Transfer assessment
When to use it: Before any personal information leaves Canada, or when you inherit a Law 25 "outside Quebec" assessment that never examined the Canada-origin path.
Bill C-36 Hub
Working templates
Six working documents that turn the bill's proposed duties into repeatable practice. Each one downloads as Markdown: fill it in, adapt it to your program, keep it as evidence. Built from the Law 25-to-C-36 readiness playbook.
Status: Bill C-36 is at second reading in the House of Commons. Proposed legislation, not law. These templates prepare you for what the bill proposes; they certify nothing. Have counsel validate legal conclusions before you rely on them.
Legitimate-interest assessment
When to use it: Before relying on the proposed legitimate-interest consent exception, which would require a recorded interest, a PIA, an adverse-effect analysis, and mitigations.
Privacy impact assessment
When to use it: For new or materially changed systems, legitimate-interest uses, and transfers outside Canada. One core PIA with jurisdictional modules, not a Quebec copy and a federal copy.
Vendor review
When to use it: Before signing or renewing any service provider that touches personal information, and to test whether "deletion supported" is actually true.
Incident record
When to use it: From the moment a suspected incident is discovered, through notification, remediation, and lessons learned. One record, started early.
Board memo
When to use it: When you need executive sponsorship for the readiness program, quarterly status reporting, or a formal decision on accepted residual risk.