[{"data":1,"prerenderedAt":557},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"post-\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role":45,"post-alt-\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role":534,"post-rel-\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role":536},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"category":493,"date":494,"description":495,"extension":496,"faq":497,"keyword":510,"meta":511,"minutes":23,"navigation":317,"path":512,"rawbody":513,"seo":514,"sources":515,"stem":525,"tags":526,"translationKey":531,"updated":532,"__hash__":533},"blog_en\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role.md","Québec Privacy Officer Under Law 25: The Security Role",{"type":49,"value":50,"toc":484},"minimark",[51,55,58,61,82,87,90,93,101,104,107,111,114,203,206,210,213,289,292,295,299,303,306,393,396,400,403,450,453,457,474,481],[52,53,54],"p",{},"At your 30-person company, who is in charge of protecting personal information? If nobody has signed anything, the answer is simple: the president or CEO. Section 3.1 of the Act, as amended by Law 25, assigns the role by default to the person exercising the highest authority. Plenty of executives find out the day an incident hits.",[52,56,57],{},"At other SMBs, the role was handed off in a hurry to the office manager “because she already looks after the computers.” Her title is on the website, but she has neither the budget nor the authority to make the sales director turn on MFA.",[52,59,60],{},"Yet the Act puts this person at the centre of several security decisions. In English, the statute calls the role the “person in charge of the protection of personal information”; most people just say privacy officer. Here is what the role involves on the security side, and how to equip it.",[62,63,66],"callout",{"title":64,"type":65},"TL;DR","tip",[67,68,69,73,76,79],"ul",{},[70,71,72],"li",{},"By default, the privacy officer is the person with the highest authority; they can delegate the function in writing, in whole or in part (s. 3.1).",[70,74,75],{},"The officer’s title and contact information must be published on the company website.",[70,77,78],{},"The officer is involved in privacy impact assessments (s. 3.3), injury assessment during incidents (s. 3.7) and receiving breach notices from vendors (s. 18.3).",[70,80,81],{},"Delegating does not transfer accountability: senior management remains responsible.",[83,84,86],"h2",{"id":85},"who-holds-the-role-by-default-and-how-to-delegate","Who holds the role by default, and how to delegate",[52,88,89],{},"Section 3.1 is clear: the business is responsible for the personal information it holds, and the person with the highest authority ensures the Act is complied with. That person exercises the privacy officer function but may delegate all or part of it, in writing, to any person.",[52,91,92],{},"The CAI stresses two points:",[67,94,95,98],{},[70,96,97],{},"even after delegating, the person with the highest authority remains accountable for compliance;",[70,99,100],{},"they must back the delegate with the necessary human, technical and financial resources.",[52,102,103],{},"In practice, delegate to someone who can make things happen: secure a budget, impose a rule on a manager, pause a project. Delegation without authority is delegation in name only.",[52,105,106],{},"If your business is also subject to federal PIPEDA, its accountability principle likewise requires designating someone responsible for compliance. Aligning both roles in one person usually makes sense.",[83,108,110],{"id":109},"the-officers-security-related-duties","The officer’s security-related duties",[52,112,113],{},"The Act and the CAI assign the privacy officer several functions. These have a direct security dimension:",[115,116,117,133],"table",{},[118,119,120],"thead",{},[121,122,123,127,130],"tr",{},[124,125,126],"th",{},"Duty",[124,128,129],{},"Section",[124,131,132],{},"What it means for security",[134,135,136,148,159,170,181,192],"tbody",{},[121,137,138,142,145],{},[139,140,141],"td",{},"Approve governance policies",[139,143,144],{},"3.2",[139,146,147],{},"Sign off on retention, destruction and staff roles",[121,149,150,153,156],{},[139,151,152],{},"Be consulted from the start of any system project",[139,154,155],{},"3.3",[139,157,158],{},"Ask the security questions before the purchase, not after",[121,160,161,164,167],{},[139,162,163],{},"Assess the risk of injury after an incident",[139,165,166],{},"3.7",[139,168,169],{},"Join the