Know your information.
Organize categories and purposes. Identify sensitive information and uses involving automated decisions.
P-39.1 · art. 14, 12.1A-2.1 · art. 53.1, 65.2
Law 25 management software · Built in Québec
Law 25.
Law 25.
Put it
into practice.
Your practices become policies. Your policies get a public home. Requests reach the right place. Your Law 25 work, together in one workspace.
30-day trial, no card, no commitment. One trial per business.
From collection to accountability
Fewer scattered files.
Fewer scattered files.
A clearer picture.
The information you collect, the policies you publish and the requests you receive. Follow the same thread from everyday work to your accountability dossier.
01
Describe your practices.
A catalog of information and purposes that informs policies for each product and your whole organization.
02Inform the right people.
Publish policies on your public page and record the methods you used to distribute them.
03Keep track of what follows.
Rights requests, incidents and registers share the same workspace as your policies.
From your practices to your public
It starts with what you do.
01
Describe your practices.
Categories, purposes and retention periods: describe your information and connect it to your products or services. This foundation informs policies that reflect your activities.
02
Generate your policies.
Generate an organization-wide or product-specific privacy policy from your catalog. Review the text, then publish a version you can refer back to.
03
Publish and distribute.
Agreely hosts your policies at a public address. Link to it from your website, then record the channels and distribution methods you used.
04
Receive the requests.
Your public page’s form routes rights requests to Agreely. Once the email is confirmed, requests enter your register for your team to track and handle.
05
Collect an informed choice.
When a purpose requires consent, send a dedicated request. The person reviews the purposes on their device and confirms their choice with a passkey. Their decision produces a signed receipt they can return to.
The tools, close at handLaw 25 has many parts.
Law 25 has many parts.
So does your platform.
From the first information collected to your auditor’s dossier. Find tools for every step in one workspace.
A-2.1 · art. 53.1, 65.2
Policies built from your practices.
Generate organization-wide or product-specific privacy policies from your catalog. Review, publish and retain each version.
P-39.1 · art. 8.2A-2.1 · art. 63.4
Every request, followed through.
Your public page’s form feeds the register after email confirmation. Track requests and their deadlines.
P-39.1 · art. 27, 32A-2.1 · art. 83, 84, 98
Make responsibilities clear.
Identify your privacy officer and publish governance and privacy policies, with their history.
P-39.1 · art. 3.1, 3.2, 8.2A-2.1 · art. 52.2, 8, 63.3, 63.4
An incident. A documented response.
Record the facts, risk assessment, actions taken and notices in one register.
P-39.1 · art. 3.5 to 3.8A-2.1 · art. 63.8 to 63.11
Keep information with a rule.
Associate categories with retention rules and document destruction obligations and attestations.
P-39.1 · art. 23A-2.1 · art. 73
Assess before moving forward.
Document project and cross-border privacy assessments, chosen safeguards and your conclusions.
P-39.1 · art. 3.3, 3.4, 17A-2.1 · art. 63.5, 63.6, 70.1
Document uses and providers.
Maintain provider and secondary-use registers, together with the agreements and reasons supporting them.
P-39.1 · art. 18.3, 12A-2.1 · art. 67.2, 65.1
A choice for each purpose.
Collect separate decisions, with dedicated handling for parental and express consent.
P-39.1 · art. 14, 4.1A-2.1 · art. 53.1, 64.1
A withdrawal that counts.
Your systems can check consent before using information. A withdrawal takes effect at the next check.
P-39.1 · art. 8, 14A-2.1 · art. 65
Choice starts on your website.
With Témoins, block non-essential trackers before consent and retain evidence of each decision. Billed separately.
P-39.1 · art. 8.1, 14A-2.1 · art. 65.0.1, 53.1
Evidence others can verify.
Review the access log, export your dossier and give your auditor temporary access.
P-39.1 · art. 3.1A-2.1 · art. 52.2, 8
Multiple clients. One account.
Law firms and advisory teams: move between businesses and public bodies with the same Agreely account.
For firms and advisorsConnected to your systems.
API, TypeScript and PHP SDKs, CLI: connect your Agreely workflows to your ERP or internal tools.
