# FAQ

> Answers to the questions we hear most about our services, Law 25 and working with Data Next Step.

- URL: https://datanextstep.com/faq/
- Language: English (other language: https://datanextstep.com/fr/faq/)
- Publisher: Data Next Step (https://datanextstep.com/)

---

Answers to the questions we hear most about our services, Law 25 and working with Data Next Step.

## General

### What does Data Next Step do?

We help organizations strengthen their cybersecurity, meet privacy obligations and adopt automation and AI responsibly — from first assessment through ongoing support.

### Who do you work with?

Mostly small and mid-sized businesses in Quebec and across Canada, from professional services to manufacturing and tech. Our engagements scale with the size of your team.

### Do you offer services in French and English?

Yes. All our consultations, deliverables and support are available in both French and English.

## Services

### Where should we start if we have never done a security review?

Start with a free consultation. We look at where you are today, then recommend a short assessment that maps your risks and quick wins before any larger project.

### Can you act as our outsourced security team?

Yes. Many clients use us as a virtual CISO or managed security partner, with a set number of hours each month and on-call help for incidents.

### How long does a typical engagement take?

A focused assessment takes two to four weeks. Implementation projects usually run one to three months, depending on scope.

## Law 25 & compliance

### Does Law 25 apply to my business?

If you collect personal information about people in Quebec, Law 25 most likely applies — whatever the size of your organization.

### Can you help us prepare for SOC 2 or ISO 27001?

Yes. We run gap analyses, help you build the policies and controls, and prepare your team and evidence for the audit.

### What happens if we have a confidentiality incident?

Contact us right away. We help you contain the incident, assess the risk of serious harm, and complete the required notifications and register entries.

## NextIT platform

### What is NextIT?

NextIT is our platform for running your compliance program in one place: policies, evidence, vendors, incidents and reports.

### Do I need NextIT to work with you?

No. NextIT is optional. Many clients start with consulting and adopt the platform later to keep their program up to date.

## Working with us

### How much does a consultation cost?

The first consultation is free. After that, we send a clear proposal with a fixed scope and price before any work begins.

### How do you keep our information confidential?

We sign an NDA before any detailed discussion, limit access to the people working on your file, and follow the same controls we recommend to clients.