⚜️

Law 25 — for Quebec businesses

How Sonocall helps you comply with Quebec's modernized private-sector privacy law (Loi 25).

1. You are the controller, we are the processor

Under Law 25, your business is the controller of the personal information collected through your Sonocall numbers. Sonotech acts as your processor under a signed DPA.

In practice: you decide what to collect and why. We secure, store and process the data on your instructions.

⚠ Why your choice of provider is your liability

Under Law 25, the business that collects the data (you) is the controller — not the SaaS vendor. If you use a non-compliant tool, the Commission d'accès à l'information (CAI) holds you responsible, even when the failure is technical and on the vendor's side.

You are required to:

  • sign a data processing agreement (DPA) with every provider (s. 18.3)
  • complete a privacy impact assessment (PIA) before any transfer outside Québec (s. 17)
  • designate a person in charge of the protection of personal information and publish their contact details (s. 3.1)
  • offer an accessible way for individuals to exercise their rights (ss. 27-28)
  • notify the CAI of any confidentiality incident presenting a risk of serious injury (s. 3.5)

Concrete risk: administrative penalties up to CAD $10M or 2% of worldwide turnover, and penal fines up to $25M or 4% — levied on the business, not the vendor.

Most US voice-AI platforms do not provide: a Quebec-specific DPA, data residency in Canada, a French-language rights request form, a published privacy officer, or a retention engine. A Quebec business using them carries that risk alone.

Sonocall exists precisely to close that gap: we give you every contractual and technical element so that you are compliant, not just us.

2. Section 8 — Information at the time of collection

At the start of every call, your AI agent automatically plays:

“This call may be recorded and analyzed for quality, training and service improvement purposes.”

This broad wording covers everything done with the data: recording + transcription + analysis. Configurable per agent, with refusal detection: if the caller declines, recording stops and the call follows the branch you chose (transfer, end call or callback).

3. Section 17 — Assessment before transfers outside Québec

We wrote a PIA for each of our sub-processors (Google, Twilio, SendGrid, Stripe) and we publish them. All stored data stays in Canada (Montréal). Real-time AI processing goes through Google's paid AI infrastructure under a contractual no-training, no-retention commitment.

4. Sections 27-28 — Rights of data subjects

Your callers can request access, correction or deletion of their data at any time. Our public form routes requests to the right business with a 30-day response window.

5. Section 3.5 — Confidentiality incident notification

In the event of a security incident, Sonotech notifies the CAI and informs you immediately. Our public procedure details the steps.

6. Section 3.1 — Person in charge of protection

Law 25 requires every business to designate a person in charge of the protection of personal information. Sonocall lets you set that contact in your settings — it appears in your consent announcements and call confirmations.

7. Bill 96 — French by default

For Quebec businesses, the Sonocall interface is automatically in French. Consent announcements and confirmation emails are also in French by default.

8. What we built for you

  • Law 25 consent flow, compliant by default
  • Automatic refusal detection → recording stops immediately
  • Consent audit log (evidence for the CAI)
  • Automatic retention engine with configurable policy
  • Public data-rights form (30-day response)
  • Signed DPA and published PIAs
  • Data stored 100% in Canada (Montréal)
  • Ready-to-use incident notification procedure

Ready to get compliant?

Every plan includes the Law 25 features by default. No surcharge.

Get started →