triage with IT, often under pressure",[121,171,172,175,178],{},[139,173,174],{},"Record disclosures made to reduce a risk",[139,176,177],{},"3.5",[139,179,180],{},"Keep track of information shared with a bank or an expert",[121,182,183,186,189],{},[139,184,185],{},"Receive breach notices from vendors",[139,187,188],{},"18.3",[139,190,191],{},"Be the named contact in vendor contracts",[121,193,194,197,200],{},[139,195,196],{},"Answer access requests within 30 days",[139,198,199],{},"30 and 32",[139,201,202],{},"Verify the requester’s identity so you do not cause an incident yourself",[52,204,205],{},"That last point is often overlooked. A fake access request from someone posing as a client is a very real social engineering technique. The Act requires requests to be made in writing by a person who proves their identity (s. 30).",[83,207,209],{"id":208},"privacy-officer-and-it-who-does-what","Privacy officer and IT: who does what",[52,211,212],{},"The privacy officer does not need to configure a firewall. Their job is to make sure the right decisions are made and documented. Here is a realistic split in an SMB that relies on a managed service provider:",[115,214,215,231],{},[118,216,217],{},[121,218,219,222,225,228],{},[124,220,221],{},"Activity",[124,223,224],{},"Leadership",[124,226,227],{},"Privacy officer",[124,229,230],{},"IT or MSP",[134,232,233,247,261,275],{},[121,234,235,238,241,244],{},[139,236,237],{},"Choose security measures",[139,239,240],{},"Funds",[139,242,243],{},"Validates against information sensitivity",[139,245,246],{},"Proposes and prices",[121,248,249,252,255,258],{},[139,250,251],{},"Configure MFA, backups, access",[139,253,254],{},"Informed",[139,256,257],{},"Checks it is done",[139,259,260],{},"Implements",[121,262,263,266,269,272],{},[139,264,265],{},"Incident triage",[139,267,268],{},"Decides on notices",[139,270,271],{},"Assesses injury, keeps the register",[139,273,274],{},"Detects, contains, provides logs",[121,276,277,280,283,286],{},[139,278,279],{},"Staff training",[139,281,282],{},"Supports",[139,284,285],{},"Organizes",[139,287,288],{},"Provides technical content",[52,290,291],{},"One piece of advice: avoid naming your MSP as privacy officer. They would end up assessing their own work.",[52,293,294],{},"Section 18.3 also gives the officer an underused lever. Any vendor you entrust with personal information under a mandate or service contract must notify the officer without delay of any breach or attempted breach of confidentiality, and must allow the officer to carry out any verification relating to that confidentiality (exceptions exist, for example for members of a professional order). For a Gatineau engineering firm that outsources payroll, HR files and cloud hosting to three different vendors, that is solid footing to ask for a SOC 2 report, an access list or penetration test results.",[296,297],"cta",{"variant":298},"audit",[83,300,302],{"id":301},"the-officers-quarterly-dashboard","The officer’s quarterly dashboard",[52,304,305],{},"Once a quarter, the privacy officer should be able to answer these questions, with evidence:",[67,307,310,321,328,335,342,349,362,374,381],{"className":308},[309],"contains-task-list",[70,311,314,320],{"className":312},[313],"task-list-item",[315,316],"input",{"disabled":317,"type":318,"aria-label":319},true,"checkbox","What share of accounts is protected by MFA? (Target: 100%.)"," What share of accounts is protected by MFA? (Target: 100%.)",[70,322,324,327],{"className":323},[313],[315,325],{"disabled":317,"type":318,"aria-label":326},"Has the list of admin accounts been reviewed?"," Has the list of admin accounts been reviewed?",[70,329,331,334],{"className":330},[313],[315,332],{"disabled":317,"type":318,"aria-label":333},"Have all departed employees’ accounts been disabled?"," Have all departed employees’ accounts been disabled?",[70,336,338,341],{"className":337},[313],[315,339],{"disabled":317,"type":318,"aria-label":340},"When was the last successful backup restore test?"," When was the last successful backup restore test?",[70,343,345,348],{"className":344},[313],[315,346],{"disabled":317,"type":318,"aria-label":347},"Are critical patches applied on workstations and servers?"," Are critical patches applied on workstations and servers?",[70,350,352,355,356,361],{"className":351},[313],[315,353],{"disabled":317,"type":318,"aria-label":354},"What new entries are in the incident register, and were the promised measures carried out?"," What new entries are in the ",[357,358,360],"a",{"href":359},"\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template","incident register",", and were the promised measures carried out?",[70,363,365,368,369,373],{"className":364},[313],[315,366],{"disabled":317,"type":318,"aria-label":367},"Which current projects require a privacy impact assessment?"," Which current projects require a ",[357,370,372],{"href":371},"\u002Fen\u002Fblog\u002Fprivacy-impact-assessment-pia-quebec-security","privacy impact assessment","?",[70,375,377,380],{"className":376},[313],[315,378],{"disabled":317,"type":318,"aria-label":379},"Do new vendor contracts include security and notice clauses?"," Do new vendor contracts include security and notice clauses?",[70,382,384,387,388,392],{"className":383},[313],[315,385],{"disabled":317,"type":318,"aria-label":386},"What were the results of the latest phishing simulation or training?"," What were the results of the latest ",[357,389,391],{"href":390},"\u002Fen\u002Fblog\u002Fphishing-simulation-employees","phishing simulation"," or training?",[52,394,395],{},"Present this dashboard to leadership. It is also what the CAI expects from engaged management: approving security measures, promoting them and providing resources.",[83,397,399],{"id":398},"written-delegation-template","Written delegation template",[52,401,402],{},"The Act requires delegation in writing but sets no format. Here is a starting point to adapt:",[404,405,406,447],"blockquote",{},[52,407,408,409,413,414,417,418,421,422,413,424,426,427,430,431,434,435,438,439,442,443,446],{},"I, ",[410,411,412],"span",{},"name",", ",[410,415,416],{},"title",", as the person exercising the highest authority within ",[410,419,420],{},"company",", delegate to ",[410,423,412],{},[410,425,416],{},", effective ",[410,428,429],{},"date",", the function of person in charge of the protection of personal information under section 3.1 of the Act respecting the protection of personal information in the private sector, ",[410,432,433],{},"in full \u002F for the following functions: …",". ",[410,436,437],{},"Name"," will have the following resources: ",[410,440,441],{},"time allocated, budget, access to our IT provider",". They will report to leadership ",[410,444,445],{},"quarterly",".",[52,448,449],{},"Signature and date.",[52,451,452],{},"Name a backup for absences, too: an incident during the construction holiday in late July will not wait for anyone to get back from the cottage. Keep the signed document with your governance policies.",[83,454,456],{"id":455},"pitfalls-to-avoid","Pitfalls to avoid",[67,458,459,462,465,468,471],{},[70,460,461],{},"Delegating to someone with no authority over managers or budget.",[70,463,464],{},"Publishing a personal email or cell number instead of role-based contact details.",[70,466,467],{},"Forgetting to update the website and vendor contracts when the officer leaves.",[70,469,470],{},"Letting the officer discover new software only after it has been bought.",[70,472,473],{},"Treating the role as a one-time task rather than an ongoing function.",[52,475,476,477,480],{},"This article explains Law 25 in plain terms and is not legal advice: validate your delegation and role split with your legal counsel. If your privacy officer needs regular technical backup, ",[357,478,479],{"href":25},"our ongoing security partner service"," can act as their right hand.",[296,482],{"variant":483},"devis",{"title":485,"searchDepth":11,"depth":15,"links":486},"",[487,488,489,490,491,492],{"id":85,"depth":11,"text":86},{"id":109,"depth":11,"text":110},{"id":208,"depth":11,"text":209},{"id":301,"depth":11,"text":302},{"id":398,"depth":11,"text":399},{"id":455,"depth":11,"text":456},"compliance","2026-10-24","The privacy officer role under Québec’s Law 25, from a security angle: default holder, written delegation, security duties, a quarterly dashboard and template.","md",[498,501,504,507],{"q":499,"a":500},"Does the privacy officer need a certification?","No. The Act requires no degree or certification. The CAI does recommend choosing someone with the required skills and significant decision-making power. Privacy training and a grounding in information security are strong assets.",{"q":502,"a":503},"Can we give the role to an outside consultant?","Yes. The Act allows the function to be delegated in writing, in whole or in part, to any person, including someone outside the business. The person with the highest authority still remains responsible for implementing the Act. An external officer needs to