Privacy & Data Governance

A typical Law 25 gap assessment for a mid-sized organization may run 3–4 weeks: mapping data flows and current controls, testing them against the law's requirements, then delivering a prioritized remediation roadmap. Larger or multi-brand environments can take longer. You'll know the timeline before we start – I confirm scope, timing, and commercial terms in the proposal after a short discovery call.

Yes. If your products or marketing target Quebec residents, Law 25 likely applies to you regardless of where you're incorporated. I help US teams understand which obligations follow the data (consent, privacy impact assessments, and breach notification) and build controls that satisfy both Quebec and US state privacy laws without duplicating work.

Absolutely. Training is a first-class deliverable for me. I typically include working sessions so your people can run the PIA process, vendor reviews, and consent program after I leave. I've trained 450+ stakeholders, and my goal is always that the program survives without me, not that you need me forever.

Yes. My CIPP/C credential is Canada-specific, and I work hands-on with PIPEDA, Quebec Law 25, and practical GDPR-readiness patterns for Canadian organizations with cross-border data flows. I keep my guidance operational: what to actually do, in what order, rather than reciting statutes.

Yes. I design the program first, then optimize the platform to match it: PIA automation, vendor workflows, consent and cookie programs, and training so the tool reflects how your teams actually work. I've run OneTrust at enterprise scale and Ketch in a media environment, so I know where these platforms help and where they get in the way.

No. I provide governance, operational, and risk guidance: the machinery that makes compliance real day to day. For legal opinions or litigation positions, you need qualified counsel for your circumstances, and I'll tell you plainly when a question belongs with a lawyer.

With a short discovery call where we scope your data flows, accountability gaps, and urgency. From there I propose either a fixed-scope assessment or a roadmap-plus-implementation package. You'll see the full plan and price before committing to anything.