Quebec's Law 25, in effect since September 2023, governs the collection and processing of personal information. For a business deploying conversational AI (receptionist, chatbot, voice agent), six obligations deserve particular attention.
1. Designate a responsible person
Any business collecting personal information must designate a person responsible for the protection of personal information. Their name and contact details must be published on the website. At Boréal, that's our director of operations, reachable at privacy@borealtech.solutions.
2. Accessible privacy policy
A clear policy, in French, stating: what is collected, why, retention period, with whom it is shared. For conversational AI, this includes call transcriptions, audio recordings where applicable, metadata (time, duration, inbound number).
3. Informed consent
Consent must be free, informed and given for specific purposes. Concretely: an introduction message ("This call may be analyzed to improve our service") at the start of the call, or a linked policy in the confirmation SMS.
4. Privacy impact assessment (PIA)
For any new project involving personal information, a PIA must be conducted. For Luna, we walk our customers through this assessment: documentation is delivered with the setup.
5. Hosting and transfers
Information may be hosted outside Quebec, but equivalent protection measures must be demonstrated. Luna: primary hosting in Canada, AES-256 encrypted transcriptions, no transfer to the United States or to jurisdictions without a protection agreement.
6. Rights of the data subject
Every customer can request: access to their data, rectification, withdrawal of consent, portability (since September 2024). Maximum response time is 30 days. Luna offers an admin interface where these requests are handled in a few clicks.
Sanctions
Provided fines are substantial: up to $25M or 4% of worldwide revenue, whichever is higher. For SMBs it remains rare, but the Quebec Commission d'accès à l'information has already issued public decisions in 2024-2025.
In practice: Law 25 obligations are reasonable and well-documented. Choosing a partner (like Boréal) that has already internalized them dramatically simplifies compliance.