know your operations well and be quickly reachable during an incident; have the arrangement reviewed by your legal counsel.",{"q":505,"a":506},"Can a company director be held personally liable?","The Act provides that a director, officer or representative of a legal person who ordered or authorized the act or omission constituting an offence, or who consented to it, is party to the offence (s. 93). That is liability tied to participating in the offence, not automatic liability. Check your situation with your legal counsel.",{"q":508,"a":509},"Do we have to publish the privacy officer’s name on our website?","The Act requires publishing their title and contact information (s. 3.1), not necessarily their name. A role-based address such as privacy@yourcompany.ca means you do not have to update the site every time the person changes.","privacy officer Quebec",{},"\u002Fen\u002Fblog\u002Fprivacy-officer-quebec-security-role","---\ntitle: \"Québec Privacy Officer Under Law 25: The Security Role\"\ndescription: \"The privacy officer role under Québec’s Law 25, from a security angle: default holder, written delegation, security duties, a quarterly dashboard and template.\"\ndate: 2026-10-24\ncategory: compliance\ntags: [\"law 25\", \"governance\", \"privacy officer\", \"smb\"]\ntranslationKey: responsable-rp\nkeyword: \"privacy officer Quebec\"\nfaq:\n  - q: \"Does the privacy officer need a certification?\"\n    a: \"No. The Act requires no degree or certification. The CAI does recommend choosing someone with the required skills and significant decision-making power. Privacy training and a grounding in information security are strong assets.\"\n  - q: \"Can we give the role to an outside consultant?\"\n    a: \"Yes. The Act allows the function to be delegated in writing, in whole or in part, to any person, including someone outside the business. The person with the highest authority still remains responsible for implementing the Act. An external officer needs to know your operations well and be quickly reachable during an incident; have the arrangement reviewed by your legal counsel.\"\n  - q: \"Can a company director be held personally liable?\"\n    a: \"The Act provides that a director, officer or representative of a legal person who ordered or authorized the act or omission constituting an offence, or who consented to it, is party to the offence (s. 93). That is liability tied to participating in the offence, not automatic liability. Check your situation with your legal counsel.\"\n  - q: \"Do we have to publish the privacy officer’s name on our website?\"\n    a: \"The Act requires publishing their title and contact information (s. 3.1), not necessarily their name. A role-based address such as privacy@yourcompany.ca means you do not have to update the site every time the person changes.\"\nsources:\n  - title: \"Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), ss. 3.1 to 3.8, 18.3 and 93\"\n    url: \"https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1\"\n  - title: \"CAI — Business responsibilities and functions of the person in charge of the protection of personal information (French)\"\n    url: \"https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fprotection-renseignements-personnels\u002Finformation-entreprises-privees\u002Fresponsable-protection-renseignements-personnels-entreprise\"\n  - title: \"CAI — Preventing confidentiality incidents: checklist for businesses (French, January 2026)\"\n    url: \"https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fuploads\u002Fpdfs\u002FCAI_FIC_ENTR_Prevention_incidents.pdf\"\n---\n\nAt your 30-person company, who is in charge of protecting personal information? If nobody has signed anything, the answer is simple: the president or CEO. Section 3.1 of the Act, as amended by Law 25, assigns the role by default to the person exercising the highest authority. Plenty of executives find out the day an incident hits.\n\nAt other SMBs, the role was handed off in a hurry to the office manager “because she already looks after the computers.” Her title is on the website, but she has neither the budget nor the authority to make the sales director turn on MFA.\n\nYet the Act puts this person at the centre of several security decisions. In English, the statute calls the role the “person in charge of the protection of personal information”; most people just say privacy officer. Here is what the role involves on the security side, and how to equip it.