Quebec Law 25 for Business Phones: Call Logs and Voicemail

The short answer

If your business operates in Quebec, the caller numbers, call logs, voicemails and transcripts your phone line produces are almost always personal information under the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by Law 25 (S.Q. 2021, c. 25). For a small business phone line, that means six things:

1. Name a person in charge of privacy and publish their title and contact details.
2. Write down how long you keep call data and how you delete it.
3. Use voicemail and caller details only for the reason the caller contacted you.
4. Assess privacy impacts before adopting a phone system, and before call data is kept outside Quebec.
5. Log every confidentiality incident, and report the serious ones.
6. Answer access requests within 30 days.

This is the situation as of October 2026. This guide is educational, not legal advice.

2026 check: the official consolidation of P-39.1 is marked current to 15 October 2026. The latest amending acts it cites date from 2023, and none of the sections below show a 2024, 2025 or 2026 amendment ^[1]. Section 88 required the Commission d'accès à l'information (CAI) to report to the government on how the Act is working by 14 June 2026, so watch for follow-up changes.

What Law 25 is and who it applies to

Law 25 brought in its changes in three stages: September 2022, September 2023 and 22 September 2024 ^[2]. The Act covers any "enterprise" as defined in article 1525 of the Civil Code. According to the CAI, that includes sole proprietors, corporations, partnerships, condo syndicates and associations. Whether a non-profit is covered is decided case by case ^[3].

An organization located outside Quebec that collects, holds, uses or communicates personal information while carrying on its business in Quebec is also subject to the Act ^[3]. An Ontario or US company that answers calls from Quebec customers should assume the Act applies to those calls. The same CAI page refers health and social services organizations to a separate Quebec health-information law, so clinics should check both.

Why call logs, voicemail and transcripts are personal information

Personal information is any information that lets someone identify a natural person, directly or indirectly ^[4]. The Act applies whatever the medium or form ("written, graphic, taped, filmed, computerized, or other") and whether you keep the information yourself or through a third party ^[1]. The CAI lists sound (sonore) among the covered forms and notes that the information does not have to sit in a file under the person's name to count ^[3].

The federal Office of the Privacy Commissioner (OPC) makes a similar point. It notes that call recordings can capture voice characteristics, accents, speech disabilities and incidental personal details, and it calls voiceprints "sensitive biometric information" ^[5]. That guidance applies PIPEDA rather than Quebec law, but the reasoning carries over to voicemail.

Sensitive information. Information is sensitive when its nature (in particular medical, biometric or otherwise intimate) or the context of its use creates a high reasonable expectation of privacy ^[1]. The CAI's examples include health, sexual orientation, ethnic origin, religious beliefs and financial situation ^[4]. A "call me back about my quote" message is probably not sensitive. A voicemail describing symptoms to a clinic probably is. Plan for the most sensitive message your mailbox is likely to receive.

Carve-out. The collection and confidentiality rules do not apply to information about a person's work duties, such as their name, title and work telephone number ^[1]. A supplier calling from an office line is partly exempt. A consumer calling from a personal cell is not.

Appoint and publish a privacy officer

The person with the highest authority in the enterprise, often the owner, is the person in charge of protecting personal information. They may delegate the role in writing, in whole or in part. The role's title and contact information must be published on your website, or made available by other appropriate means if you have no website ^[1].

This person handles access and correction requests, which must be answered within 30 days. If you don't answer within that time, the request is treated as refused ^[6]. Someone therefore has to know how to find every voicemail, transcript and log entry for a given caller. Publish a role-based contact (for example, "Privacy Officer" with a shared mailbox) so a staff change doesn't leave a dead contact on your website.

Governance policies and a plain-language privacy policy

Governance policies and practices ^[1] must cover at least:

• how personal information is kept and destroyed;
• staff roles throughout the information's life cycle;
• how privacy complaints are handled.

They must be proportionate to your business and approved by the person in charge. Detailed information about them must be published in clear, simple language on your website ^[6].

A privacy policy. If you collect personal information by technological means, you must publish a privacy policy in clear, simple language and give notice when you change it ^[1]. For the phone line, the policy should cover:

• what the line keeps (logs, voicemail, transcripts) and why;
• who can access it, how long it is kept and how it is deleted;
• which providers handle it, and whether it may leave Quebec;
• how to request access, and how to reach the privacy officer.

Informing callers and consent

At collection. When you collect information from someone, you must tell them the purposes and means of collection, their rights of access and correction, and their right to withdraw consent. Where relevant, you must also tell them about third parties involved and the possibility that the information is communicated outside Québec. All of this must be in clear, simple language ^[1]. The Act does not prescribe a voicemail greeting. A practical approach is a one-sentence notice that points to your policy:

"Leave your name, number and a short message so we can call you back. Our privacy policy at yourdomain.ca explains how we handle messages."

« Laissez votre nom, votre numéro et un court message pour que nous puissions vous rappeler. Notre politique de confidentialité, sur votredomaine.ca, explique comment nous traitons les messages. »

Consent. Since September 2023, consent has to be requested for each purpose, in simple and clear terms. A written consent request must be presented separately from any other information ^[2][1]. Information may be used only for the purposes it was collected for unless the person consents, and that consent must be express for sensitive information ^[1].

