Template and samples
Law 25 privacy impact assessment template and samples
Québec’s Law 25 sets no required format for a privacy impact assessment (an EFVP, in French). The Commission d’accès à l’information publishes a template, and our generator follows it in seven sections. Here is what each one holds, then seven complete assessments of common projects.
The template, section by section
- 01
Purpose and scope
What the project is, why the organisation undertakes it, and what the assessment covers and leaves out. It also justifies how deep the review goes, in proportion to the sensitivity, purpose, quantity, distribution and medium of the information.
- 02
Personal information concerned
The inventory of personal information: what it is, whom it is about, its nature and its sensitivity.
- 03
Data flows
The path the information takes, in order: who collects it, which vendors receive it and where, who can see it, and how long it is kept.
- 04
Findings and risks
For each requirement of the law, the organisation’s answer and the section at issue, then the risks, rated by severity and likelihood.
- 05
Communication outside Québec
For each vendor outside Québec, the four factors of section 17: the sensitivity of the information, the purpose, the protection measures, contractual ones included, and the legal framework where it goes.
- 06
Measures adopted
The measures that answer the findings and reduce the risks.
- 07
Conclusion
What the assessment brought to light, what remains to be confirmed, and the adoption of the document under the authority of the person in charge of the protection of personal information.
Seven complete samples
The organisations, people and answers are fictional. Each document is the one the generator produced: the findings come from hand-written rules, and the purpose, data flows and conclusion were drafted by the tool from the answers.
Adoption of an artificial intelligence tool
AI scribe in consultations
A US-hosted AI scribe listens to consultations, and the contract with the vendor is not signed yet.
5 findings · 6 measures
Acquisition or development of an information system
Client list in a US-hosted CRM
A small business moves its client list to a US-hosted CRM. The risk hides in the free-text notes field.
5 findings · 5 measures
Acquisition or development of an information system
Moving email and documents to Microsoft 365
An accounting firm puts its clients’ SINs in Microsoft 365 without knowing which province will store them.
4 findings · 3 measures
Acquisition or development of an information system
Cloud payroll and human resources platform
An 80-employee business hands its payroll to a platform hosted in Ontario, which the law counts as outside Québec.
2 findings · 5 measures
Overhaul of an existing system
Website redesign and its quote request form
A contractor redesigns its site. The quote form receives photos of homes and goes through three American vendors.
2 findings · 5 measures
Adoption of an artificial intelligence tool
AI chat agent on the website
A brokerage adds an AI agent to its website. The provider is in Québec, but the language model runs in the United States.
4 findings · 5 measures
Acquisition or development of an information system
New dental practice management software
A dental clinic adopts software hosted in Québec. Children’s health records, and yet only two findings.
2 findings · 4 measures
Now your project
You describe your project, the tool asks the questions and applies the law, and you leave with the same document in Word and PDF.
CAD 499 per project, plus taxes