Quebec Privacy Rules and Your AI Phone: A Checklist

Every call your business answers collects personal information. A name, an address, a callback number, maybe details about what's broken in someone's house. If you're in Quebec, the province's personal-information protection rules govern how you handle every piece of that, and adding an AI receptionist doesn't change your obligations. It just changes who's answering the phone.

Contractors are busy running jobs, not reading legislation. But before you hand your phone lines to an automated system, you need to know what you're responsible for and what to ask the vendor. Here's the checklist.

Why Quebec's Privacy Rules Reach Your Call Handling, Not Just Your Website

Most business owners think of privacy law as a website problem: cookie banners, contact forms, that kind of thing. Quebec's rules don't work that way. Personal information typically includes names, addresses, phone numbers, email addresses, dates of birth, social insurance numbers, IP addresses, and other similar information. That's exactly what a booking call collects, whether a human or an AI answers it.

The reach is broader than most contractors expect. Unlike some privacy laws that apply only to certain sectors or organizational sizes, Quebec's private-sector regime is designed to protect the personal information of all Quebec residents, regardless of who is handling their data, which includes private-sector businesses, non-profit organizations, and individuals acting in a professional capacity. A five-person electrical outfit is just as covered as a national retailer.

Size doesn't buy you an exemption, and neither does being a service business instead of a tech company. The safest assumption is that privacy compliance benefits every business, regardless of size or structure. If you dispatch techs, quote jobs, and send confirmation texts, you're already handling the kind of data these rules regulate. The question isn't whether they apply to your call intake. It's whether your current process, or the AI system you're about to add, actually meets the bar.

What to Ask Before You Turn On an AI Receptionist

Before any AI system touches a customer call, get straight answers to three questions.

Where does the data live, and for how long? Cross-border data transfers carry real weight here. Organizations must conduct a Privacy Impact Assessment for cross-border transfers considering the sensitivity of the information, the purpose, the safeguards in place, and the legal framework in the destination jurisdiction. If a vendor can't tell you plainly where call recordings and transcripts are stored, and how long they are kept before they are deleted, that's a gap you need closed before go-live, not after. Data hosted in Canada is the shortest answer to the first half of that question.

Is there a real privacy policy you can point a caller to? This isn't optional paperwork. Quebec's private-sector privacy legislation requires anyone who collects personal information through technological means to publish a confidentiality policy. If a homeowner asks how their address and phone number are being used, your team, or your AI vendor, needs a clear answer ready.

Can you delete or export a caller's data on request, and quickly? Callers have that right, and locating and removing someone's information across every system that touched it is harder than it sounds. The right to demand deidentification or deletion is technically demanding, requiring systems that can locate all instances of an individual's personal information across databases, backups, and third-party systems. Ask the vendor to show you this process, not just describe it.

Consent, Recording, and Language Obligations

Consent is not a checkbox buried in fine print. Businesses must obtain clear, free, and informed consent from individuals, especially when collecting sensitive data, and consent must be granular and specific to each purpose of data use. A caller booking a furnace repair should understand, in plain terms, that their name and address are being collected to schedule and confirm the visit, nothing more. If the call is recorded or transcribed, the greeting is where the caller learns it, before they start giving you details.

Language matters just as much as consent. Quebec's language rules run alongside its privacy rules, and they apply to phone conversations, not just signage. Where consumers may communicate directly with a business, Quebec consumers must have the option to do so in French, and any consumer who communicates in French must be answered in French, with another language used only if the consumer initiated in that language. If your AI receptionist can't hold a full conversation in French by default and switch naturally when a caller starts in English, you have a language compliance problem layered on top of a privacy one.

The obligation doesn't end when the call does. Confirmation texts and emails sent after booking are still collecting and transmitting personal information, so they should follow the same minimization principle: send what's needed for the appointment, and nothing extra. A confirmation that repeats a customer's full address, unit number, and job notes in a text thread is collecting and exposing more than the booking requires.

How Gala Handles This So You Don't Have to Build It Yourself

Most contractors don't have a privacy officer on staff, and most don't want to become one just to answer the phone safely. Every covered business has to designate someone responsible for personal-information protection, and by default that responsibility falls on the CEO if no one else is appointed. For a busy owner, that's one more job nobody signed up for.

This is why the handling matters more than the label. Gala's Receptionist is built to collect only what's needed to book and confirm a job: name, number, address, and the work requested. It runs bilingually by default, so French-speaking callers are served in French without you having to script that behavior yourself, and English callers get answered in English.

Consistency is the other half of the problem. When a human answers calls between jobs, notes get scribbled on a truck dashboard or texted to a group chat, with no consistent record of what was collected or why. An AI receptionist that logs every call the same way, every time, gives you a documented, repeatable process instead of ad hoc notes scattered across phones. That's useful for compliance, and it's useful for running your business.

If you're in construction or electrical work and you're evaluating whether an AI phone system fits your privacy obligations, don't guess. Talk to Gavion about how Gala handles call data, or see how it fits into after-hours coverage for your specific trade. Compliance shouldn't be the reason you're still missing calls at 7pm.

Sources

This article draws on the following sources:

1. Quebec privacy rules for small business: frequently asked questions (CFIB)
2. What Quebec's private-sector privacy regime requires of a business (BigID)
3. Small Business Data Privacy Compliance: Key Laws & Practical Steps (Ludwig IP Law)
4. Quebec's privacy obligations and Canadian businesses in 2026, not just Quebec companies (Gamtech)
5. What is Quebec's private-sector privacy legislation? (Termly)
6. Doing business in Quebec: language legislation (Norton Rose Fulbright)