Recording phone calls in Canada and Quebec: what the law allows

What federal privacy law adds: announce, limit, hand over

Outside Quebec, Alberta and British Columbia, a business that records its customers falls under PIPEDA. According to the Office of the Privacy Commissioner of Canada, it tells the person the call is recorded, and why, in precise terms. If the person carries on with the call knowing this, their consent is implied; a voiceprint or sensitive information may require express consent.

It offers another way to someone who declines, unless an exception to consent applies: continuing without recording, coming in person, doing it online. It uses the recording only for the reason given, limits how long it keeps it, and hands it over to the person who asks, within thirty days of the written request, unless PIPEDA allows an extension.

What Quebec's Law 25 adds (Quebec only)

We read the official text of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), updated to August 12, 2026. Section 8: when the information is collected, the person is told, in clear and simple language, the purposes, the means, their rights of access and rectification and their right to withdraw consent. Section 3.1: the title and contact information of the person in charge of privacy are published on the business's website. Section 12: the information is used only for the purposes given, with some exceptions.

Section 23: once the purposes are achieved, the business destroys the information or anonymizes it. Section 11: information used to make a decision about a person is kept for at least one year. Sections 27 and 32: the person gets a copy, and a written reply is due no later than thirty days after the request.

Section 17: before communicating information outside Quebec, or entrusting a provider outside Quebec with collecting or keeping it, the business conducts a privacy impact assessment and signs a written agreement. So ask your provider where the voice goes and how long a copy stays there.

“This call may be recorded”: what to say, and when

Say the call is recorded, not that it “may be”, when it is. Say why, in one precise reason. Say it at the start, before the caller gives a name: Quebec's Act says to inform the person when the information is collected, and British Columbia's says on or before collecting, verbally or in writing. None of these texts requires software to introduce itself as software, but saying so makes the notice clearer.

Keep the rest ready on request, in the privacy policy published on your website (section 8.2 in Quebec): rights, retention period, person in charge of privacy. And plan an answer for someone who declines: in British Columbia, section 7 forbids requiring consent beyond what is necessary to provide the service. A callback from your team or a text are simple alternatives.

A version that fits in one breath: “[Your business], hello! This call is recorded so we can take down your request accurately. If you would rather not be recorded, say so, and someone on our team will call you back.”

Recording, transcribing, summarizing: three different things

Recording means keeping the audio. Transcribing means turning speech into text, word for word: personal information just as the audio is. Summarizing means pulling out the request: who is calling, about what, how urgently. Real-time processing, without which a receptionist cannot answer, decides where the voice travels during the call. The three outputs do not need to live equally long: the law asks for a period justified by the reason given, not the same one for everything.

How Zenvox does it, on every call

The first sentence the caller hears, before saying anything, announces the recording, its reason, and that they are talking to a virtual assistant. By default: “[Your business], hello! This is [first name], the virtual assistant. This call is recorded so I can take down your request accurately. How can I help you?” If the caller asks during the call whether they are being recorded, the receptionist confirms it.

You can rewrite the greeting, but the app refuses a greeting that no longer mentions the recording, and the notice the caller heard is logged with the conversation. If the caller declines to be recorded, no audio archive is created for that call, and the receptionist offers the other route you chose: a callback from your team, a transfer, or a text.

After the call, you get the summary by text; in your workspace, every call has its file — recording, transcript, written request — and every time someone opens it, a dated entry is logged. Those files live in Zenvox's database in Canada; real-time voice processing runs through a subprocessor in the United States, whose copy is short-lived, as the bottom of every page states. The Security and data handling page says where the assessment for that transfer stands.

Keeping, handing over, erasing, from your workspace

Zenvox does not choose the retention period for you: you set a period for the audio, the transcript and the written request, and what happens when it ends, deletion or anonymization. You can also keep no audio at all: the transcript and the summary stay. A hold suspends deletion for a file under dispute.

An access request is handled from the person's file: you export their recording, transcript and request, and an incomplete export names what it left out. An erasure request also removes the summaries, drafts and attached files. The thirty-day deadline stays yours.

What changes from one province to the next

The Criminal Code is the same everywhere. For privacy, Quebec, Alberta and British Columbia have their own law for what happens inside the province; PIPEDA applies elsewhere, and to information that crosses a border. Each province and territory has its own page, with its sources: the links are below.