Explore integrationsEvery access leaves a trace. Here is a real one. Verify it.
audit receipt · data consent
anchored · Base
verified here
partly verified
Data consent
grant
Contact details · Marketing communications
POL-2026-0001
epoch root · 0x5b0c…fbfa
anchored · Base
A real access-log event, drawn from the demonstration company Assurance Boreale and anchored on the public Base chain. The math is redone right here, in your browser, from the artifacts alone.
The company's registered DID key, hosted by Agreely, verifies the signature placed over the epoch root. Defense in depth, not non-repudiation.
- Commitment to verify computing confirmed mismatch found
- Root to verify computing confirmed mismatch found
- Signature to verify computing confirmed check it yourself mismatch found
- Anchor to verify published
Expected (receipt)
Recomputed here
0x5b0cd3ecafd1850fc2dd12c548ca140095636032339c0dd86f6be0fc3da5fbfa
pending
Valid. Recomputed in your browser.
The math was redone right here, in your browser, from the artifacts alone. This receipt would still verify even if Agreely disappeared.
This demonstrates the integrity and traceability of this access-log event, recorded and unaltered in the company's log. It is never proof of compliance.
Integrity confirmed. The signature still needs checking.
The math was redone right here, in your browser, from the artifacts alone. This receipt would still verify even if Agreely disappeared.
Your browser does not verify Ed25519 signatures: check the signature on the full verifier.
This demonstrates the integrity and traceability of this access-log event, recorded and unaltered in the company's log. It is never proof of compliance.
Mismatch found: this receipt does not verify.
This is exactly what verification would reveal if the record had been altered after the fact.
The receipt could not be loaded here. See the raw receipt (JSON) and the transaction below.
compute, your browser 0 ms
When your activity calls for consent
The other side
Open the citizen app
The other side
of consent.
For uses that require it, a dedicated flow lets people decide on their own device. They can then find their choices, withdraw them and view their receipt in their citizen space.
01
Your receipt goes with you
Every consent is signed and verified with the passkey on your device, in an app on your home screen.
02
Withdraw with a tap
A withdrawal, by passkey (Face ID or Touch ID), is honored from the very next check.
03
Verify it yourself
Confirm a receipt is authentic and untampered, without having to trust Agreely or anyone else.
The accountability file
All your work.
All your work.
One clear file.
Your registers tell the story of what you have done. Agreely brings them together in a view your auditor can review, article by article.
The pieces are already here.
Consent, requests, incidents and retention. Find the registers and documented information from your workspace.
Explore the obligations
Auditor access
One link is enough.
- Read-only consultation
- Time-limited, revocable access
- No account to create
AGREELYAn actual view of the platform
Registers linked to the relevant articles.
API · SDK TypeScript et PHP · CLI
Your systems act. Agreely keeps track.
Connect your ERP, CRM or internal tools to Agreely. Check access, create a consent request or report the end of a customer relationship from your own workflows.
One example: ending a customer relationship
- 01
Your ERP
The customer relationship ends.
- 02
Your integration
An API call records the end and its reason.
- 03
Agreely
That date anchors the retention periods you have defined.
Deadlines are calculated from your applicable rules. Data destruction remains under your control.
Law firms · Advisory teams
Many clients.
Many clients.
One account.
Support several businesses or public bodies with their Law 25 work. Switch organizations with your Agreely account to find each client’s policies, requests and registers.
Let’s talk about your firmCompliance, article by articleThe law on one side.
The law on one side.
Your tools on the other.
Law 25 modernized two acts: P-39.1 for the private sector, A-2.1 for public bodies. Pick your sector: each obligation appears with the section that governs you.
Your sector
Citations now shown for the private sector (P-39.1). Citations now shown for the public sector (A-2.1).
Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) Act respecting access to documents held by public bodies and the protection of personal information (CQLR, c. A-2.1)
P-39.1
art. 14A-2.1
art. 53.1
art. 14A-2.1
art. 53.1
Clear, free and informed consent, requested for each purpose.
Agreely
(category, purpose) catalog with per-cell consent.
P-39.1
art. 8A-2.1
art. 65
art. 8A-2.1
art. 65
Mandatory disclosure list at collection, in clear and simple language.
Agreely
Versioned, signed consent documents.
P-39.1
art. 8 al. 1 (4) and 14 al. 3A-2.1
art. 65 (5)
art. 8 al. 1 (4) and 14 al. 3A-2.1
art. 65 (5)
Right to withdraw consent.Inform, at collection, of the consequences of withdrawing consent to the communication or use of information collected under an optional request.
