Know your information.
Organize categories and purposes. Identify sensitive information and uses involving automated decisions.
P-39.1 · art. 14, 12.1A-2.1 · art. 53.1, 65.2
Agreely · The Platform
Law 25.
Law 25.
Put it
into practice.
Your practices become policies. Your policies get a public home. Requests reach the right place. Your Law 25 work, together in one workspace.
30-day trial, no card, no commitment. One trial per business.
From collection to accountability
Fewer scattered files.
Fewer scattered files.
A clearer picture.
The information you collect, the policies you publish and the requests you receive. Follow the same thread from everyday work to your accountability dossier.
01
Describe your practices.
A catalog of information and purposes that informs policies for each product and your whole organization.
02Inform the right people.
Publish policies on your public page and record the methods you used to distribute them.
03Keep track of what follows.
Rights requests, incidents and registers share the same workspace as your policies.
From your practices to your public
It starts with what you do.
01
Describe your practices.
Categories, purposes and retention periods: describe your information and connect it to your products or services. This foundation informs policies that reflect your activities.
02
Generate your policies.
Generate an organization-wide or product-specific privacy policy from your catalog. Review the text, then publish a version you can refer back to.
03
Publish and distribute.
Agreely hosts your policies at a public address. Link to it from your website, then record the channels and distribution methods you used.
04
Receive the requests.
Your public page’s form routes rights requests to Agreely. Once the email is confirmed, requests enter your register for your team to track and handle.
05
Collect an informed choice.
When a purpose requires consent, send a dedicated request. The person reviews the purposes on their device and confirms their choice with a passkey. Their decision produces a signed receipt they can return to.
The tools, close at handLaw 25 has many parts.
Law 25 has many parts.
So does your platform.
From the first information collected to your auditor’s dossier. Find tools for every step in one workspace.
A-2.1 · art. 53.1, 65.2
Policies built from your practices.
Generate organization-wide or product-specific privacy policies from your catalog. Review, publish and retain each version.
P-39.1 · art. 8.2A-2.1 · art. 63.4
Every request, followed through.
Your public page’s form feeds the register after email confirmation. Track requests and their deadlines.
P-39.1 · art. 27, 32A-2.1 · art. 83, 84, 98
Make responsibilities clear.
Identify your privacy officer and publish governance and privacy policies, with their history.
P-39.1 · art. 3.1, 3.2, 8.2A-2.1 · art. 52.2, 8, 63.3, 63.4
An incident. A documented response.
Record the facts, risk assessment, actions taken and notices in one register.
P-39.1 · art. 3.5 to 3.8A-2.1 · art. 63.8 to 63.11
Keep information with a rule.
Associate categories with retention rules and document destruction obligations and attestations.
P-39.1 · art. 23A-2.1 · art. 73
Assess before moving forward.
Document project and cross-border privacy assessments, chosen safeguards and your conclusions.
P-39.1 · art. 3.3, 3.4, 17A-2.1 · art. 63.5, 63.6, 70.1
Document uses and providers.
Maintain provider and secondary-use registers, together with the agreements and reasons supporting them.
P-39.1 · art. 18.3, 12A-2.1 · art. 67.2, 65.1
A choice for each purpose.
Collect separate decisions, with dedicated handling for parental and express consent.
P-39.1 · art. 14, 4.1A-2.1 · art. 53.1, 64.1
A withdrawal that counts.
Your systems can check consent before using information. A withdrawal takes effect at the next check.
P-39.1 · art. 8, 14A-2.1 · art. 65
Choice starts on your website.
With Témoins, block non-essential trackers before consent and retain evidence of each decision. Billed separately.
P-39.1 · art. 8.1, 14A-2.1 · art. 65.0.1, 53.1
Evidence others can verify.
Review the access log, export your dossier and give your auditor temporary access.
P-39.1 · art. 3.1A-2.1 · art. 52.2, 8
Multiple clients. One account.
Law firms and advisory teams: move between businesses and public bodies with the same Agreely account.
For firms and advisorsConnected to your systems.
API, TypeScript and PHP SDKs, CLI: connect your Agreely workflows to your ERP or internal tools.
Explore integrationsEvery access leaves a trace. Here is a real one. Verify it.
audit receipt · data consent
anchored · Base
verified here
partly verified
Data consent
grant
Contact details · Marketing communications
POL-2026-0001
epoch root · 0x5b0c…fbfa
anchored · Base
A real access-log event, drawn from the demo tenant Assurance Boreale and anchored on the public Base chain. The math is redone right here, in your browser, from the artifacts alone.
The company's registered DID key, hosted by Agreely, verifies the signature placed over the epoch root. Defense in depth, not non-repudiation.
