Quebec's Law 25: What Small Businesses Need to Know About Calls and Texts

Law 25 in a Nutshell

"Law 25" (often called Bill 25 or Bill 64) is Quebec's Act to modernize legislative provisions as regards the protection of personal information, passed by the National Assembly in September 2021. It mainly amended the Act respecting the protection of personal information in the private sector, which applies to businesses in Quebec regardless of their size.

Its obligations came into force in three stages: September 2022, September 2023, and September 2024 with the right to data portability. Today, all the rules apply. A two-person business is therefore covered just like a large chain, although it's naturally expected to take measures proportionate to its reality.

The basic principle is simple: personal information is any information about a natural person that allows them to be identified. A name, a phone number, an address, a photo of a customer's house or the content of a voicemail all qualify. As soon as your business collects, uses, keeps or shares this kind of information, the law applies.

Why Your Calls and Texts Are Affected

People often associate Law 25 with websites, cookies and online forms. Yet for most service businesses, the largest amount of personal information flows through the phone. Every call leaves a number in your history. Every voicemail contains a name, often an address and a description of a need.

Text messages are even richer. A customer might send you a photo of their electrical panel, the address of their cottage, their availability or details about their family situation to explain why it's urgent. That's valuable for serving them well, and that's exactly why this information deserves to be handled properly.

The good news is that most obligations come down to common sense. Only collect what's useful, know where the information is, limit who can access it, and don't keep it forever.

Basic Obligations for a Small Business

Law 25 contains several obligations, but some apply directly to every small business. Here are the main ones, in simple terms. For details specific to your situation, the Commission d'accès à l'information du Québec (CAI) publishes free guides, and a legal advisor can help you.

Remember that the goal isn't to produce a stack of documents nobody reads. It's to have a few clear habits that the whole team knows, and to be able to explain them if a customer or the CAI asks.

• Designate a person in charge of the protection of personal information. By default, it's the person with the highest authority in the business (often the owner), but this role can be delegated in writing. Their title and contact information must be published on your website, if you have one.
• Adopt simple internal rules on how you handle personal information (who has access, how long you keep it, how you destroy it, how you handle a complaint).
• Publish a privacy policy in clear and simple terms if you collect information through technological means, such as a website or an online form.
• Only collect the information necessary for the purposes you've determined, and inform the person of those purposes.
• Keep a register of confidentiality incidents and notify the CAI and the people concerned when an incident presents a risk of serious injury.
• Destroy or anonymize information once the purposes for which it was collected have been achieved, subject to retention periods set by other laws.

Consent: What Changes for Your Communications

Law 25 requires consent to be manifest, free, enlightened and given for specific purposes. In practice, this means the person must understand why you're using their information. When a customer calls you for a quote, they obviously expect you to use their number to reply about it. That's consistent with the reason for their call.

Where you need to be careful is when you use that information for something else. Adding every number in your call history to a promotional mailing list, for example, isn't the same as answering a request. For prospecting and commercial electronic messages, another federal law also comes into play: Canada's Anti-Spam Legislation (CASL). We'll cover it in a separate article.

A good habit is to clearly separate two types of messages: those that respond to a customer's request (quote, appointment, follow-up on a job) and those that promote your services. The first are part of a relationship the customer started. For the second, make sure you have clear consent and always offer a simple way to unsubscribe.

Voicemail, Call History and Texts: Where Is Your Data?

One of the first steps in complying with the law is knowing where your customers' information is. For many small businesses, the answer is a little awkward: all over the place. On the owner's cell phone, on an employee's phone, in the landline's voicemail, in a notebook at the front desk and in an Excel file on the office computer.

That's not a criticism: it's the reality of most small businesses, which grew one customer at a time. But when conversations are scattered across several personal phones, it becomes hard to know who has access to what, to respond to a customer's access request or to clean up once a job is done.