Agreely
Withdrawal honored on the very next check.
See the 17 other obligations, four groups
Consent (continued)
P-39.1
art. 4.1A-2.1
art. 64.1
art. 4.1A-2.1
art. 64.1
Minor under 14: consent by the person having parental authority or the tutor.
Agreely
Parental consent flow.
P-39.1
art. 8.1A-2.1
art. 65.0.1
art. 8.1A-2.1
art. 65.0.1
Technology that can identify, locate or profile a person: inform beforehand of its use and of the means offered to activate those functions.
Agreely
Catalog profiling flag, prior disclosure carried into documents and the policy.
P-39.1
art. 12 al. 2 and 3A-2.1
art. 65.1
art. 12 al. 2 and 3A-2.1
art. 65.1
Use for another purpose without consent in five cases only; a compatible purpose requires a relevant and direct link and excludes prospecting.Use for another purpose without consent in four cases only; a compatible purpose requires a relevant and direct link; the first three cases are entered in the article 67.3 register.
Agreely
Secondary-use register: invoked exception, original purpose and justification attested.
P-39.1
art. 12.1A-2.1
art. 65.2
art. 12.1A-2.1
art. 65.2
Decision based exclusively on automated processing: disclosure and observations.
Agreely
Automated-decision flag in the catalog, its disclosure carried into your documents, and the review request as a rights type.
Rights of the individual concerned
P-39.1
art. 27A-2.1
art. 83 and 84
art. 27A-2.1
art. 83 and 84
Right of access: confirm holding and hand over a copy.
Agreely
Access export on request.
P-39.1
art. 27 al. 3A-2.1
art. 84 al. 3
art. 27 al. 3A-2.1
art. 84 al. 3
Delivery in a structured, commonly used technological format.
Agreely
Structured export, in JSON or CSV, of the consent records held for the person.
P-39.1
art. 32A-2.1
art. 98
art. 32A-2.1
art. 98
Respond to the access request within 30 days; silence counts as a deemed refusal.Respond with diligence within 20 days; a single extension of up to 10 days, with written notice before the deadline.
Agreely
Rights clock: each request's deadline is computed for the applicable regime.
P-39.1
art. 23A-2.1
art. 73
art. 23A-2.1
art. 73
Destruction or anonymization once the purposes are accomplished.
Agreely
Crypto-shred erasure and a destruction schedule.
P-39.1
art. 11 al. 2A-2.1
P-39.1 only
art. 11 al. 2A-2.1
P-39.1 only
Information used for a decision kept at least one year.
Agreely
Retention floor applied to the schedule.
Accountability and logging
P-39.1
art. 3.1A-2.1
art. 52.2 / 8
art. 3.1A-2.1
art. 52.2 / 8
Person in charge of the protection of personal information.
Agreely
Named responsable, published contact, signed receipts.
P-39.1
art. 18 al. 2A-2.1
art. 67.3
art. 18 al. 2A-2.1
art. 67.3
Record certain communications to a third party.
Agreely
Register of communications without consent (ground relied on, recipient, categories), plus the anchored access log for every consent decision.
P-39.1
art. 18.3A-2.1
art. 67.2
art. 18.3A-2.1
art. 67.2
Communication without consent to a mandatary or service provider: the mandate given in writing, stating the required protective measures.
Agreely
Mandatary register: written contract and required clauses attested, gaps flagged.
P-39.1
art. 3.2 / 8.2A-2.1
art. 63.3 / 63.4
art. 3.2 / 8.2A-2.1
art. 63.3 / 63.4
Governance policies and a public confidentiality policy.
Agreely
Governance suite and a published policy.
Governance and risk
P-39.1
art. 10A-2.1
art. 63.1
art. 10A-2.1
art. 63.1
Reasonable security measures given sensitivity, purpose, quantity, distribution and medium, from collection through destruction.
Agreely
Declarative register of security measures, covering sensitive information and destruction.
P-39.1
art. 3.5 to 3.8A-2.1
art. 63.8 to 63.11
art. 3.5 to 3.8A-2.1
art. 63.8 to 63.11
Measures, notification, and a confidentiality-incident register.
Agreely
Confidentiality-incident register.
P-39.1
art. 17A-2.1
art. 70.1
art. 17A-2.1
art. 70.1
Communication outside Quebec and a privacy impact assessment.
