Loi 25 compliance,
by design.
Béluga is engineered to make Loi 25 compliance the default, not a configuration project. Here is what that means concretely for your organization.
What is Loi 25?
The Act respecting the protection of personal information in the private sector (Loi 25, formerly Bill 64) is the Québec law that modernized privacy obligations between September 2022 and September 2024. It applies to any organization, public or private, that collects, holds, uses or communicates personal information in Québec — regardless of size or where its head office is located.
Penalties can reach 25 M$ or 4% of worldwide turnover, plus the cost of remediation and reputational impact.
Key obligations and how Béluga handles them
1. Designate a person responsible for the protection of personal information
This is your obligation. Béluga supports it by providing a clear processor relationship, named contacts on our side (vie-privee@beluga.quebec), and a DPA template you can sign in minutes.
2. Conduct a privacy impact assessment (ÉFVP) before transferring personal information outside Québec
This is the obligation that disqualifies most cloud providers. Microsoft 365, Google Workspace, Infomaniak (Switzerland) and Proton (Switzerland) all trigger an ÉFVP because the data leaves Québec.
With Béluga, your data stays on Québec-owned hardware in Québec. For standard usage, no ÉFVP is required.
3. Notify confidentiality incidents that present a risk of serious harm
We operate the incident registry on your behalf. If a material incident occurs on Béluga infrastructure, we notify you in time for your 72-hour reporting window, with all the evidence required by the Commission d'accès à l'information.
4. Privacy by default
Every Béluga setting that affects privacy ships at the most protective level. Public sharing is opt-in, indexing is opt-in, third-party integration is opt-in, AI features are opt-in.
5. Right to access, rectification, deletion, portability
Built into the product. Your administrators can fulfill requests for any user with one-click exports (mbox, vCard, iCal, native files) and one-click deletion that purges across primary and backup systems within the legal retention boundary.
What you receive when you sign up
- Béluga DPA — signed, in French, governed by the Civil Code of Québec.
- ÉFVP template — pre-filled for the standard Béluga deployment, ready to be reviewed and stored by your responsible person.
- Incident register — operated by us, exportable on demand.
- Sub-processors list — public, kept up to date.
- Annual transparency report — number and nature of government data requests received.
What Béluga does not remove
Loi 25 also imposes obligations that no provider can discharge for you: designating a responsible person, training your team, defining retention schedules, governing internal access. We support those, but they remain yours.