AI receptionists and Canadian privacy law: what to ask before you sign

Before you sign with an AI receptionist, get written answers to five questions: where your callers’ information is stored and processed, which other companies touch it, how long it’s kept, whether anyone trains AI models on it, and what callers hear at the start of the call. In Canada you stay responsible for personal information even when a vendor handles it for you, so the vendor’s answers become your answers.

Which privacy laws apply to an AI receptionist in Canada?

For most private businesses it’s PIPEDA, the federal private-sector privacy law, or a provincial law that takes its place, plus health-privacy law if you run a clinic. According to the Office of the Privacy Commissioner of Canada (OPC):

• PIPEDA covers private-sector organizations that collect, use or disclose personal information in commercial activities across Canada, under 10 fair information principles.
• Alberta, British Columbia and Quebec have their own private-sector laws, deemed substantially similar. Businesses covered by them are generally exempt from PIPEDA for activity inside the province, but information that crosses provincial or national borders falls under PIPEDA anyway.
• Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have substantially similar laws for personal health information.

Personal information is broad: “any factual or subjective information, recorded or not, about an identifiable individual.” A caller’s name, number, reason for calling and the recording of their voice all count.

Who is responsible for callers’ data when a vendor answers your phone?

You are. PIPEDA’s accountability principle says an organization “is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing,” and “shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.” The OPC’s guidelines for processing personal data across borders add that the contract is the main tool, and that you should have the right to audit how the vendor handles the information.

What to ask:

• Will you sign a data processing agreement that limits use to our purposes?
• What evidence of your safeguards can you show us, and can we audit it?
• How quickly will you tell us about an incident that affects our callers?

Where is call data stored and processed, and who are the subprocessors?

Ask for a list of every company in the call path, what each one does, and where it stores and processes data. “Hosted in Canada” can describe where recordings are kept while a live step runs somewhere else. A typical AI receptionist call passes through a phone carrier, speech-to-text, a language model that decides what to say, text-to-speech for the voice, storage for recordings and transcripts, and tools for texting, email, logging and analytics.

PIPEDA doesn’t ban processing outside Canada. But the OPC says businesses must “make it plain” to people, “in clear and understandable language,” that their information may be processed in another country and may be accessible to the courts, law enforcement and national security authorities there.

What does Quebec’s Law 25 require?

If you serve callers in Quebec, plan for three things: a published privacy officer, a privacy impact assessment before you adopt the system, and another one before personal information leaves Quebec. The Commission d’accès à l’information (CAI) explains each one (its pages are in French):

• A privacy officer. By default it’s the person with the highest authority in the business, and the role can be delegated in writing. Their title and contact details must be published on your website. (CAI: responsabilité des entreprises)
• An assessment when you acquire a system. The CAI requires a privacy impact assessment (an EFVP) for any project to acquire, develop or overhaul an information system involving personal information, and lists artificial intelligence systems as an example. Your privacy officer must be consulted from the start.
• An assessment before data leaves Quebec. Before you communicate personal information outside Quebec, to another province or another country, or entrust someone outside Quebec to collect, use or keep it for you, you need an EFVP and a written agreement, and the CAI’s guidance also lists informing the people concerned and obtaining their consent. The transfer can go ahead if the assessment shows the information will be adequately protected. (CAI: utilisation et communication)
• A written service contract. It must set out how the provider keeps the information confidential, uses it only for the mandate and doesn’t keep it after the contract ends. The provider must tell your privacy officer about any breach without delay.
• Automated decisions. If a decision about a person is based exclusively on automated processing, you must tell them no later than when you share the decision, and let them present their observations to a staff member who can review it. Ask whether the receptionist ever decides anything on its own, such as turning down a booking.

What extra rules apply to dental offices and health clinics?

In Ontario, a company that supplies electronic services to a health information custodian, such as a dental office or physiotherapy clinic, is limited by law in what it can do with personal health information. Under section 6 of O. Reg. 329/04, made under PHIPA, a supplier that isn’t the custodian’s agent:

• “shall not use any personal health information to which it has access in the course of providing the services for the health information custodian except as necessary in the course of providing the services”;
• “shall not disclose any personal health information to which it has access in the course of providing the services”; and
• can’t let its employees or anyone acting for it access the information unless they agree to the same restrictions.

Ask whether the vendor acts as your agent or as an electronic service provider, and get an agreement that reflects these limits, covers its subcontractors and deletion, and rules out secondary uses such as model training. Other provinces have their own health-privacy laws; check yours. Infold handles intake only for health practices and never gives clinical advice. See how that works for dental offices and clinics.

What should law firms check before an AI takes intake calls?

Keep intake short and conflict-first. The Law Society of Ontario’s commentary on confidentiality says “a lawyer should be cautious in accepting confidential information on an informal or preliminary basis, since possession of the information may prevent the lawyer from subsequently acting for another party in the same or a related matter.”

