Bilingual phone service for Quebec businesses: what Law 25 and Bill 96 actually require

If your business takes phone calls from Quebec customers, two provincial laws shape what your phone line is allowed to do. Law 25 (the privacy law, effective in phases through 2024) governs the data side: call recordings, consent, retention. Bill 96 (the French-language law, effective 2022) governs the language side: what tongue the call gets answered in, what choice the caller is offered.

Both laws apply whether your headquarters is in Montreal, Toronto, Calgary, or Brooklyn. The trigger is serving a Quebec resident, not where your office sits. Most Canadian SMBs only think about this when an enforcement letter lands.

Two laws, two angles

It's tempting to lump these together because they're both "Quebec rules" — but they come from different ministries, different enforcement bodies, and they overlap only in narrow places. Treat them separately.

Law 25: what your phone line touches

Law 25 (Bill 64 when it was being debated; Law 25 once enacted) modernized Quebec's privacy regime in three phases starting September 2022. By September 2024 the full framework was in force. It applies to every business handling the personal information of a Quebec resident — your size doesn't exempt you.

For phone operations specifically, four parts of Law 25 matter:

1. Consent for call recording

If you record calls — and most modern phone systems do, even by default — Law 25 requires you to inform the caller and obtain their consent. The consent must be specific (recording, not "everything"), informed (the caller knows what it's for), and granular (they can decline recording without losing access to the service). The CAI has issued explicit guidance on this.

In practice, this is a short disclosure at the start of every call: "This call may be recorded for quality and booking purposes. Press 1 or say 'continue' to proceed."The caller's response is logged with the call record.

2. Designated privacy officer

Every organization must publicly designate a person responsible for privacy. Their contact details must be on your website. For a one- or two-person shop, that's the owner. The name and title go on the privacy policy page.

3. Retention and deletion

Call recordings, transcripts, and any associated metadata are personal information. You need a written retention policy (typical: 90 days for recordings, 7 years for booking metadata for tax purposes) and the ability to delete on request. If a Quebec resident emails you and asks for their data to be erased, you have 30 days to comply.

4. Breach notification

If a "confidentiality incident" (Law 25's term for a breach) poses a risk of serious harm, you must notify the CAI and the affected individuals without delay. "Serious harm" is interpreted broadly. A leaked call recording with payment information would qualify; a leaked appointment time probably wouldn't.

Bill 96: the French-service requirement

Bill 96 (the "Act respecting French, the official and common language of Québec") came into force on June 1, 2022. The operative provision for phone service is straightforward: Quebec consumers must be able to receive service in French. Other languages may be offered in addition, but French has to be available — and not as a second-class option.

A business carrying on its activities in Quebec must respect the right of consumers to be informed and served in French.

In phone terms that means: when a Quebec area code dials in, the call needs to be answerable in French. A line that auto- responds in English only — even with a French callback option — has been challenged before the OQLF. The safe pattern is to offer the language choice up front, default to French, and switch to whatever the caller speaks.

The practical checklist

Here's what compliance looks like in concrete terms for a Canadian service business that takes Quebec calls:

1. Consent disclosure at call start.A 5-7 second statement that the call may be recorded, with the caller's acknowledgement logged.
2. Bilingual greeting + service.The call opens with both languages offered ("Pour le service en français, dites français…") or auto-detects from the caller's first reply.
3. Privacy officer on your website. Name, title, email. On a public page.
4. Written retention policy. One paragraph in your privacy policy. 90 days for recordings is reasonable; longer if you have a documented operational reason.
5. Data subject request process.An email address that monitors requests, a documented turnaround (30 days max), and a process for verifying the requester's identity before deleting.
6. Breach response plan. Who gets notified, what triggers notification, who calls the CAI.

How a bilingual AI receptionist handles both

Most of the items above are policy-and-paperwork. The phone side — items 1 and 2 — is where the right tool helps. A properly designed AI receptionist:

• Plays consent disclosure automaticallyat the start of every call, in the caller's language, and logs the acknowledgement in the call record.
• Detects language from the caller's first phrase and continues the rest of the call in French or English accordingly. Mid-call switches are handled too — the caller can flip between languages.
• Stores recordings in Canadian data centres with documented retention (this is Cedri's default; PIPEDA-aligned and Law 25-compatible).
• Honours deletion requests via API — when a customer asks to be forgotten, the call records, transcript, and booking metadata associated with their number are purged within the 30-day window.