Version françaiseGet my number
Menu

Launch: free number transfer, no activation fee. Get it

Practical guide

Law 25 and your phone data

Your phone produces a lot of personal information: who you call, when, for how long, what you write, what you leave in a voicemail box. In Québec, Law 25 strengthened the protection of this information. This guide explains what it protects, the rights it gives you and what it requires of businesses, whether they are your phone provider or a shop that records its calls.

Guides · Reviewed · 5 min read

Law 25 in brief

"Law 25" is the common name of the Act to modernize legislative provisions as regards the protection of personal information, passed in 2021. It amended the Act respecting the protection of personal information in the private sector, which applies to businesses that collect information about people in Québec. Its obligations came into force in three steps, in September 2022, 2023 and 2024. Québec's Commission d'accès à l'information (CAI) oversees it.

Telecommunications companies may also be subject to federal rules: the Personal Information Protection and Electronic Documents Act (PIPEDA), overseen by the Office of the Privacy Commissioner of Canada, and rules of the Canadian Radio-television and Telecommunications Commission (CRTC) on the confidentiality of customer information.

Which phone data is protected

Personal information is any information about a person that allows them to be identified, directly or indirectly. On the phone, this includes:

  • your phone number, your name and your account address;
  • call and text records: numbers, dates, times and durations, even without the content;
  • the content of your texts, pictures and voicemails;
  • call recordings and their transcripts, including summaries produced by artificial intelligence;
  • the address you register for 9-1-1;
  • technical information tied to your account, such as your IP address or device model.

What the law requires of businesses

  • Name a person in charge of the protection of personal information. By default, it is the person with the highest authority in the business; their title and contact information must be published on the website.
  • Publish a privacy policy in clear and simple terms.
  • Collect only the information needed, for set and stated purposes.
  • Get consent that is manifest, free and informed, requested for specific purposes and separately from any other information when it covers sensitive information or secondary uses.
  • Set the privacy settings of technology products offered to the public at the highest level of confidentiality by default.
  • Assess privacy factors before sending information outside Québec, and cover the transfer with a written agreement.
  • Destroy or anonymize information once the purpose for which it was collected is achieved, subject to retention periods set by other laws.
  • Keep a register of confidentiality incidents, and notify the CAI and the people affected when an incident presents a risk of serious injury.

Your rights

The business must answer an access or correction request within 30 days. Make your request in writing to the person in charge, saying what you are asking for.

  • Know what information a business holds about you and get a copy.
  • Have inaccurate, incomplete or ambiguous information corrected.
  • Withdraw your consent, for example to promotional emails or to AI processing.
  • Receive the information you provided in a structured, commonly used technological format (portability), since September 2024.
  • Ask for de-indexing of information or for its distribution to stop where the law allows.
  • Be told when a decision is made solely by automated processing, and submit your observations.

Recorded calls

"This call may be recorded": this message is not just a formula. It informs the person before recording starts. A business that records its calls should say why, who can listen to the recording and how long it keeps it. If you don't want to be recorded, you can ask for another way to communicate, such as email. Later, you can ask for access to a recording about you: contact the business you called, not its phone provider.

Artificial intelligence on the phone

Voicemail transcription, call summaries, suggested replies, virtual receptionist: these features process personal information, often at a provider outside Québec. An approach that respects the law makes them optional, asks for your separate and clear consent, explains what is sent to the AI provider, and lets you withdraw that consent without losing the basic service. A virtual agent should also say it is one at the start of the call.

For small businesses

Your business phone holds your customers' contact details, the history of your exchanges and sometimes recordings. A few simple steps help you follow the law: choose a provider that publishes a clear privacy policy and says where the data is stored; limit access to records and recordings to the staff who need it; remove the access of an employee who leaves; set a retention period for recordings; and log any incident in your register, such as a lost phone with no lock.

Law 25 penalties can be significant: administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and even higher penal fines. The CAI publishes practical guides for small organizations.

Filing a complaint

Start by writing to the business's person in charge of the protection of personal information. If the answer doesn't satisfy you, or you don't get one in time, you can go to Québec's Commission d'accès à l'information. For a federally regulated telecommunications company, the Office of the Privacy Commissioner of Canada can also take your complaint.

With MIMT

At MIMT, the person in charge of the protection of personal information is the president of GROUPE TAKATAK. Our privacy policy states what we collect, our providers, and the retention periods our systems actually apply. AI features are optional and off by default; see our AI page.