\n\n::callout{type=\"tip\" title=\"TL;DR\"}\n- By default, the privacy officer is the person with the highest authority; they can delegate the function in writing, in whole or in part (s. 3.1).\n- The officer’s title and contact information must be published on the company website.\n- The officer is involved in privacy impact assessments (s. 3.3), injury assessment during incidents (s. 3.7) and receiving breach notices from vendors (s. 18.3).\n- Delegating does not transfer accountability: senior management remains responsible.\n::\n\n## Who holds the role by default, and how to delegate\n\nSection 3.1 is clear: the business is responsible for the personal information it holds, and the person with the highest authority ensures the Act is complied with. That person exercises the privacy officer function but may delegate all or part of it, in writing, to any person.\n\nThe CAI stresses two points:\n\n- even after delegating, the person with the highest authority remains accountable for compliance;\n- they must back the delegate with the necessary human, technical and financial resources.\n\nIn practice, delegate to someone who can make things happen: secure a budget, impose a rule on a manager, pause a project. Delegation without authority is delegation in name only.\n\nIf your business is also subject to federal PIPEDA, its accountability principle likewise requires designating someone responsible for compliance. Aligning both roles in one person usually makes sense.\n\n## The officer’s security-related duties\n\nThe Act and the CAI assign the privacy officer several functions. These have a direct security dimension:\n\n| Duty | Section | What it means for security |\n|---|---|---|\n| Approve governance policies | 3.2 | Sign off on retention, destruction and staff roles |\n| Be consulted from the start of any system project | 3.3 | Ask the security questions before the purchase, not after |\n| Assess the risk of injury after an incident | 3.7 | Join the triage with IT, often under pressure |\n| Record disclosures made to reduce a risk | 3.5 | Keep track of information shared with a bank or an expert |\n| Receive breach notices from vendors | 18.3 | Be the named contact in vendor contracts |\n| Answer access requests within 30 days | 30 and 32 | Verify the requester’s identity so you do not cause an incident yourself |\n\nThat last point is often overlooked. A fake access request from someone posing as a client is a very real social engineering technique. The Act requires requests to be made in writing by a person who proves their identity (s. 30).\n\n## Privacy officer and IT: who does what\n\nThe privacy officer does not need to configure a firewall. Their job is to make sure the right decisions are made and documented. Here is a realistic split in an SMB that relies on a managed service provider:\n\n| Activity | Leadership | Privacy officer | IT or MSP |\n|---|---|---|---|\n| Choose security measures | Funds | Validates against information sensitivity | Proposes and prices |\n| Configure MFA, backups, access | Informed | Checks it is done | Implements |\n| Incident triage | Decides on notices | Assesses injury, keeps the register | Detects, contains, provides logs |\n| Staff training | Supports | Organizes | Provides technical content |\n\nOne piece of advice: avoid naming your MSP as privacy officer. They would end up assessing their own work.\n\nSection 18.3 also gives the officer an underused lever. Any vendor you entrust with personal information under a mandate or service contract must notify the officer without delay of any breach or attempted breach of confidentiality, and must allow the officer to carry out any verification relating to that confidentiality (exceptions exist, for example for members of a professional order). For a Gatineau engineering firm that outsources payroll, HR files and cloud hosting to three different vendors, that is solid footing to ask for a SOC 2 report, an access list or penetration test results.\n\n::cta{variant=\"audit\"}\n::\n\n## The officer’s quarterly dashboard\n\nOnce a quarter, the privacy officer should be able to answer these questions, with evidence:\n\n- [ ] What share of accounts is protected by MFA? (Target: 100%.)\n- [ ] Has the list of admin accounts been reviewed?\n- [ ] Have all departed employees’ accounts been disabled?\n- [ ] When was the last successful backup restore test?\n- [ ] Are critical patches applied on workstations and servers?\n- [ ] What new entries are in the [incident register](\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template), and were the promised measures carried out?