork: the privacy officer designation, the PIAs, and the CAI-facing incident process.
Law 25 expectation | What it looks like in MSP work | Where Huntress fits |
Reasonable security safeguards | Layered security controls (identity and access, endpoint protection, timely offboarding), documented and reviewed on a set schedule, similar to the controls attested to in a SOC 2 Type 2 | The Huntress agentic platform brings endpoint, identity, and security posture protection together, so you can show clients which layers are in place and keep them current |
Spotting confidentiality incidents | Detect, investigate, and scope what was accessed | The platform pairs detection with 24/7 human-led AI-centric SOC investigation, giving you the signal and the detail |
Incident register and CAI decision | Record facts, timeline, and risk assessment | Incident reports and log data from the platform can be fed into the client’s register |
Staff handling of personal information | Security awareness training and simulated phishing awareness training | Security awareness training sits on the same platform, so training records live alongside your other evidence |
Vendor contracts and cross-border PIAs | Inventory, agreements, security documentation | Your inventory and security documentation give clients what they need to complete their PIAs and vendor reviews, and platform records back it up. If a client wants to reduce potential cross-border access to information that Huntress collects, Sensitive Data Mode can be used to restrict SOC access by permanently blocking specific file extensions from host data transfers. |
One thing worth saying plainly: No product makes anyone Law 25 compliant. Most of the law is governance, documentation, and decisions only your client can make. What tools do is produce the evidence that those decisions were backed by real security.
Turn Law 25 into a recurring service
If you sell this as a one-time policy pack, you’ll leave money and protection on the table. A better approach is a service that produces proof on a schedule:
- Initial engagement. Confirm the client’s privacy officer, map personal information and data flows (especially anything leaving Quebec), complete the needed PIAs, refresh service-provider agreements, set up the incident register and notification process, and update the privacy policy.
- Monthly. Review access and MFA, track new tools that need a PIA, log and triage potential incidents, and send the client a short summary.
- Annual. Refresh the data map and PIAs, run an incident tabletop, confirm training is done, and hand over a readiness report the client can show insurers or larger customers.
That same evidence helps with cyber insurance applications too, which increasingly ask about privacy programs, incident response testing, and vendor controls.
Law 25 and PIPEDA
If your clients operate across Canada, you’ll run into the federal law, Personal Information Protection and Electronic Documents Act (PIPEDA), as well. They share themes like consent, safeguards, and breach notification, but Quebec’s rules are stricter on assessments, portability, and penalties. Many MSPs offer a base Canadian privacy service and add a Quebec tier for clients with Quebec-resident data.
A quick Law 25 checklist for MSPs
- Do you know which clients have Quebec customers, employees, or data?
- Does each one have a named privacy officer, with contact info published?
- Do you have written service-provider agreements that cover the Law 25 basics?
- Have PIAs been done for systems and transfers that send data outside Quebec?
- Is there an incident register, and a documented path from “we found something” to “the client decides”?
- Is MFA enforced and documented across client environments?
- Are staff trained on handling personal information?
- Are privacy policies current, written in plain-language, and available in French where needed?
If you answered “I don’t know” to more than two, start there.
