What Law 25 actually asks of a phone system

Five of Law 25's obligations reach a phone system directly: you must name a privacy officer and publish their contact details, publish a privacy policy, obtain valid consent, complete a privacy impact assessment before personal information leaves Quebec, and keep a register of confidentiality incidents.

Most Law 25 guidance is written for websites and CRMs. A phone line collects personal information too — numbers, recordings, voicemail, transcripts, call logs — and the obligations do not soften because the channel is audio.

The five that touch a phone line

1. A named privacy officer. Since 22 September 2022, every private business in Quebec must designate someone responsible for the protection of personal information. By default it is the person with the highest authority, and the role can be delegated. The title and contact details must be published on your website — designating someone internally and telling nobody does not satisfy it.

2. A published privacy policy, in clear language, covering what you collect and why. For a phone system that means saying that you hold call records, and for how long.

3. Valid consent — manifest, free, informed, specific and granular. Recording consent has its own article because it is the hardest of the five to get right.

4. A privacy impact assessment before personal information is communicated outside Quebec. This is the one most often missed, and it is the one that catches almost every cloud phone system, because almost none of them keep Quebec data in Quebec. Where your call data lives covers it properly.

5. A register of confidentiality incidents — every incident, not only the reportable ones. What to do when one involves call records covers the register and the notification threshold.

What a phone system holds that counts

It is easy to underestimate. A business phone line typically holds:

• caller phone numbers, which identify a person
• call recordings, if enabled
• voicemail audio and any machine transcription of it
• call detail records — who called whom, when, for how long
• contact records built up from call traffic
• IP addresses from the softphone session

All of it is personal information under Law 25 when it can be associated with a person. The transcription is worth singling out: a transcript is a new record derived from the recording, and it persists differently.

Questions to ask any vendor

Short list, and the answers should be findable without a sales call:

• Where is the data stored, physically?
• Have you completed an impact assessment for transfers outside Quebec, or do you expect me to?
• What is retained, for how long, and can I change it?
• Who at your company can access my call recordings?
• Is your sub-processor list published and complete?

That last one is more revealing than it looks. A vendor whose sub-processor list is behind a login or an email form is telling you something about how it treats disclosure generally.

Where Ringfully is

We publish a complete, named sub-processor list — no form, no login. Our data is in AWS us-east-1, in the United States, which is stated plainly rather than described as "the cloud". Recording is off by default. We do not yet name a privacy officer, because the operating entity is not yet incorporated, and every policy page says so on its face until it is.

That last point is a gap, not a feature. We would rather it be visible than implied.

A description of what the statute asks, not legal advice. Obligations depend on what your business collects and why — confirm your position with a Quebec-qualified adviser. Our own gaps are listed on security.