\n- [ ] Which current projects require a [privacy impact assessment](\u002Fen\u002Fblog\u002Fprivacy-impact-assessment-pia-quebec-security)?\n- [ ] Do new vendor contracts include security and notice clauses?\n- [ ] What were the results of the latest [phishing simulation](\u002Fen\u002Fblog\u002Fphishing-simulation-employees) or training?\n\nPresent this dashboard to leadership. It is also what the CAI expects from engaged management: approving security measures, promoting them and providing resources.\n\n## Written delegation template\n\nThe Act requires delegation in writing but sets no format. Here is a starting point to adapt:\n\n> I, [name], [title], as the person exercising the highest authority within [company], delegate to [name], [title], effective [date], the function of person in charge of the protection of personal information under section 3.1 of the Act respecting the protection of personal information in the private sector, [in full \u002F for the following functions: …]. [Name] will have the following resources: [time allocated, budget, access to our IT provider]. They will report to leadership [quarterly].\n>\n> Signature and date.\n\nName a backup for absences, too: an incident during the construction holiday in late July will not wait for anyone to get back from the cottage. Keep the signed document with your governance policies.\n\n## Pitfalls to avoid\n\n- Delegating to someone with no authority over managers or budget.\n- Publishing a personal email or cell number instead of role-based contact details.\n- Forgetting to update the website and vendor contracts when the officer leaves.\n- Letting the officer discover new software only after it has been bought.\n- Treating the role as a one-time task rather than an ongoing function.\n\nThis article explains Law 25 in plain terms and is not legal advice: validate your delegation and role split with your legal counsel. If your privacy officer needs regular technical backup, [our ongoing security partner service](\u002Fen\u002Fservices\u002Fongoing-security-partner) can act as their right hand.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":495},[516,519,522],{"title":517,"url":518},"Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), ss. 3.1 to 3.8, 18.3 and 93","https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1",{"title":520,"url":521},"CAI — Business responsibilities and functions of the person in charge of the protection of personal information (French)","https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fprotection-renseignements-personnels\u002Finformation-entreprises-privees\u002Fresponsable-protection-renseignements-personnels-entreprise",{"title":523,"url":524},"CAI — Preventing confidentiality incidents: checklist for businesses (French, January 2026)","https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fuploads\u002Fpdfs\u002FCAI_FIC_ENTR_Prevention_incidents.pdf","en\u002Fblog\u002Fprivacy-officer-quebec-security-role",[527,528,529,530],"law 25","governance","privacy officer","smb","responsable-rp",null,"qrHaMzqbny8vYriEw9DbAhC2kmpiCkzcYKZeFiJaDAA",{"path":535},"\u002Fblogue\u002Fresponsable-protection-renseignements-personnels-securite",[537,543,551],{"path":538,"title":539,"description":540,"category":493,"minutes":23,"tags":541},"\u002Fen\u002Fblog\u002Finformation-security-policy-template-small-business","Information Security Policy Template for Small Business","A 12-section information security policy template you can adapt, who should sign it, how it ties into Quebec's Law 25 and PIPEDA, and the mistakes to avoid.",[542,528,527,530],"security policy",{"path":544,"title":545,"description":546,"category":493,"minutes":23,"tags":547},"\u002Fen\u002Fblog\u002Fevaluate-it-provider-security","How to Evaluate Your IT Provider's Security: 12 Questions","Your managed IT provider holds the keys to your business. Here are 12 questions to ask, what a good answer looks like, and what to put in the contract.",[548,549,550,527,530],"it provider","msp","supply chain",{"path":552,"title":553,"description":554,"category":493,"minutes":27,"tags":555},"\u002Fen\u002Fblog\u002Fquebec-law-25-cybersecurity-checklist","Quebec Law 25 Compliance Checklist: The Cybersecurity Side","A practical Quebec Law 25 compliance checklist for SMBs: governance, access control, technical safeguards, incident handling and vendors, mapped to the Act.",[527,493,556,530],"checklist",1792972905945]