Quebec privacy law
Quebec’s Law 25 applied to a phone line handled by AI
Your web forms have been reviewed. Your phone line — which captures a name, an address, a reason for calling, and sometimes a great deal more — almost certainly has not.
Canadian French + English • Configurable human handoff • Keep your number when supported by your carrier
At a glance
Defined by the workflow, not only the voice
Law 25, formally the act to modernize legislative provisions respecting the protection of personal information, phased in between September 2022 and September 2024. It applies to every enterprise carrying on activities in Quebec, with no size threshold: three employees or three hundred, the obligations are the same.
Most businesses dealt with their forms, their newsletter, and their privacy policy. Almost none dealt with their phone. Yet a call is a collection of personal information exactly as a form is: it captures a name, a number, often an address, a reason, sometimes a health or financial detail — and unlike a form, it produces a recording and a transcript that someone has to decide to keep or destroy.
This page covers the obligations that bear directly on a phone line, what a vendor like VocalOps can configure to help, and what stays irreducibly yours.
This is not legal advice. Law 25 is interpreted against your sector, your data, and your agreements; have your counsel validate your situation. We describe what we see in phone deployments, not what the law means for your business in particular.
Outcomes
The obligations that bear directly on a call
Inform at the point of collection
The caller must know why their information is being collected, for what purposes, by what means, and what their rights are — at the start of the call, not in a policy they will never read.
Say they are not speaking to a person
Transparency about the automated nature of the interaction is the defensible minimum, and it is also what callers accept most readily when it is stated plainly.
Handle automated decisions properly
Where a decision rests exclusively on automated processing, the person must be informed and able to submit observations to someone who can review it.
Minimize
Collect only what the stated purpose requires. An agent that asks one open question too many captures information you will then have to protect, retain, and destroy.
Set a retention period and destroy
The audio, the transcript, the summary, and the customer record do not necessarily share a lifespan. "Just in case" is not a retention period.
Designate a privacy officer
By default the person with the highest authority in the enterprise holds the role. Their title and contact details have to be published.
Buyer guidance
What Law 25 changes in practice for your calls
Law 25’s obligations are written for all collection, not for the telephone specifically. Here is how they translate when the collection point is a spoken conversation with an automated agent on the other end.
A call is a collection, exactly as a form is
This is the mental slip behind nearly every gap. A business that would have refused to add a "health notes" field to its web form will happily let an agent ask an open question that produces exactly the same data, in a transcript kept longer than the database would have kept it. Start by writing down what the line actually captures, not what you assumed it captured.
The notice has to work spoken aloud
A forty-second legal paragraph read over the phone informs nobody: the caller checks out before the end, and you have degraded the experience without gaining protection. A useful notice is short, placed at the start, in plain language, and says how to reach a person. The full detail lives in the policy the notice points to.
Say plainly that the caller is speaking to an automated agent
Ambiguity is a bad trade. A caller who discovers mid-conversation that they were talking to a machine feels deceived, and that is the origin of a good share of complaints. Said upfront, with an immediate way to ask for a person, the automated nature almost always passes without friction.
Automated decisions require more than a notice
If a decision affecting the caller rests exclusively on automated processing — refusing a request, classifying a file as low priority, applying a rate — the person must be informed and able to put their observations to someone who can review it. In a well-designed phone line, that means a refusal or a rejection is never final on the call.
Retention is a decision, not a default setting
Set a period per data type: audio, transcript, summary, and customer record do not share the same usefulness or the same risk. Many businesses discover they have no real need for audio beyond a few weeks, having kept it indefinitely. Then name who performs the deletion, and verify at least once that it happens.
Transfers outside Quebec are assessed before, not after
Communicating personal information outside Quebec requires a prior privacy impact assessment. A telephony and AI stack almost always involves some: hosting, transcription, voice models, support tooling. Ask your vendor for the list, document the assessment, and redo it when the list changes.
The confidentiality incident register
The duty to keep a register, and to report to the Commission d’accès à l’information and to affected individuals where an incident presents a risk of serious injury, has been in force since 2022. A call recording sent to the wrong recipient is an incident. Decide now who logs it and who decides on reporting — not on the day it happens.
The privacy officer
By default it is the person with the highest authority in the enterprise, and the function can be delegated in writing. Their title and contact details must be published. It is one of the simplest obligations to meet and one of the easiest to spot as missing: a page that names nobody takes ten seconds to check.