Take an hour to do an inventory. Note every place where customer calls, voicemails and texts arrive, who can see them, and how long they stay there. This simple exercise will often show you where to tidy up first.

• Personal cell phones used for work (texts, photos, call history).
• Voicemail on the business line and on cell phones.
• Messaging apps used with customers.
• Paper notes, notebooks and whiteboards at the front desk.
• Shared files, emails and management software.

Practical Best Practices for Business Texting

Texting is an excellent channel for small businesses: fast, convenient and appreciated by customers. With a few simple habits, it also becomes a channel that respects their privacy. These practices require no budget, just a bit of team discipline.

The general idea: keep texting for logistics and everyday exchanges, and save more sensitive information for a better-suited channel. When in doubt, ask yourself whether you'd be comfortable with someone other than the customer reading the message.

• Never ask by text for a social insurance number, credit card number, health insurance number or detailed health information.
• Stick to what's useful for meeting the need: name, job address, availability, general description.
• Use a business number rather than scattered personal cell phones, to keep conversations in one place.
• Remove a departing employee's access on their last day.
• Lock phones with a passcode and turn on automatic updates.
• Immediately respect any request to stop: if someone texts STOP, you stop texting them.
• Regularly clean out photos and conversations you no longer need.

How Alloia Fits In

Missed calls come with the job. When you're on a job site, in a meeting or with a customer, it's normal not to be able to pick up. Alloia simply helps you avoid losing that customer: when a call goes unanswered, the person automatically receives a text sent from your current number, using conditional call forwarding. The conversation then continues by text, whenever you're available.

From a Law 25 perspective, the main advantage is organizational. Instead of conversations scattered across several personal cell phones, customer exchanges are grouped in a single inbox tied to the business number. It becomes easier to know where the information is and who has access to it. The text that's sent responds directly to the call the customer just made, which stays consistent with the reason they reached out.

Alloia doesn't replace your judgment or your team: you're the one replying to customers, deciding what to ask them and how to serve them. And as with any tool that handles customer information, take the time to read its privacy policy and check that the way you use it matches your internal rules.

What to Do If a Confidentiality Incident Happens

A confidentiality incident includes unauthorized access, use or disclosure of personal information, or its loss. In a small business, it can be as ordinary as a work phone left behind in a restaurant, with no passcode, holding hundreds of customer conversations.

The law requires you to promptly take reasonable measures to reduce the risks. If the incident presents a risk of serious injury to the people concerned, you must notify the CAI and those people. In every case, the incident must be recorded in your register. To assess the risk, you consider in particular the sensitivity of the information and the possible consequences of its use.

• Act fast: change passwords, wipe the phone remotely if possible, remove access.
• Write down what happened, the date, the information involved and the measures taken.
• Assess the risk of serious injury, ideally with an advisor's help if you're unsure.
• Notify the CAI and the people concerned if the risk is serious.
• Fix the root cause so it doesn't happen again (mandatory passcode, backups, training).

FAQ: Law 25, Calls and Texts

Can I text back a customer who called me? Yes. Replying to someone who just contacted you, about their request, is consistent with the reason for their call. Simply stay on the topic of their request and respect their choice if they prefer another way of communicating.

Does Law 25 apply to self-employed workers? Yes, the law covers anyone carrying on an enterprise in Quebec who collects personal information in that context. The measures expected remain proportionate to the size and nature of your activities.

What are the possible penalties? The law provides for administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and higher penal fines in the most serious cases. These amounts are maximums: the CAI takes the business's situation into account. For a small business, the goal is mainly to show good faith and reasonable measures.

Should I delete my old customer texts? The law requires you to destroy or anonymize information once the purposes for which it was collected have been achieved, subject to retention periods set by other laws (for example, for your accounting records or warranties). Set yourself a simple rule and apply it regularly.

Where can I get help? The Commission d'accès à l'information du Québec website offers guides and tools for businesses. For a specific situation, consult a lawyer or a privacy advisor. This article is for information only and is not legal advice.