- Commitment to verify computing confirmed mismatch found
- Root to verify computing confirmed mismatch found
- Signature to verify computing confirmed check it yourself mismatch found
- Anchor to verify published
Expected (receipt)
Recomputed here
0x5b0cd3ecafd1850fc2dd12c548ca140095636032339c0dd86f6be0fc3da5fbfa
pending
Valid. Verifiable without trusting us.
The math was redone right here, in your browser, from the artifacts alone. This receipt would still verify even if Agreely disappeared.
This demonstrates the integrity and traceability of the access event, recorded and unaltered in the tenant's log. It is never proof of compliance.
Integrity confirmed. The signature still needs checking.
The math was redone right here, in your browser, from the artifacts alone. This receipt would still verify even if Agreely disappeared.
Your browser does not verify Ed25519 signatures: check the signature on the full verifier.
This demonstrates the integrity and traceability of the access event, recorded and unaltered in the tenant's log. It is never proof of compliance.
Mismatch found: this receipt does not verify.
This is exactly what verification would reveal if the record had been altered after the fact.
The receipt could not be loaded here. Verify it directly on the full verifier:
compute, your browser 0 ms
When your activity calls for consent
The other side
Open the citizen app
The other side
of consent.
For uses that require it, a dedicated flow lets people decide on their own device. They can then find their choices, withdraw them and view their receipt in their citizen space.
01
Your receipt goes with you
Every consent is signed and verified with the passkey on your device, in an app on your home screen.
02
Withdraw with a tap
A withdrawal, by passkey (Face ID or Touch ID), is honored from the very next check.
03
Verify it yourself
Confirm a receipt is authentic and untampered, without having to trust Agreely or anyone else.
The accountability file
All your work.
All your work.
One clear file.
Your registers tell the story of what you have done. Agreely brings them together in a view your auditor can review, article by article.
The pieces are already here.
Consent, requests, incidents and retention. Find the registers and documented information from your workspace.
Explore the obligations
Auditor access
One link is enough.
- Read-only consultation
- Time-limited, revocable access
- No account to create
AGREELYAn actual view of the platform
Registers linked to the relevant articles.
API · SDK TypeScript et PHP · CLI
Your systems act. Agreely keeps track.
Connect your ERP, CRM or internal tools to Agreely. Check access, create a consent request or report the end of a customer relationship from your own workflows.
One example: ending a customer relationship
- 01
Your ERP
The customer relationship ends.
- 02
Your integration
An API call records the end and its reason.
- 03
Agreely
That date anchors the retention periods you have defined.
Deadlines are calculated from your applicable rules. Data destruction remains under your control.
Law firms · Advisory teams
Many clients.
Many clients.
One account.
Support several businesses or public bodies with their Law 25 work. Switch organizations with your Agreely account to find each client’s policies, requests and registers.
Let’s talk about your firmCompliance, article by articleThe law on one side.
The law on one side.
Your tools on the other.
Law 25 modernized two acts: P-39.1 for the private sector, A-2.1 for public bodies. Pick your sector: each obligation appears with the section that governs you.
Your sector
Citations now shown for the private sector (P-39.1). Citations now shown for the public sector (A-2.1).
Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) Act respecting access to documents held by public bodies and the protection of personal information (CQLR, c. A-2.1)
P-39.1
art. 14A-2.1
art. 53.1
art. 14A-2.1
art. 53.1
Clear, free and informed consent, requested for each purpose.
Agreely
(category, purpose) catalog with per-cell consent.
P-39.1
art. 8A-2.1
art. 65
art. 8A-2.1
art. 65
Mandatory disclosure list at collection, in clear and simple language.
Agreely
Versioned, signed consent documents.
P-39.1
art. 8 al. 1 (4) and 14 al. 3A-2.1
art. 65 (5)
art. 8 al. 1 (4) and 14 al. 3A-2.1
art. 65 (5)
Right to withdraw consent.Inform, at collection, of the consequences of withdrawing consent to the communication or use of information collected under an optional request.
Agreely
Withdrawal honored on the very next check.
See the 17 other obligations, four groups
Consent (continued)
P-39.1
art. 4.1A-2.1
art. 64.1
art. 4.1A-2.1
art. 64.1
Minor under 14: consent by the person having parental authority or the tutor.
Agreely
Parental consent flow.
P-39.1
art. 8.1A-2.1
art. 65.0.1
art. 8.1A-2.1
art. 65.0.1
Technology that can identify, locate or profile a person: inform beforehand of its use and of the means offered to activate those functions.
Agreely
Catalog profiling flag, prior disclosure carried into documents and the policy.
