Most vendors selling into Canada treat privacy as a US problem with a maple leaf on it. Quebec ended that. Law 25 brought consent, transparency, portability and rules on automated decision-making that are far closer to the European regime than to anything south of the border. And it applies whether or not your office is in Montreal.
GDPR principles as the starting point
The data model is planned with GDPR principles in mind, which share a lot with PIPEDA and with Law 25 where it counts: purpose limitation, meaningful consent, the ability to delete, the ability to explain an automated decision. Building to the tighter standard once is cheaper than discovering the gap during your first enterprise security review.
What stays yours
Law 25 puts obligations on you as the organization: designating a person responsible for privacy, running an assessment before certain projects, publishing your practices. Those are not things a developer can assume for you, and anyone promising otherwise is selling something. What the build does is document how personal information actually moves, so those obligations can be evidenced rather than asserted.
Bilingual is an architecture decision
If Quebec is in scope, French is not a translation pass at the end. Content structure, layout behaviour with longer strings, date and number formats and store metadata all change. Planned at the start it is close to free. Added afterwards it is a rebuild of the content layer.
The deal
- First Version (MVP) from $27,800; an inherited app is taken over from $10,500
- Fixed price and scope in writing before each step
- Bilingual English and French from the first data model where required
- Asynchronous delivery, calls by appointment
- Full handover of code, cloud accounts and documentation
How remote delivery works: remote app developer.