Loi 25 compliance,
by design.
Béluga is engineered to make Loi 25 compliance the default, not a configuration project. Here is what that means concretely for your organization.
What is Loi 25?
The Act respecting the protection of personal information in the private sector (Loi 25, formerly Bill 64) is the Québec law that modernized privacy obligations between September 2022 and September 2024. It applies to any organization, public or private, that collects, holds, uses or communicates personal information in Québec — regardless of size or where its head office is located.
Penalties can reach 25 M$ or 4% of worldwide turnover, plus the cost of remediation and reputational impact.
Key obligations and how Béluga handles them
1. Designate a person responsible for the protection of personal information
This is your obligation. Béluga supports it by providing a clear processor relationship, named contacts on our side (vie-privee@beluga.quebec), and a DPA template you can sign in minutes.
2. Conduct a privacy impact assessment (ÉFVP) before transferring personal information outside Québec
This is the obligation that disqualifies most cloud providers. Microsoft 365, Google Workspace, Infomaniak (Switzerland) and Proton (Switzerland) all trigger an ÉFVP because the data leaves Québec.
With Béluga, your data stays on Québec-owned hardware in Québec. For standard usage, no ÉFVP is required.
3. Notify confidentiality incidents that present a risk of serious harm
We operate the incident registry on your behalf. If a material incident occurs on Béluga infrastructure, we notify you in time for your 72-hour reporting window, with all the evidence required by the Commission d'accès à l'information.
4. Privacy by default
Every Béluga setting that affects privacy ships at the most protective level. Public sharing is opt-in, indexing is opt-in, third-party integration is opt-in, AI features are opt-in.
5. Right to access, rectification, deletion, portability
Your users reach their data through open standards (IMAP for mail, CalDAV/CardDAV and vCard/iCalendar exports for calendar and contacts). For formal access, rectification or erasure requests, our privacy officer (rprp@beluga.quebec) answers within the 30-day legal deadline.
What you receive when you sign up
- Béluga DPA — in French, governed by the Civil Code of Québec.
- Incident register — operated by us, exportable on demand.
- Sub-processors list — documented in our privacy policy (Stripe, Mistral AI, Cyberimpact), kept up to date.
- A named contact — Béluga's privacy officer, reachable directly.
What Béluga does not remove
Loi 25 also imposes obligations that no provider can discharge for you: designating a responsible person, training your team, defining retention schedules, governing internal access. We support those, but they remain yours.