P-39.1
art. 12 al. 2 and 3A-2.1
art. 65.1
art. 12 al. 2 and 3A-2.1
art. 65.1
Use for another purpose without consent in five cases only; a compatible purpose requires a relevant and direct link and excludes prospecting.Use for another purpose without consent in four cases only; a compatible purpose requires a relevant and direct link; the first three cases are entered in the article 67.3 register.
Agreely
Secondary-use register: invoked exception, original purpose and justification attested.
P-39.1
art. 12.1A-2.1
art. 65.2
art. 12.1A-2.1
art. 65.2
Decision based exclusively on automated processing: disclosure and observations.
Agreely
Automated-decision flag in the catalog, its disclosure carried into your documents, and the review request as a rights type.
Rights of the individual concerned
P-39.1
art. 27A-2.1
art. 83 and 84
art. 27A-2.1
art. 83 and 84
Right of access: confirm holding and hand over a copy.
Agreely
Access export on request.
P-39.1
art. 27 al. 3A-2.1
art. 84 al. 3
art. 27 al. 3A-2.1
art. 84 al. 3
Delivery in a structured, commonly used technological format.
Agreely
Structured export, in JSON or CSV, of the consent records held for the person.
P-39.1
art. 32A-2.1
art. 98
art. 32A-2.1
art. 98
Respond to the access request within 30 days; silence counts as a deemed refusal.Respond with diligence within 20 days; a single extension of up to 10 days, with written notice before the deadline.
Agreely
Rights clock: each request's deadline is computed for the applicable regime.
P-39.1
art. 23A-2.1
art. 73
art. 23A-2.1
art. 73
Destruction or anonymization once the purposes are accomplished.
Agreely
Crypto-shred erasure and a destruction schedule.
P-39.1
art. 11 al. 2A-2.1
P-39.1 only
art. 11 al. 2A-2.1
P-39.1 only
Information used for a decision kept at least one year.
Agreely
Retention floor applied to the schedule.
Accountability and logging
P-39.1
art. 3.1A-2.1
art. 52.2 / 8
art. 3.1A-2.1
art. 52.2 / 8
Person in charge of the protection of personal information.
Agreely
Named responsable, published contact, signed receipts.
P-39.1
art. 18 al. 2A-2.1
art. 67.3
art. 18 al. 2A-2.1
art. 67.3
Record certain communications to a third party.
Agreely
Register of communications without consent (ground relied on, recipient, categories), plus the anchored access log for every consent decision.
P-39.1
art. 18.3A-2.1
art. 67.2
art. 18.3A-2.1
art. 67.2
Communication without consent to a mandatary or service provider: the mandate given in writing, stating the required protective measures.
Agreely
Mandatary register: written contract and required clauses attested, gaps flagged.
P-39.1
art. 3.2 / 8.2A-2.1
art. 63.3 / 63.4
art. 3.2 / 8.2A-2.1
art. 63.3 / 63.4
Governance policies and a public confidentiality policy.
Agreely
Governance suite and a published policy.
Governance and risk
P-39.1
art. 10A-2.1
art. 63.1
art. 10A-2.1
art. 63.1
Reasonable security measures given sensitivity, purpose, quantity, distribution and medium, from collection through destruction.
Agreely
Declarative register of security measures, covering sensitive information and destruction.
P-39.1
art. 3.5 to 3.8A-2.1
art. 63.8 to 63.11
art. 3.5 to 3.8A-2.1
art. 63.8 to 63.11
Measures, notification, and a confidentiality-incident register.
Agreely
Confidentiality-incident register.
P-39.1
art. 17A-2.1
art. 70.1
art. 17A-2.1
art. 70.1
Communication outside Quebec and a privacy impact assessment.
Agreely
Transfer register and privacy impact assessment (EFVP).
P-39.1
art. 17 al. 2 and 3A-2.1
art. 70.1 al. 2 and 3
art. 17 al. 2 and 3A-2.1
art. 70.1 al. 2 and 3
Outside Quebec: adequate protection shown by the assessment and a written agreement, including for a mandate or contract entrusted outside.
Agreely
Written-agreement block and linked assessment on every recorded transfer or mandate.
Citations verified against the official texts of the two acts modernized by Law 25: the Act respecting the protection of personal information in the private sector (P-39.1) and the Act respecting access to documents held by public bodies and the protection of personal information (A-2.1). The two acts sometimes reuse the same article numbers for different obligations; the mapping shown here is built obligation by obligation, never by substituting numbers, and obligations with no direct equivalent in the other act are marked as such. For information only, not legal advice.
