Quebec: Law 25, and the federal law that resumes at the border

What Quebec law requires, and since when

Obligations arrived in stages, and dates matter because they say since when each one can be demanded. Since 22 September 2022: appoint a person in charge of protecting personal information and publish that person’s title and contact details on your business website; keep a register of every confidentiality incident; act promptly to reduce a risk of injury; notify the Commission d’accès à l’information and affected individuals of any incident presenting a serious risk of injury.

Since 22 September 2023: governance rules for personal information, the privacy impact assessment, new consent rules — a request presented separately from other information, parental consent for a child under 14 —, a right to have circulation stopped and search results de-indexed, information owed at collection time, and a mandatory assessment before any communication outside Quebec.

Since 22 September 2024: a right to portability, meaning an obligation to hand over, on request, computerised information in a structured and commonly used technological format.

The official text of the Quebec statute (CQLR, c. P-39.1), updated to 12 August 2026, was read on 21 October 2026 for our call-recording guide, which cites its sections. Section 3.1 covers the person in charge of privacy and publishing their title and contact details, section 8 the information owed at collection, and section 17 the assessment made before a communication outside Quebec. The first two dates come from government releases we read and list below; the third rests on concurring secondary sources, and we give it for what it is.

The point almost nobody gets right

Quebec’s exemption order sets federal law aside for activity taking place inside Quebec. It does not set aside the rest. The regulatory analysis published with an order of the same family lists what stays federal: transfers of information across provincial or national borders, federal works and undertakings — banks, telecommunications, interprovincial transport — and personal information about employees.

For a Quebec business whose calls are answered by software, one consequence follows directly: the moment information leaves the province, federal law governs that transfer, on top of what Quebec law already requires. The two add up rather than replace one another.

Complaints follow the same dividing line. For what happens inside Quebec, a complaint goes to the Commission d’accès à l’information. For what leaves it, a complaint goes to the Office of the Privacy Commissioner of Canada. A vendor showing you a single authority is handing you an incomplete map.

The assessment required before sending information outside Quebec

This is the obligation bearing most directly on a service such as ours. Since September 2023, before communicating personal information outside Quebec, a business must carry out a privacy impact assessment, and that communication may proceed only where the assessment shows the information will receive adequate protection.

The obligation falls on whoever communicates: on you as much as on us. What you can demand from a vendor is therefore precise, and comes down to four questions. Where do your call records live? Which processing is entrusted to whom? How long does a copy exist elsewhere? Where does their assessment for that transfer stand?

Where ours stands is written at the foot of every page on this site, in the one wording we use for it. We do not rewrite it here: a second version would end up saying something other than the first, which is exactly what a page like this must avoid.

Recording a call: two regimes, not one

The Criminal Code does not forbid a business party to a call from recording it: consent from one of the people in the conversation is enough to take it out of the offence, and a business taking part in that conversation is one of those people.

That settles nothing on the privacy side, and this is where many commercial pages go wrong. Privacy law requires a caller to be told at the start of a call about the recording and its purpose, requires the stated purpose to be the only one used, requires an alternative route for a person who declines, lets that person request access to their recording, and limits retention. Both regimes apply at once; one does not excuse the other.

Here, the disclosure is spoken before the microphone opens, at the start of the call. It is a mechanism rather than a label: you can hear it, by calling your own receptionist.

Decisions made without human involvement

Since 2023, a business making a decision about a person based exclusively on automated processing must inform that person no later than when it communicates the decision. On request, it must state which information was used, the reasons along with the main factors and parameters that led to the decision, and that person’s right to have the information corrected. It must also give them an opportunity to submit observations to a staff member able to review the decision.

A receptionist that sorts, qualifies or sets aside a request without a person reviewing it falls inside that definition. Good reason to keep somebody in the loop on refusals and on priorities, and to be able to show, on request, what fed the decision.

The product hands you the material: an access log, exporting a record, deleting a record, and a role per teammate that limits what each one sees. Whether you let sorting happen with nobody in the loop stays your decision, taken in full knowledge of this obligation.

What the product will not do for you

Appointing your responsible person, publishing their title and contact details on your site, keeping your incident register, writing your policy, setting your retention period, running your assessment before a communication outside Quebec: these are obligations of your business. A vendor letting you believe it performs them for you is doing you harm.

What we owe you, on the other hand, can be checked from outside: a disclosure you can hear at the start of a call, an access log, an export and a deletion that work inside the app, and public wording about processing locations that does not shift from page to page.

Quebec law provides for high administrative and penal sanctions. They are expressed as ceilings — a maximum the law allows, not a sum a business ordinarily pays. We print no figure for them: a ceiling quoted out of context serves to frighten, not to decide.

Where federal law stands as we write

Federal law in force today remains the Personal Information Protection and Electronic Documents Act. It has not been replaced. Since 1 November 2018 it requires a business subject to it to report to the federal commissioner and notify affected individuals of any breach of security safeguards presenting a real risk of significant harm, and to keep a record of every breach for 24 months.

A reform is under study. Bill C-36 received first reading on 15 June 2026; as of 23 October 2026 it sat at second reading in the House of Commons and had not received royal assent. None of its content is in force. This is a third reform attempt in six years, and both earlier ones died on the order paper: we date this page rather than bet on its passage.