The LSO’s April 2024 white paper on generative AI (PDF) names two intake risks: a chatbot could create a lawyer-client relationship without the lawyer knowing, and a tool could answer in a way the client reads as legal advice. It also notes that some AI providers train on user inputs, and tells licensees to check privacy settings and opt out of training.

So set the receptionist up to capture the names of all parties for your conflict check, the type of matter, any urgent deadline and contact details, then book the consultation. No advice, no full story. Infold handles intake only for law firms and never gives legal advice. If you practise outside Ontario, check your own law society’s guidance.

Do callers have to be told the call is being recorded?

Yes. The OPC’s guidance on recording customer telephone calls, updated October 8, 2026, says an organization “must inform the customer that they are recording a call, clearly state the purpose of the recording and obtain consent.” The key points:

• State the purpose as clearly and narrowly as possible. Don’t say the call is recorded “for quality assurance” if the recording will also be used for marketing, profiling or authentication.
• If the caller carries on knowing the call is recorded and why, consent is usually implied. Voiceprints or other sensitive information may need express consent.
• “Customers must be given a choice about whether their voice is recorded.” If recording isn’t integral to the service, offer alternatives, such as continuing the call without recording.
• Callers can ask for access to their recording later, and retention should be limited.
• If you contract out call handling, the provider must follow the same rules.

A greeting that covers this can be short. For example: “Hi, you’ve reached [business]. I’m [business]’s AI assistant. This call is recorded and transcribed so our team can follow up. If you’d rather not be recorded, just say so.” Ask every vendor to play you the exact greeting your callers will hear.

Do callers need to be told they’re talking to an AI?

Canada’s privacy commissioners say yes for public-facing generative AI. Their joint principles for generative AI say organizations should “ensure that individuals interacting with the tool are aware that they are interacting with a generative AI tool,” and tell them about privacy risks and any ways to reduce them. Infold’s receptionist tells callers it’s an AI assistant at the start of every call.

Can an AI receptionist text callers after the call?

Yes, within Canada’s anti-spam law (CASL). The CRTC’s CASL FAQ sums up the three requirements for a commercial electronic message, texts included: consent, identification and an unsubscribe mechanism.

• Confirmations and requested quotes. Under section 6, consent isn’t needed for a message that solely provides a quote the person asked for, or “facilitates, completes or confirms” a transaction they already agreed to. The message must still identify the sender and include a way to unsubscribe.
• Promotional texts. Under section 10, an inquiry gives implied consent for six months, and a purchase for two years. After that, you need express consent.

Ask whether every text names your business and offers STOP, and whether consent is recorded.

How long should recordings and transcripts be kept?

Only as long as you need them for the purpose you told callers about. The OPC says the right period depends on why the recording was made, whether it was used to make a decision about someone, and any legal duty to keep it. The privacy commissioners’ generative AI principles add that prompts shouldn’t be kept, reused or disclosed unless that’s required, and in Quebec your governance policies must set rules for keeping and destroying personal information.

Ask for the default retention for audio, transcripts and summaries, whether you can change each one, and what happens to data and backups when the contract ends.

Will your callers’ data be used to train AI models?

Ask directly, about the vendor and every speech and AI provider behind it. The privacy commissioners’ principles say providers should tell the organizations using them about any secondary purpose, “such as where personal information collected from prompts is used for further training or refining of an AI model,” and should use anonymized or de-identified data where possible. Get the answer in your contract, and for health and legal practices, expect a plain no.

The checklist: what to ask any AI receptionist vendor

Data and vendors

• Where are recordings, transcripts, summaries, logs and backups stored?
• Where is each live step processed: phone connection, speech recognition, AI model and voice?
• Who are your subprocessors, and will you tell us before you add one?
• Will you sign a data processing agreement, and how quickly do you report incidents?

Callers

• What exactly does the greeting say about AI and recording?
• How does a caller carry on without being recorded, or reach a person?
• Do you create voiceprints or any other biometric identifiers?

Retention and training

• What are the default retention periods, and can we change them?
• Does anyone in the chain train models on our callers’ data, and does the contract rule it out?

Texts

• Do follow-up texts name our business and include a way to opt out?
• Do you record consent and stop promotional texts when it lapses?

Your province and sector

• Quebec: will you support our privacy impact assessment and sign the written agreement?
• Health: will you sign terms that reflect PHIPA’s service-provider limits, or your province’s equivalent?
• Law: is intake conflict-first, with no legal advice?

Where does Infold fit?

Here’s where Infold stands today:

• Hosted in Canada by default. Call data is stored in Canada as standard.
• Canada-only processing, end to end, is available when you need it, and so is deployment in your own cloud or on your own servers. See custom and enterprise.
• It tells callers it’s an AI assistant at the start of every call.
• Intake only for health and law. It never gives clinical or legal advice.

Bring this checklist to your demo and ask us every question on it. Read about trust and Canadian hosting, check pricing or book a demo. For the phone side of setup, see how to forward your business calls in Canada.