• Calling back about the message is why the caller left it, so it is the collection purpose.
• Adding voicemail callers to a marketing list is a new purpose. Section 12 says commercial prospection cannot count as a "consistent" purpose, so you need consent first.
• Live call recording raises its own notice and consent questions. See our small-business call recording checklist.
• Bilingual lines should give notices in each language the line offers. Our bilingual auto attendant guide covers menu wording.

Privacy impact assessments and storing data outside Quebec

A privacy impact assessment (PIA, called an EFVP in French) is mandatory in three situations ^[6]. Two of them matter for phone lines:

1. Acquiring, developing or overhauling an information system or electronic service delivery system that involves personal information ^[1]. The CAI's examples of information systems include videoconferencing and collaboration software, so a hosted phone system with voicemail-to-email plausibly qualifies. Consult the person in charge from the start of the project. The system must also be able to return computerized information collected from a person in a structured, commonly used format.
2. Communicating personal information outside Quebec, including entrusting someone outside Quebec with collecting, using, communicating or keeping it on your behalf ^[1]. The assessment must weigh the sensitivity of the information, the purposes, the protection measures and the destination's legal framework. The transfer may go ahead only if protection is adequate, and it requires a written agreement.

If your provider stores voicemail in Ontario, the US or elsewhere, assume section 17 applies. A PIA must be proportionate to the sensitivity, purposes, quantity, distribution and medium of the information ^[1]. For a small office it can be a few pages. The CAI publishes a guide and a report template.

Vendor contracts. You may share information without consent with a provider that needs it to perform a contract. The contract must be in writing and must set out:

• the measures that protect confidentiality;
• a limit on use to the contract itself;
• that the provider does not keep the data after the contract ends.

The provider must also report breaches to your privacy officer without delay ^[1][7].

Voicemail-to-email: retention, destruction, access and incidents

Voicemail-to-email creates copies: in the provider's storage, in several inboxes, on staff phones and in forwarded threads.

Retention. Once the purposes are achieved, you must destroy the information or anonymize it, subject to any retention period another law requires ^[1]. The CAI recommends inventorying the types of documents that contain personal information and setting a retention schedule ^[8]. The Act sets no number of days for voicemail. Choose a period, write it down and apply it to every copy, including inbox copies.

Security. Security measures must be reasonable given the sensitivity, purposes, quantity, distribution and medium of the information ^[1]. Send voicemail emails to access-controlled role mailboxes, not personal accounts.

Access and portability. If a caller asks, computerized information must be provided as a written, intelligible transcript ^[1]. Since 22 September 2024, computerized information collected from the person must also be provided on request in a structured, commonly used technological format ^[2].

Incidents. A confidentiality incident is unauthorized access, use or communication, or the loss of personal information ^[1]. The CAI's examples include sending information to the wrong recipient ^[9]. On a phone line, that could be a voicemail email forwarded to the wrong client, a former employee still receiving voicemail notifications, or a lost, unlocked phone. Under sections 3.5, 3.7 and 3.8 (P-39.1), you must:

• take reasonable steps to reduce the risk and prevent repeats;
• assess the risk of serious injury with the person in charge;
• if the risk is serious, promptly notify the CAI and the people affected;
• record every incident in a register, including the minor ones. The CAI says register entries must be kept for at least five years ^[9].

You remain responsible for incidents at a provider that holds data for you.

Penalties and enforcement

Administrative penalties can apply to:

• failing to inform people as sections 7 and 8 require;
• handling information in contravention of the law;
• failing to report an incident when required;
• lacking the security measures section 10 requires.

You may offer the Commission an undertaking to fix a failure. If the Commission accepts it and you comply, no administrative penalty can follow for those acts ^[1]. The amounts above are ceilings, not typical fines.

A one-page Law 25 checklist for a small business phone line

• Person in charge named (delegation in writing); title and contact published on the website
• Governance policies cover phone-data retention, destruction, staff roles and complaints; approved and summarized online
• Privacy policy mentions call logs, voicemail and transcripts, in plain language
• Inventory written: logs, audio, transcripts and staff notes, plus where each copy lives
• Voicemail greeting points to the privacy policy in each language the line uses
• Voicemail emails go to access-controlled role mailboxes
• Departing staff removed from voicemail notifications and phone apps the same day
• Proportionate PIA done for the phone or voicemail system
• Storage locations confirmed; section 17 assessment and written agreement if data leaves Quebec
• Provider contract covers confidentiality, limited use, deletion at contract end and breach notice
• Retention period set and deletion done on schedule in every copy
• No marketing to voicemail callers without separate consent
• Access requests answered within 30 days
• Incident register kept; serious incidents reported

FAQ

Does Law 25 apply to a business outside Quebec? Yes, when the business collects, holds, uses or communicates personal information while carrying on its business in Quebec ^[3]. Its activity elsewhere in Canada is generally governed by PIPEDA or another province's law. For Canadian numbers and porting, see our Canada page.

Are call logs sensitive information? Usually not on their own. Sensitivity depends on the nature of the information and the context ^[1]. A log of calls to an addiction clinic reveals more than a log of calls to a hardware store.

Do I need a PIA just to keep my current phone service? Section 3.3 applies to projects that acquire, develop or overhaul a system. Section 17 applies before information is communicated outside Quebec, or entrusted to someone there for keeping. If your provider stores voicemail outside Quebec, check section 17 first. Beyond the mandatory cases, the CAI recommends PIAs for any project involving personal information ^[6].

Auto Attendant emails each voicemail with a transcript and keeps voicemails for 365 days, so list both copies in your inventory and retention schedule.