What Quebec's Law 25 asks of a business.

What Law 25 is

Its full name is the Act to modernize legislative provisions as regards the protection of personal information (2021, chapter 25). It was introduced as Bill 64 and assented to on 22 September 2021. Everybody calls it Law 25 after the chapter number, and almost nobody calls it anything else.

It replaces nothing. It amends the statutes that were already there, including the Act respecting the protection of personal information in the private sector (chapter P‑39.1), which is the one that applies to businesses. That distinction is useful when you are hunting for the exact text of an obligation: Law 25 says what changed, and P‑39.1 says what applies today.

The obligations came into force in stages over three years, and all of them apply now. Which arrived when still matters, because it is what tells you how long you have been supposed to be doing a thing.

The official texts. They are in French, because the statute is; an English summary in their place would be us vouching for a translation we did not make.

Law 25 as assented to (PDF, Commission d’accès à l’information)

Act respecting the protection of personal information in the private sector, chapter P‑39.1

The main changes made by Law 25

The person responsible for the protection of personal information

Anyone carrying on an enterprise who collects, holds, uses or communicates personal information in the course of it. A three-person clinic is covered on the same terms as a chain. There is no headcount threshold; the 25-employee figure people remember belongs to the Charter of the French Language and registration with the Office québécois de la langue française, not to this.

Being incorporated elsewhere does not settle it. Law 25 attaches to personal information collected in the course of an enterprise in Quebec, and where the server sits exempts nothing: if anything the opposite, since the assessment duty is triggered precisely when the information leaves Quebec. An Ontario business answering calls from Quebec can therefore be both subject to the statute and carrying out the very cross-border communication the statute asks it to assess first.

Nor does the number you publish. A 514, 418 or 819 number says where your callers are, not which statute applies to what you keep about them.

Serving Quebec from outside Quebec→

Quebec area codes for a local business number→

The obligations, one at a time

Six of them, in the order a business meets them rather than the order the statute numbers them. None of these is a project; all of them are a decision, written down somewhere a person can find it again in two years.

A named person, published

Since 22 September 2022 a private business in Quebec has had to designate a person responsible for the protection of personal information. By default that is the person with the highest authority, and the role can be delegated. Their title and contact details have to be published, on your website or, failing that, by another appropriate means. Naming somebody internally without saying so is not enough.

A published privacy policy

Written in simple, clear terms, saying what you collect and why. For a phone line that means writing down that you hold call records, and for how long. It is the page an unhappy customer reads first, and the page quoted back at you if it describes something other than what you actually do.

Valid consent, one purpose at a time

Consent has to be manifest, free and informed, given for specific purposes, and it is requested for each of those purposes, in simple and clear terms. Asked for in writing, it is presented distinctly from everything else. Consent that is not given in accordance with the law is without effect. Section 14 of the private-sector Act. It is the hardest of these for a phone line, which is why it has a page of its own.

An assessment before anything leaves Quebec

Before communicating personal information outside Quebec you have to assess whether it would receive adequate protection there, having regard to the legal framework where it is going. It is an assessment, not a prohibition: keeping data outside Quebec is not forbidden, doing it without having assessed is. And the obligation belongs to you, the business collecting, not to your provider.

An incident register, and notice when the risk is serious

Every confidentiality incident goes in a register, however small. The Commission asks that the register carry a description of the incident, its date, the number of people affected, the risk assessment, the dates of any notices and the measures taken, and that it be kept for at least five years after the incident became known. Notice to the Commission and to the people affected is a separate duty, owed only when the incident presents a risk of serious harm. The Commission’s guidance covers both.

Governance policies, and the rest of the calendar

Since 22 September 2023 there are also governance policies and practices to keep (retention, staff roles, how complaints are handled), privacy by default on a technological product or service, and anonymisation according to generally accepted best practices where you choose not to destroy. Since 22 September 2024 there is a right to portability: giving a person, on request, the information they supplied you, in a structured, commonly used technological format.

The penalties, and the two regimes people blend

There are two of them and they are not the same thing. An administrative monetary penalty is imposed by a person the Commission designates, on a failure it has investigated, without going to court. A penal fine is imposed by a court, on a prosecution the Commission brings. The two are frequently quoted as one number, usually the largest of the four.

Read those as ceilings rather than as tariffs. Setting a penal fine, a judge weighs the nature, gravity, repetitiveness and duration of the offence, how sensitive the information was, whether the business acted deliberately or carelessly, and whether it took reasonable steps to prevent it (section 92.3). The same facts on the same day cannot draw both an administrative penalty and a penal charge under the same provision (section 90.11). An administrative penalty is prescribed two years after the failure, a prosecution five years after the offence.

The Commission on the penalties it can impose on a business

What it means for a phone system

The obligations do not relax because the channel is audio. A business line holds callers’ numbers, recordings if they are switched on, voicemail audio and its transcript, call logs, contact records built from call traffic, and the IP addresses of softphone sessions. All of it is personal information the moment it can be attached to a person. The transcript is worth calling out: it is a new document derived from the recording, and it is retained separately.

Recording and consent

An announcement saying a call “may be recorded” satisfies the duty to inform and is not automatically valid consent. The gap between announcing and obtaining is where most phone systems sit. And quality assurance, training and evidence in a dispute are three purposes, not one: consent obtained for the first does not cover the other two.

