Bilingual phone service for Quebec businesses: what Law 25 and Bill 96 actually require

If your business takes phone calls from Quebec customers, two provincial laws shape what your phone line is allowed to do. Law 25 (the privacy law, effective in phases through 2024) governs the data side: call recordings, consent, retention. Bill 96 (the French-language law, effective 2022) governs the language side: what tongue the call gets answered in, what choice the caller is offered.

Both laws apply whether your headquarters is in Montreal, Toronto, Calgary, or Brooklyn. The trigger is serving a Quebec resident, not where your office sits. Most Canadian SMBs only think about this when an enforcement letter lands.

Two laws, two angles

It's tempting to lump these together because they're both "Quebec rules," but they come from different ministries and different enforcement bodies, and they overlap only in narrow places. Treat them separately.

Law 25: what your phone line touches

Law 25 (Bill 64 when it was being debated; Law 25 once enacted) modernized Quebec's privacy regime in three phases starting September 2022. By September 2024 the full framework was in force. It applies to every business handling the personal information of a Quebec resident. Your size doesn't exempt you.

For phone operations specifically, four parts of Law 25 matter:

1. Consent for call recording

Most modern phone systems record calls, often by default. If yours does, Law 25 requires you to inform the caller and obtain their consent. The consent must be specific (recording, not "everything"), informed (the caller knows what it's for), and granular (they can decline recording without losing access to the service). The CAI has issued explicit guidance on this.

In practice, this is a short spoken notice at the very start of the call, before anything else is discussed. It can be as simple as "this call may be recorded" folded into the greeting. Whether you need to go further than notice, with an explicit opt-in or a way to decline recording and still be served, depends on what you record and why. That is the part worth taking to a lawyer.

2. Designated privacy officer

Every organization must publicly designate a person responsible for privacy. Their contact details must be on your website. For a one- or two-person shop, that's the owner. The name and title go on the privacy policy page.

3. Retention and deletion

Call recordings, transcripts, and any associated metadata are personal information. You need a written retention policy, with a short window for recordings and a longer one for the booking records your accountant needs, plus the ability to delete on request. If a Quebec resident emails you and asks for their data to be erased, you have 30 days to comply.

4. Breach notification

If a "confidentiality incident" (Law 25's term for a breach) poses a risk of serious harm, you must notify the CAI and the affected individuals without delay. "Serious harm" is interpreted broadly. A leaked call recording with payment information would qualify; a leaked appointment time probably wouldn't.

Bill 96: the French-service requirement

Bill 96 (the "Act respecting French, the official and common language of Québec") came into force on June 1, 2022. The operative provision for phone service is straightforward: Quebec consumers must be able to receive service in French. Other languages may be offered in addition. French has to be available, and it cannot be a second-class option.

Consumers of goods and services have a right to be informed and served in French.

In phone terms that means: when a Quebec area code dials in, the call needs to be answerable in French. A line that auto- responds in English only is exactly the case the requirement is aimed at, even if it offers a French callback option. The safe pattern is to offer the language choice up front, default to French, and switch to whatever the caller speaks.

The practical checklist

Here's what compliance looks like in concrete terms for a Canadian service business that takes Quebec calls:

1. Recording notice at call start. A short statement, before anything else, that the call may be recorded. You also need a documented decision on whether your use of recordings needs an explicit opt-in on top of it.
2. Bilingual greeting + service. The call opens with both languages offered ("Pour le service en français, dites français…") or auto-detects from the caller's first reply.
3. Privacy officer on your website. Name, title, email. On a public page.
4. Written retention policy. One paragraph in your privacy policy. 90 days for recordings is reasonable; longer if you have a documented operational reason.
5. Data subject request process. An email address that monitors requests, a documented turnaround (30 days max), and a process for verifying the requester's identity before deleting.
6. Breach response plan. Who gets notified, what triggers notification, who calls the CAI.

How a bilingual AI receptionist handles both

Most of the items above are policy-and-paperwork. The phone side is items 1 and 2, and that is where the right tool helps. Here is what Cedri actually does, and what it doesn't:

• Speaks the recording notice on its opening line. Cedri's greeting carries one clause, "I'm an AI assistant and this call may be recorded," in the caller's language, on every call. It is a notice, not a consent gate: there is no keypress to capture and no acknowledgement stored.
• Answers in your primary language and follows the caller. If they reply in the other official language the call continues there, and it can switch back mid-call as often as the caller does.
• Stores transcripts, bookings, and customer records in Canadian data centres, with a retention window you choose in Settings. It is off by default, so nothing is purged until you set one. Live call audio and its recordings are handled by the voice infrastructure provider, and the split is spelled out in Cedri's privacy policy, which is aligned with PIPEDA and Law 25.
• Gives you the delete button. You can wipe an individual call's recording and transcript, set a retention window that purges older ones on a schedule, and export or delete the whole account. What Cedri does not have is a one-click "erase everything for this phone number" sweep; an erasure request is worked call by call.