Agreely
Transfer register and privacy impact assessment (EFVP).
P-39.1
art. 17 al. 2 and 3A-2.1
art. 70.1 al. 2 and 3
art. 17 al. 2 and 3A-2.1
art. 70.1 al. 2 and 3
Outside Quebec: adequate protection shown by the assessment and a written agreement, including for a mandate or contract entrusted outside.
Agreely
Written-agreement block and linked assessment on every recorded transfer or mandate.
Citations verified against the official texts of the two acts modernized by Law 25: the Act respecting the protection of personal information in the private sector (P-39.1) and the Act respecting access to documents held by public bodies and the protection of personal information (A-2.1). The two acts sometimes reuse the same article numbers for different obligations; the mapping shown here is built obligation by obligation, never by substituting numbers, and obligations with no direct equivalent in the other act are marked as such. For information only, not legal advice.
Choosing your platform
Québec’s context.
Québec’s context.
At the heart of the product.
Global suites serve many markets. Agreely brings Québec’s requirements and everyday tools together. Here are a few practical points to compare.
| Your needs | Agreely | Elsewhere in the market Documented examples by vendor |
|---|---|---|
| Law 25 guidance | P-39.1 and A-2.1, with article references for your sector’s obligations. | OneTrustAssessments, data mapping and rights workflows supporting Law 25. |
| Rights requests | A form on your public page. After email confirmation, requests enter your register. | TranscendA self-service Privacy Center for exercising data rights. |
| Consent integrity | Receipts anchored on Base, with integrity checks through a public verifier. | OsanoEncrypted, immutable cookie-consent records accessible within Osano. |
| Data hosting | Data hosted in Québec. | OneTrustCanada is among the available hosting regions. |
Official sources reviewed September 21, 2026. Each example refers only to the named vendor and capability, depending on modules and plans.
Pricing
A workspace for your team.
A workspace for your team.
A plan that fits.
Plans based on clients in your register, published products or services, and your team. Prices in Canadian dollars, billed annually. A thirty-day trial, no card or commitment.
Starter
$99/ mo
CAD, billed annually
- Clients in the register
- 1,000
- Published products or services
- 1
- Seats
- 2
- API keys
- 2
- Custom domain
- No
- Support
Growth
$349/ mo
CAD, billed annually
- Clients in the register
- 10,000
- Published products or services
- 3
- Seats
- 15
- API keys
- 10
- Custom domain
- Yes
- Support
- Priority
Business
$999/ mo
CAD, billed annually
- Clients in the register
- 100,000
- Published products or services
- 10
- Seats
- Unlimited
- API keys
- Unlimited
- Custom domain
- Yes
- Support
- Priority
Law 25 management, in practice.
Answers about the platform and its workflows.
What does Law 25 management software do?
Agreely brings your information catalog, policies, rights requests and registers into one workspace. Your team can document its work and retrieve supporting records. The platform supports compliance work; it does not replace organizational decisions or legal advice tailored to your situation.
Can we generate and host our privacy policies?
Yes. Agreely generates organization-wide or product-specific policies from your information and purposes catalog. You validate the content, publish documents on a public page hosted by Agreely and keep their versions and distribution records.
How can we manage personal information access requests?
Your public page includes a form for exercising rights. After email confirmation, the request reaches your register. Your team tracks processing and deadlines under the applicable framework. Email confirmation does not remove other identity checks your circumstances require.
Can a law firm manage multiple client organizations?
Yes. One user can work across multiple businesses or public bodies. Law firms and advisory teams can support several clients with one account, while retaining each organization’s own context.
Can we connect Agreely to our ERP or internal tools?
Yes. The API, TypeScript and PHP SDKs and CLI let you integrate Agreely with your systems. Beyond checking consent, your tools can send events used by platform workflows. For example, ending a customer relationship can trigger retention deadline calculations under your declared rules.
How does the platform differ from the cookie banner?
Témoins handles website visitors’ choices, blocking before consent and verifiable receipts. The platform covers broader operations: policies, rights requests, registers, governance and accountability. Products are billed separately; a platform plan does not include a banner site.
Let's talk about your Law 25 file.
Thirty minutes to see if Agreely fits, or write to us directly. Agreely is built by Ophelios Studio. No form, no queue.