A consent form, with the example→

The incident register

For a phone line the realistic list is duller than a spectacular breach: a voicemail box still reachable by somebody who left, a recording emailed to the wrong address, a call log exported and left in a shared drive, a softphone left signed in on a returned laptop, somebody replaying recordings they had no reason to hear. That last one counts: unauthorised use is an incident even when nothing left the company and no attacker was involved.

A breach involving call records→

Where your call data lives

This is the least discussed obligation and the one most likely to catch a cloud phone system, because almost none of them keep Quebec data in Quebec. In our own review of eight competing vendors, done on 19 August 2026, not one of the eight named Law 25 anywhere on its site. A good answer to “where is my data stored?” names a region. A bad one says “the cloud”.

Where your call data lives→

Retention

Retention is a purpose limit, not a storage setting. A recording kept indefinitely has outlived the quality-assurance purpose it was collected for, and it is your own announcement a complainant will quote back. The cheapest incident response is not holding the recording at all: scheduled deletion reduces the surface permanently, and it is a configuration decision rather than a project.

Access, correction and portability requests

A caller may ask what you hold about them, ask for it to be corrected, and, since 22 September 2024, ask for the computerised information they supplied you in a structured, commonly used format. For a phone line that means being able to find every recording, voicemail and transcript by the caller’s number, saying what has already been deleted, and answering in writing at the address your consent form names.

Notice to the Commission and to the people affected

The register covers every incident. Notice is a separate duty, owed when the incident presents a risk of serious harm, weighed on how sensitive the information is, how it could be used and how likely the harm is. A recording weighs heavily there: it carries a voice, and often something the caller said without thinking. The Commission publishes the declaration form (PDF), so you can see what you would fill in before you ever have to.

The order a business does it in, from the decision to record to the day the recording is deleted. Six steps, none of them a project.

1. Decide whether you record at all, and for which purposes

   Recording is a choice, not a default: the Act asks for the highest level of confidentiality by default on a technological service. If you do record, name each purpose before you write anything. Checking service quality, training staff and keeping evidence of what was agreed are three purposes, and consent is requested for each one.

2. Write an announcement that confirms and names a purpose

   Say that the call is recorded, not that it may be, and say what for. One sentence does both: “This call is recorded so we can check the quality of our service.” Write it in French first; an English version lives inside the English branch of your menu rather than in front of the French one.

3. Play it after the greeting, before the menu, only where you record

   The caller has to hear it before they start giving you information, so it belongs between the greeting and the first choice. If only some paths are recorded, the announcement belongs on those paths and not on every call: announcing a recording that does not happen is simply inaccurate.

4. Where the announcement is not enough, obtain consent and keep the record

   An announcement informs the caller; on its own it is not consent. On an inbound service call, announcing plus a real chance to hang up is usually defensible. It does not cover a call you placed, and it does not cover a second purpose. For those, a written form that ticks the purposes one at a time is the record you keep.

5. Write the recording, its purposes and its retention into your privacy policy

   The published policy says what you collect, why, and for how long. For a recorded line that means the recording itself, the purposes you named in the announcement, who may listen, where it is kept, and how long before it is deleted. It is the page quoted back at you if it describes something other than what you actually do.

6. Set a retention window and scheduled deletion

   The statute sets no fixed period: once the purpose you named is served, the recording is destroyed or anonymised. A window you set once, with a job that deletes what has passed it, is the cheapest incident response there is, because a recording you no longer hold cannot be sent to the wrong person.

The consent form, with the example→

Is it legal to record a call in Quebec?→

Our data is at AWS in us-east-1: Northern Virginia, in the United States. Not a Canadian region. If you are a Quebec business, sending us personal information is a communication outside Quebec, and the statute asks you to assess it before you start. We would rather write that sentence than let you find it in a sub-processor table.

Recording is off by default: an organisation that has not configured it does not record. When it is on, the rule belongs to the company rather than to each person, and playing a recording back is a separate permission from making one. Retention is set rather than left open: an administrator sets a window per class of data, a nightly job deletes whatever has passed it with no archive behind, and an organisation that sets nothing follows 30 days for recordings and 90 for voicemail.

Our sub-processor list is published in full, with no form and no login, naming every party and what reaches each one: that is half the work of your assessment, done in advance. What we hold, who can reach it and what we still lack is on security.

We do not decide your purposes, and no phone system can. We cannot keep your register either: the incidents in it are yours, and it follows you on the day you change providers. And we cannot tell you the communication outside Quebec is acceptable; that judgement is yours, and any vendor who makes it for you has told you something about how carefully they read the statute.

We do not yet name a person responsible for the protection of personal information, because the operating entity is not yet incorporated. That is a gap rather than a feature, and every legal page on this site says so on its face until it is fixed. We would rather it were visible than implied.

The obligations as a file

All 9 obligations, in the order they came into force, with the 5 that reach a phone line marked and every row citing the Commission page it comes from. English and French in the same file. If you are writing about Law 25, this is the list without the essay around it.

What Law 25 asks of a phone system

Call-recording consent under Law 25

Recording announcements in Quebec: what to say

The incident register and notice to the Commission

Where your call data lives

Serving Quebec from outside Quebec: Laws 96 and 25

A description of what the statute asks, not legal advice. What you owe depends on what your business collects and why. Confirm your own situation with a Quebec-qualified adviser.