British Columbia: PIPA, and the spoken notice the statute expressly provides for

British Columbia law expressly provides for a spoken notice at collection time — the exact shape of a disclosure at the start of a call. It carries no breach-reporting duty, and that silence excuses you from nothing.

Which law applies to a British Columbia business whose calls are answered by software?

British Columbia’s Personal Information Protection Act, assented to in 2003 and current to 8 September 2026 in the version we read. Federal order SOR/2004-220 sets aside Part 1 of the federal statute for activity taking place inside the province.

Provincial law governs what happens inside British Columbia; federal law governs information transferred outside the province or outside the country. A business whose calls do not stay entirely inside the province therefore has both above it.

Two features make this page useful beyond that principle. The statute expressly provides for a spoken notice at collection time — the exact shape of a disclosure at the start of a call. And it carries no breach-reporting duty, the opposite of both the Alberta regime and the federal one.

This is not legal advice. It is a summary of what we read, written for a business owner, carrying its reading date below.

Where you probably are

You run a business in British Columbia and you have heard it falls under provincial law rather than federal law. Half true, and the missing half is the half bearing on a service that answers a phone.

You may also have read that a breach must be reported to the provincial commissioner. That is not what British Columbia law says, and below we explain why that still excuses you from no reporting at all.

The spoken notice, written into the statute itself

This is the most directly useful provision in the whole file, because it addresses speech head-on. Section 10(1) reads: “On or before collecting personal information about an individual from the individual, an organization must disclose to the individual verbally or in writing (a) the purposes for the collection of the information, and (b) on request by the individual, the position name or title and the contact information for an officer or employee of the organization who is able to answer the individual’s questions about the collection.”

In other words, British Columbia law provides for the very form of a disclosure spoken at the start of a call. Not a tolerance: the text. What it adds does take preparation — your business must be able to name, on request, whoever answers questions about that collection.

Section 4(3) also requires designating one or more individuals responsible for ensuring the organization meets its obligations under the Act. Unlike Quebec, no duty to publish their details on your site — yet you must be able to give them when asked.

Consent cannot be a condition of service beyond what is necessary

Section 7 reads: “An organization must not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service.”

The operational consequence is sharp. A “decline the recording and we will not serve you” stance is legally fragile in British Columbia once recording is not necessary to deliver the service. That is the strongest argument for keeping a route without recording: a person who declines must be servable another way — in writing, in person, or by a transfer to somebody.

The statute also frames collection itself: section 11 allows it only for purposes a reasonable person would consider appropriate in the circumstances, and section 6 requires consent, subject to exceptions.

Provincial law imposes no breach reporting — and why your own duty is unchanged

We checked this in the text of the statute itself: no provision creates a duty to report a breach, either to the commissioner or to affected individuals. The provincial commissioner has publicly called for that amendment for years; a call is not a statute. Public bodies in the province, under a different statute, are the ones who must report their breaches.

That does not mean no reporting duty reaches you. The moment information leaves the province, federal law governs that transfer — and since 1 November 2018 it requires reporting to the federal commissioner and notifying affected individuals of any breach presenting a real risk of significant harm, plus keeping a record of every breach for 24 months.

A good illustration of what the border rule changes in practice: reading provincial law alone would hand you the opposite of the right answer here.

“Name and phone number”: the exclusion does not cover your customer

British Columbia law excludes business contact information from its definition of personal information. Many summaries conclude a name and a phone number are not personal information in this province. Wrong, and the definition is narrow: it covers information enabling an individual at a place of business to be contacted — name, position name or title, business telephone number, business address, business email or business fax number.

A consumer’s home number, dialling a plumber from their kitchen, is not business contact information. It is personal information, and everything a collection requires applies to it.

For a service that answers a phone, that is the distinction worth holding on to: the exclusion targets a work contact, not a customer.

Recording a call, and where a complaint goes

The Criminal Code does not forbid a business party to a call from recording it: consent from one of the people in the conversation is enough to take it out of the offence. Privacy law, for its part, requires a caller to be told at the start of a call about the recording and its purpose. Both regimes apply at once.

The provincial regulator is the Office of the Information and Privacy Commissioner for British Columbia, OIPC BC. It administers the private-sector statute, the public-sector statute and the e-health statute. For what leaves the province, a complaint goes to the Office of the Privacy Commissioner of Canada.

Here, the disclosure is spoken before the microphone opens. An access log, exporting a record, deleting a record and a role per teammate exist in the product. What the product will not do for you: appoint your responsible person, write your policy, set your retention period. Federal law in force stays the same as elsewhere in the country; Bill C-36, tabled on 15 June 2026, sat at second reading on 23 October 2026 without royal assent.

What we read, and when

Checked on 2026-09-15

Related product pages

Pages describing measures taken, processing locations and known limits.

Security and data handlingPrivacy policyOur subprocessors