Choosing your platform
Québec’s context.
Québec’s context.
At the heart of the product.
Global suites serve many markets. Agreely brings Québec’s requirements and everyday tools together. Here are a few practical points to compare.
| Your needs | Agreely | Elsewhere in the market Documented examples by vendor |
|---|---|---|
| Law 25 guidance | P-39.1 and A-2.1, with article references for your sector’s obligations. | OneTrustAssessments, data mapping and rights workflows supporting Law 25. |
| Rights requests | A form on your public page. After email confirmation, requests enter your register. | TranscendA self-service Privacy Center for exercising data rights. |
| Consent integrity | Receipts anchored on Base, with integrity checks through a public verifier. | OsanoEncrypted, immutable cookie-consent records accessible within Osano. |
| Data residency | Data at rest hosted in Canada. | OneTrustCanada is among the available hosting regions. |
Official sources reviewed September 21, 2026. Each example refers only to the named vendor and capability, depending on modules and plans.
Pricing
A workspace for your team.
A workspace for your team.
A plan that fits.
Plans based on clients in your register, published products or services, and your team. Prices in Canadian dollars, billed annually. A thirty-day trial, no card or commitment.
Starter
$99/ mo
CAD, billed annually
- Clients in the register
- 1,000
- Published products or services
- 1
- Seats
- 2
- API keys
- 2
- Custom domain
- No
- Support
Growth
$349/ mo
CAD, billed annually
- Clients in the register
- 10,000
- Published products or services
- 3
- Seats
- 15
- API keys
- 10
- Custom domain
- Yes
- Support
- Priority
Business
$999/ mo
CAD, billed annually
- Clients in the register
- 100,000
- Published products or services
- 10
- Seats
- Unlimited
- API keys
- Unlimited
- Custom domain
- Yes
- Support
- Priority
Quebec's Law 25, in plain terms.
For information only, not legal advice. Articles cited here are those of P-39.1 (private sector).
Does consent have to be asked for each purpose?
Yes. Art. 14 requires clear, free and informed consent, given for specific purposes and “requested for each such purpose”. Bundled consent, not requested separately for each purpose, is without effect (art. 14). An “accept all” button placed after each purpose has been presented separately is a convenience, not a shortcut. When the request is made in writing, it must also be presented distinctly from any other information given to the individual concerned.
What is consent proof, and does Law 25 require one?
In practice, it is for the enterprise to demonstrate valid consent: non-compliant consent is without effect (art. 14) and the enterprise is accountable for the information it holds (art. 3.1). Collecting consent is easy, but being able to demonstrate it after the fact is what counts. A checkbox in a database you could have edited proves neither when consent was given, nor for which purpose, nor that it was honored until withdrawal. Consent proof is a verifiable record, bound to the specific purpose (art. 8 and 14), that a regulator or auditor can check on demand.
What must you disclose when you collect personal information?
Art. 8 requires that, at collection and in clear and simple language, you inform the individual concerned of the purposes, the means used, their rights of access and rectification, and their right to withdraw consent. Where applicable, you must also name the third party on whose behalf collection is made, the categories of recipients, and the possibility of a communication outside Quebec. On request, you add the categories of persons with internal access, the retention period, and the contact details of the person in charge of the protection of personal information.
What rights does an individual have under Law 25?
The individual concerned can ask for access to their information and a copy (art. 27), ask to rectify inaccurate information (art. 28), and withdraw consent at any time (art. 8 al. 1 (4)). Computerized information collected from them must, on request, be released in a structured, commonly used technological format (art. 27 al. 3). The person in charge must answer in writing, with diligence and within 30 days at the latest; failing that, the request is deemed refused (art. 32).
Does Law 25 require a privacy officer?
Yes. Article 3.1 places personal-information protection in the hands of a person in charge ; by default this is the person with the highest authority in the enterprise, who may delegate the function in writing. That person's title and contact details must be published, notably on the enterprise's website. The named person answers access requests and carries accountability, article in hand (the statutory term is “responsable de la protection des renseignements personnels”, not “DPO”).
Is there a right to erasure in Quebec, and what does it mean?
Once the purposes of collection are accomplished, art. 23 requires the enterprise to destroy the personal information or anonymize it according to best practices, subject to any retention period set by law. In Quebec, “anonymized” sets a strict bar: the process must be irreversible, which is distinct from mere de-identification. Cessation of dissemination and de-indexing (art. 28.1) cover what the public often calls the “right to be forgotten”, but that is not the statutory term.
Let's talk about your Law 25 file.
Thirty minutes to see if Agreely fits, or write to us directly. Agreely is built by Ophelios Studio. No form, no queue.