The 60-second answer
Voicemail and call detail records are personal information. PIPEDA Principle 4.1.3 makes you responsible for that information even after it is transferred to a provider for processing, and requires contractual means to secure comparable protection. Moving to a hosted PBX moves the execution, never the accountability.
The sentence that governs this entire topic
Schedule 1 of PIPEDA contains one clause that settles most arguments about hosted phone systems before they start:
“An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.” — PIPEDA, Schedule 1, clause 4.1.3 [1]
Read it twice. Transferring processing to a provider does not transfer responsibility. It creates an obligation to secure comparable protection by contract. That is a positive duty on you, the customer, and it is discharged by asking questions and writing down the answers — not by assuming a provider has it covered.
What your phone system actually holds
It is easy to underestimate this. A business phone system in normal operation accumulates:
| Record | Personal information? | Typical sensitivity |
|---|---|---|
| Voicemail audio | Almost always | High — callers state names, numbers, reasons |
| Voicemail transcripts and email copies | Yes, and now in your mail system too | High |
| Call detail records | Yes, where they identify individuals | Moderate |
| Missed-call logs and callback lists | Yes | Moderate |
| Auto-attendant menu selections | Sometimes — a menu can reveal purpose | Depends on the menu |
| Extension directory | Yes — employee information | Low to moderate |
The second row deserves attention. Voicemail-to-email is one of the most useful features in a small-business phone system and it quietly duplicates sensitive audio into a second system with its own retention rules, its own backups, and its own access list. If your voicemail retention is 30 days but your mailbox keeps everything forever, your real retention period is forever.
Residency: what the law says, and what it does not
PIPEDA does not contain a general requirement that personal information be stored in Canada. What it contains is an accountability requirement [1], a retention requirement [2], a safeguards requirement, and an openness requirement — the ten fair information principles set out in the statute [3].
There are two facts that make cross-border storage more consequential than people expect. First, the Office of the Privacy Commissioner is explicit that information crossing provincial or national borders in the course of commercial activity remains subject to PIPEDA regardless of which province the organization is based in [4]. Second, Alberta, British Columbia and Quebec have their own substantially similar private-sector laws, and Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have adopted substantially similar legislation covering personal health information [4]. A medical or dental practice with voicemail from patients is in a materially different position from a landscaping company.
So the honest statement is not “the law requires Canadian hosting”. It is: Canadian hosting makes the accountability question short. If the answer to “where is it?” is one jurisdiction with one legal regime, the contractual work required by clause 4.1.3 is smaller and the disclosure you owe individuals is simpler.
Retention: you must choose a number
Principle 5 requires that personal information be retained only as long as necessary for the purpose it was collected, and clause 4.5.2 asks organizations to develop retention guidelines “includ[ing] minimum and maximum retention periods” [2].
Note what this does not say. It does not give you a period. It requires that you have one, that it be deliberate, and that it be documented. A phone system where voicemail accumulates indefinitely because nobody chose otherwise is not compliant by default; it has simply never been examined.
Practical starting points, to be adjusted for your sector:
- Voicemail audio: 30 to 90 days, automatically purged.
- Voicemail delivered to email: match the audio period, or shorter. Set a mail retention rule, do not rely on people deleting messages.
- Call detail records: longer is defensible where they support billing or dispute resolution, but the period should still be stated.
- Anything used to make a decision about an individual: retain long enough for that individual to access it, which is an explicit expectation in the same principle [2].
Safeguards, in the terms federal guidance uses
PIPEDA's safeguards principle asks for physical, organizational and technological protection appropriate to sensitivity. For a phone system, the practical translation is close to the federal baseline controls published for small and medium organizations [6]: control who can access voicemail boxes and the administrative interface, keep firmware and platform software patched, use individual accounts rather than a shared administrative login, and confirm that backups exist and can be restored.
Two items are specific to telephony and are missed constantly: voicemail PINs left at the default across an entire organization, and departed employees whose voicemail boxes and administrative access were never removed. Both are access-control failures on a system holding personal information.
Your provider is not your only record-holder
One structural point that a bring-your-own-trunk arrangement makes clearer than a bundled one. Your carrier — the party that owns or operates the transmission facility under the Telecommunications Act [7] — holds its own call records for the calls it carries, entirely separately from anything your PBX provider stores. Those records exist whether or not you have a hosted PBX, and they are governed by the carrier's own obligations.
This matters in two directions. It means a hosted PBX is not creating your only exposure, so a diligence exercise limited to the PBX provider is incomplete. It also means the records you may need — for a dispute, an access request, or a breach investigation — may live in two places, and knowing which party holds what before you need it is considerably easier than working it out under time pressure.
Six things to get in writing before cutover
- Location. Where is voicemail audio stored? Where are call detail records stored? Name the country, and ideally the region.
- Retention. What is the default period for each, and can you set it yourself?
- Access. Who at the provider can listen to a voicemail or read a call log, under what circumstances, and is it logged?
- Exit. What happens to your data when the contract ends? Is it deleted, and on what timeline? Can you export first?
- Breach. How and within what period will you be notified? You cannot meet your own breach obligations [5] on a timeline you do not control.
- Individual access. If someone exercises a right of access to information your phone system holds about them, how do you obtain it?
A provider that answers all six in an email has just given you most of the “contractual or other means” that clause 4.1.3 asks for. A provider that treats the questions as unusual has answered a different and more important question.
How MapleReceptionist handles it
Voicemail is Canadian-hosted, with voicemail-to-email delivery included in every band, and retention set to your period rather than a default nobody chose. Roughly 30 to 60 minutes of administrative changes per month are included in the band price, which covers the access-control housekeeping above — removing departed staff, resetting PINs, adjusting retention — that otherwise goes undone because it is nobody's specific job. Pricing is $99 CAD per month up to 10 extensions, $219 up to 25, $399 up to 50, and $699 up to 100, plus HST. Call recording is a separate topic with its own consent requirements, covered in our guide to PIPEDA-compliant call recording.
Bottom line
Your phone system is a personal-information system, and hosting it elsewhere does not change who is accountable for it — PIPEDA says that in one sentence [1]. Choose a retention period rather than inheriting one [2], find out where the data physically sits, and get the six answers above in writing. The work is an hour of questions, and it is the difference between a considered arrangement and an assumption.