Québec Law 25 and voice AI go hand in hand for any organization operating in Québec that plans to deploy a voicebot, record calls or transcribe them automatically. A voice, a phone number, a reason for calling, an account number: all of these are personal information. And automatic transcription produces a lot of it, often more than people expect.
This article gives a general overview of the obligations to plan for.
Disclaimer: this article is general information and is not legal advice. Your obligations depend on your sector, your status (private business or public body), the data you process and your architecture. Consult legal counsel about your specific situation.
Law 25 at a glance
Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) substantially amended Québec’s private-sector privacy act as well as the act governing public bodies. Its provisions came into force in stages between 2022 and 2024. It is overseen by the Commission d’accès à l’information (CAI), which has significant enforcement powers, including administrative monetary penalties.
For a telephony project, it affects governance (who is accountable, which policies), design (assessments, privacy by default) and operations (retention, incidents, individual rights).
Québec Law 25 and voice AI: which processing is covered?
A contact center or voicebot project typically involves:
- audio recording of calls (quality, training, evidence);
- automatic transcription (STT), in real time or after the call;
- analytics: intent detection, sentiment, keywords, AI-generated summaries;
- the voicebot itself, which collects information and reads and updates records;
- caller authentication, sometimes by voice;
- logging: call metadata, phone numbers, timestamps, technical logs.
Each of these needs a clear purpose and should collect only what is necessary.
Consent and transparency
Informing callers at the point of collection
Law 25 requires that individuals be informed, at the time of collection, of matters such as the purposes of collection, the means used, their rights of access and correction, and the possibility that their information may be communicated outside Québec. For a phone call, that typically means:
- a short, clear greeting stating that the call is recorded or transcribed, and why;
- disclosure that the caller is dealing with an automated system when that’s the case;
- a pointer to your privacy policy (website, email, on request) for the details.
Valid consent
Where consent is required, it must be manifest, free, informed and given for specific purposes. For sensitive information (health, financial data, biometrics), it must be express. Reusing recordings for a different purpose, such as training an AI model, may require new consent or a specific legal basis.
Identification, location or profiling technology
If your system uses technology that can identify, locate or profile a person (behavioral analytics or voice recognition, for example), the law requires you to inform them beforehand and, where applicable, tell them how to activate those functions. Voice biometrics is also subject to specific rules in Québec, including disclosure to the CAI before a biometric database is put into service.
The person in charge of personal information
Every organization must have a person in charge of the protection of personal information (often called the privacy officer). By default, this is the person with the highest authority, who may delegate the role in writing. The officer’s title and contact details must be published on the organization’s website.
In a voice AI project, this person should be involved from the start: they sign off on assessments, retention policies and incident handling.
Privacy impact assessments (PIAs)
For any new system
Law 25 requires a privacy impact assessment (PIA, or EFVP in French) for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information. A new voicebot, a transcription platform or an IVR overhaul connected to the CRM generally falls into this category.
The PIA must be proportionate to the sensitivity, purpose, quantity, distribution and medium of the information. It describes data flows, assesses risks and documents the safeguards chosen.
For transfers outside Québec
Before communicating personal information outside Québec, a specific assessment is required. It considers, among other things, the sensitivity of the information, the purpose, the protection measures (including contractual ones) and the legal framework of the destination jurisdiction. The transfer must be governed by a written agreement.
This is a key point for voice AI: many STT, TTS and language model services are hosted outside Québec, sometimes outside Canada. You need to know exactly where audio, transcripts and logs travel, including at subprocessors. Our page on STT, TTS and NLP engines covers hosting options.
Automated decisions
When a decision about a person is based exclusively on automated processing, Law 25 requires informing them no later than when the decision is communicated. On request, the person must be able to learn what personal information was used, the reasons and principal factors behind the decision, and submit observations to a staff member who can review it.
Voicebot scenarios worth analyzing:
- automatically declining a payment arrangement;
- prioritizing or refusing an appointment based on automated rules;
- locking an account after failed authentication.
Good practice: always provide a path to a human and document the decision logic.
Privacy by default and data minimization
- Most privacy-protective settings by default for technology products or services offered to the public.
- Minimization: transcribe only what’s useful, mask sensitive data (card numbers, PINs) in transcripts and logs, and prefer DTMF input kept out of recordings for payments.
- Security: encrypt media and signaling (TLS, SRTP) and storage, enforce access control, and log access. See our VoIP security expertise.
Retention and destruction
Personal information must be destroyed or anonymized once its purpose has been fulfilled, subject to retention periods required by other laws. For telephony, set separate retention periods for:
- audio recordings;
- transcripts and summaries;
- call metadata;
- technical logs, including those held by AI engine providers.
Check your vendors’ terms too: some retain data to improve their models, which should be disabled or contractually governed.
Confidentiality incidents
Unauthorized access to, loss of, or unauthorized disclosure of personal information is a confidentiality incident. The organization must take steps to reduce the risk, keep an incident register and, when an incident presents a risk of serious injury, notify the CAI and the affected individuals.
For a voice AI platform, prepare in advance: detection (alerts, logs), a risk-assessment procedure, each subprocessor’s responsibilities, and notice templates.
What about PIPEDA and GDPR?
- PIPEDA: the federal act applies in particular to federally regulated businesses and to personal information that crosses provincial or national borders in the course of commercial activity. The same organization may need to account for both regimes.
- GDPR: if you handle calls from people located in the European Union, for instance customers in France or Belgium, the GDPR may apply, with its own requirements (lawful basis, impact assessments, transfers).
An architecture designed for Law 25 (minimization, transparency, controlled transfers) generally makes compliance with other regimes easier, without guaranteeing it.
Checklist for a voice AI project
- Designate and involve the person in charge of personal information.
- Map the data: audio, transcripts, metadata, logs, and where each is hosted.
- Complete the project PIA, plus the transfer assessment if data leaves Québec.
- Write caller notices and update the privacy policy.
- Identify exclusively automated decisions and provide human review.
- Define retention periods and automate destruction.
- Put contracts in place with every vendor (STT, TTS, LLM, hosting).
- Prepare incident handling and the register.
The bottom line
Law 25 doesn’t stand in the way of voice AI; it requires designing it with transparency, minimization and control over data flows. Projects that build these requirements in from the start avoid costly rework. If you’re planning a voicebot or an AI call analytics project, we can help design a technical architecture that supports these obligations, alongside advice from your legal counsel.