Privacy & Data Governance

A typical Law 25 gap assessment for a mid-sized organization may run 3–4 weeks: mapping data flows and current controls, testing them against the law's requirements, then delivering a prioritized remediation roadmap. Larger or multi-brand environments can take longer. You'll know the timeline before we start — I confirm scope, timing, and commercial terms in the proposal after a short discovery call.

Yes. If your products or marketing target Quebec residents, Law 25 likely applies to you regardless of where you're incorporated. I help US teams understand which obligations follow the data — consent, privacy impact assessments, and breach notification — and build controls that satisfy both Quebec and US state privacy laws without duplicating work.

Absolutely — training is a first-class deliverable for me. I typically include working sessions so your people can run the PIA process, vendor reviews, and consent program after I leave. I've trained 450+ stakeholders, and my goal is always that the program survives without me, not that you need me forever.

Yes. My CIPP/C credential is Canada-specific, and I work hands-on with PIPEDA, Quebec Law 25, and practical GDPR-readiness patterns for Canadian organizations with cross-border data flows. I keep my guidance operational — what to actually do, in what order — rather than reciting statutes.

Yes. I design the program first, then optimize the platform to match it — PIA automation, vendor workflows, consent and cookie programs, and training so the tool reflects how your teams actually work. I've run OneTrust at enterprise scale and Ketch in a media environment, so I know where these platforms help and where they get in the way.

No. I provide governance, operational, and risk guidance — the machinery that makes compliance real day to day. For legal opinions or litigation positions, you need qualified counsel for your circumstances, and I'll tell you plainly when a question belongs with a lawyer.

With a short discovery call where we scope your data flows, accountability gaps, and urgency. From there I propose either a fixed-scope assessment or a roadmap-plus-implementation package — you'll see the full plan and price before committing to anything.