What we build
Quebec's Law 25 places specific obligations on businesses handling personal information: obtaining clear consent, keeping a register of processing activities, enabling data portability and reporting confidentiality incidents. Building those requirements into software from the design stage costs far less than adding them after the product ships.
Compliance is a legal matter, and Nexnet is not a law firm. What we do is the technical half of the problem: turning the obligations your legal advisor has identified into mechanisms that actually exist in the software, rather than into a policy posted on a page.
The gap between those two is what gets expensive. A privacy policy promising deletion on request is worth nothing if the system doesn't know where one person's data lives. Planning for that question while designing the database takes an hour; solving it two years later takes a project.
We don't draft your policies, we don't tell you what your legal obligations are, and we don't certify you as compliant. Those three belong to a legal advisor. Our part starts when the software has to actually do what those documents promise.
The questions we get
It applies to any business operating in Quebec that holds personal information, whatever its size — customers, employees or suppliers. How far the obligations extend depends on what you collect. That's a legal question: put it to an advisor, not a developer.
Often yes, but the cost depends on how the data was structured to begin with. The hard part is rarely the interface: it's being able to find all of one person's data in a system never designed for it.
The law frames communication of information outside Quebec through a privacy impact assessment; it doesn't forbid it outright. Technically we can host in Quebec, elsewhere in Canada, or on your premises — the choice is made with your legal advisor.
The law provides that a person be informed when a decision concerning them is made exclusively by automated processing, and be able to submit observations. In practice, a product that decides automatically must be able to explain itself and allow human review — that's designed in, not bolted on.
Free assessment
In 60 minutes you leave with a reading of your processes, the opportunities that justify a product, and an order of magnitude for cost and timeline. No commitment.
Reply within 24 hours · No commitment · Confidential