Checks for your phone line
- Who is the designated privacy officer, and are their contact details published?
- Does the notice at the start of the call cover purposes, means, and rights?
- Does the caller know they are speaking to an automated agent, and how to reach a person?
- What is the retention period for the audio, the transcript, the summary, and the record?
- Who can listen back to a call, and is that access logged?
- Which subprocessors handle this data, and which are outside Quebec?
- Was an assessment carried out before any communication outside Quebec?
- Does the confidentiality incident register exist, and who maintains it?
Implementation
Bringing a phone line into line, step by step
- 1
Inventory
List what the line actually captures — audio, transcript, number, name, address, reason — and where each element ends up, including at your subprocessors.
- 2
Write the notice
Draft the greeting: recording, automated agent, purposes of collection, how to reach a person, and a pointer to the policy.
- 3
Set the durations
Decide a period per data type, name who carries out deletion, and confirm that deletion actually happens.
- 4
Prepare for an incident
Keep the confidentiality incident register, define who is notified, and when the CAI and affected individuals must be told.
Scenarios
Where a phone line most often goes wrong
A notice written after the fact
The greeting was recorded two years ago, before anyone asked what it needed to contain. It welcomes the caller and says nothing else.
Recordings kept "just in case"
No period set means indefinite retention. It is the most widespread failing and the easiest to establish when a complaint arrives.
Processing outside Quebec, never assessed
Communicating personal information outside Quebec requires a prior assessment. Most technical stacks involve some, with nobody having documented it.
Sensitive information captured by accident
One open question — "what’s going on?" — puts a diagnosis or a financial hardship into a transcript that was never designed to hold it.
No incident register
The obligation has been in force since 2022. In many businesses the register was never created, which makes the first incident far more expensive than it needed to be.
FAQ
Questions about Law 25 and the phone
Does Law 25 apply to my small business?
Yes. Unlike some other regimes it sets no size threshold for most of its obligations: a three-person business carrying on activities in Quebec must designate a privacy officer, inform at the point of collection, set retention periods, and keep an incident register.
Do we have to tell callers the call is recorded?
Yes, and it has to be said before the recording, in understandable terms. The notice must also state the purposes, not merely that a recording is happening — "this call may be recorded" on its own does not discharge the duty to inform about purposes and rights.
Do we have to say it is an AI?
Transparency about the automated nature is the defensible position, and it is what we configure by default. It avoids the sense of having been deceived, which drives a good share of complaints, and it lays the groundwork if an automated decision later comes into play.
How long can we keep a recording?
The law does not set a number of days: it requires the period to be determined by the purposes and destruction to follow. Setting the period, justifying it, and applying it is your call. The absence of a period is the failing, not the period you choose.
Does VocalOps make my business compliant?
No, and no vendor can. We configure the greeting notice, the fields collected, the refused topics, and the agreed retention periods, and we document the flows. Consent, notices, designating the officer, the register, and the agreements remain your obligations.
Does the data have to stay in Quebec?
No, the law does not require data residency in Quebec. It requires a privacy impact assessment before communicating personal information outside it, and adequate protection there. It is a documented diligence obligation, not a prohibition.
What are the penalties?
The Commission d’accès à l’information can impose administrative monetary penalties of up to $10M or 2% of worldwide turnover, and penal proceedings can lead to fines of up to $25M or 4%, whichever is greater. In practice the easiest failings to establish are the absence of a designated officer and the absence of a register.
What counts as a confidentiality incident?
Unauthorized access to, use of, or communication of personal information, its loss, or any other breach of its protection. A call recording sent to the wrong recipient is one. It must be entered in the register, and reported to the CAI and to affected individuals if it presents a risk of serious injury.
Explore next
Related pages
AI phone agent security
Review the VocalOps approach to privacy, access, retention, permissions, human handoff, and deployment security assessment.
Read the page →SOC 2 compliance
Data encryption, Canadian hosting and least-privilege access are in place at VocalOps, and the SOC 2 Type II program with Drata is underway.
Read the page →AI receptionist for dental clinics
Answer dental clinic calls, qualify non-urgent requests, and support appointment booking with explicit clinical and privacy boundaries.
Read the page →AI receptionist for law firms
Structure new legal inquiries, potential conflicts, and callback requests without providing automated legal advice or promising representation.
Read the page →Let’s review your line, case by case
Describe what your calls capture today. We will tell you what is configurable on our side, what belongs in your policy, and what needs legal advice.