This article is general information for Canadian business operators. It is not legal advice. For your specific situation consult a Canadian-licensed privacy lawyer or contact the Office of the Privacy Commissioner of Canada (OPC) directly. All references current as of 2026-05-27.
The 60-second version
In Canada, recording a phone call is legal when at least one party to the call consents to the recording, per section 184 of the Criminal Code [3]. For businesses, the relevant statute is not just the Criminal Code — it is the federal Personal Information Protection and Electronic Documents Act (PIPEDA), administered by the Office of the Privacy Commissioner of Canada (OPC), which governs how Canadian businesses collect, use, disclose and retain personal information including voice recordings [2].
The OPC's official guidance on call recording sets out a clear, practical test for compliance [1]:
- Tell the caller at the start of the call that the call may be recorded.
- Tell them why (purpose).
- Offer a meaningful alternative if they do not consent.
- Limit collection, use, and retention to that stated purpose.
- Safeguard the recording and respect access requests.
Get those five steps right and your business is PIPEDA-compliant for call recording. Get any one of them wrong and you are exposed to an OPC complaint — and for Ontario healthcare practices, additional PHIPA liability [5].
The legal foundation: Criminal Code s.184 plus PIPEDA
Two pieces of Canadian law govern call recording:
Criminal Code s.184 (one-party consent)
Section 184 of the Criminal Code makes it an offence to intercept a private communication. The key exception: it is NOT an offence if one party to the communication consents [3]. That makes Canada a "one-party consent" jurisdiction. A business that records its own inbound or outbound calls satisfies the one-party requirement because the business itself is a party to the call.
But criminal-law compliance is not enough on its own. The recording itself is "personal information" under PIPEDA, which adds further obligations.
PIPEDA (privacy obligations on businesses)
PIPEDA applies to every Canadian business that collects, uses or discloses personal information in the course of commercial activity. A voice recording is personal information. PIPEDA imposes ten fair-information principles [2]:
- Accountability
- Identifying purposes
- Consent
- Limiting collection
- Limiting use, disclosure and retention
- Accuracy
- Safeguards
- Openness
- Individual access
- Challenging compliance
For call recording, the consent and limiting-use/retention principles do most of the work.
OPC's five-point test for call recording
The OPC's Guidelines for Recording of Customer Telephone Calls [1] set out the rules in plain language. Here is how to apply each one.
1. Notify at the start of the call
The caller must know the call may be recorded BEFORE the substantive conversation starts. The standard mechanic is an opening notice like: "This call may be recorded for quality and service purposes." If the recording starts mid-call, that fact must also be communicated. A silent, unnoticed recording does not satisfy PIPEDA even if it satisfies the Criminal Code one-party consent test.
2. State the purpose
"Quality and service" is the most common phrasing because it covers training, dispute resolution, and complaint handling. If you intend to use the recording for additional purposes — for example, marketing, sales coaching, or feeding it to a third-party transcription or AI service — you may need to state those purposes too, or obtain a separate, more explicit consent [4].
3. Provide a meaningful alternative
The OPC's guidance is clear that consent must be meaningful, which generally means the caller must have a realistic choice. In practice, this usually takes one of these forms:
- An IVR option to opt out of recording and route to an alternative line.
- A documented offer to handle the request via a non-recorded channel (email, in-person, separate non-recorded line).
- An automatic policy of NOT recording sensitive call types (e.g., debt collection, health questions to a clinic switchboard) by default.
For most SMBs, an offered email or in-person alternative is enough.
4. Limit use and retention
Only collect the minimum necessary, use it only for the stated purpose, and delete it when the purpose is exhausted. The OPC has not prescribed a fixed retention period; the rule is "as long as necessary for the purpose, no longer." Common SMB practice:
- 30–90 days for general inbound quality-assurance recordings.
- 12–24 months for recordings tied to a specific dispute, complaint, or transaction (legal-hold).
- Indefinite retention only with explicit consent for an ongoing purpose (e.g., medical-incident review at a clinic under PHIPA, with separate clinical-retention rules).
5. Safeguard the data
Encryption at rest, encryption in transit, role-based access controls, audit logging of every playback or download, and Canada-based hosting. Storing Canadian call recordings on U.S.-located servers introduces an extraterritorial-disclosure risk — U.S. authorities can compel disclosure under U.S. statutes like the CLOUD Act, which can put a Canadian business in violation of its own PIPEDA undertakings to callers if those callers were not told their data might leave Canada.
What about Quebec and Ontario specifically?
Quebec: Law 25 (formerly Bill 64)
Quebec's Act respecting the protection of personal information in the private sector (substantially amended by Law 25, fully in force since September 2023) goes further than PIPEDA in several ways: mandatory privacy officer designation, mandatory breach reporting to the Commission d'accès à l'information, mandatory privacy impact assessments for sensitive projects, and tighter consent requirements. A Canadian business with Quebec callers should treat Quebec's regime as the floor, not the federal one.
Ontario: PHIPA for healthcare
If you operate an Ontario dental practice, medical clinic, optometry office, physiotherapy clinic, or similar regulated health professional, you are a "health information custodian" under the Personal Health Information Protection Act (PHIPA) [5]. PHIPA layers on top of PIPEDA for personal health information — including call recordings that contain symptoms, diagnoses, prescriptions, or even appointment reasons. PHIPA requires:
- Written policies on PHI collection, use and disclosure.
- A designated contact for privacy inquiries.
- Stricter breach reporting (to the Information and Privacy Commissioner of Ontario AND to affected individuals).
- Specific safeguards including audit trails on every PHI access event.
An AI receptionist used by an Ontario clinic must be PHIPA-compliant, not just PIPEDA-compliant. MapleReceptionist is built to both standards.
Data residency: the underrated trap
PIPEDA does not technically require Canadian data to stay in Canada. But it does require organizations to be transparent about cross-border data flows and to ensure comparable safeguards apply abroad. In practice, the cleanest compliance posture is to keep call recordings on Canadian-located servers operated by a Canadian-incorporated company, governed by Canadian law — because that removes every "what if a U.S. court compels disclosure" question.
If your AI receptionist vendor stores recordings on U.S. servers, you have three obligations:
- Disclose to callers, in your privacy policy, that recordings may be stored outside Canada.
- Sign a data-processing agreement with the vendor that includes contractual safeguards comparable to PIPEDA.
- Be prepared to respond to caller inquiries about cross-border disclosure risk.
MapleReceptionist eliminates all three by storing every recording in Canada by default.
Sensitive call categories that need extra care
Some inbound call categories are higher-risk and warrant special handling:
- Health-related calls (clinic intake, symptom triage, dental appointment reasons) — PHIPA territory in Ontario; similar provincial health-information statutes apply elsewhere. Default to do-not-record or short retention with explicit purpose.
- Legal calls (law-firm intake) — solicitor-client privilege concerns. Many firms record only the intake portion (name, contact, conflict check) and pause recording at substantive legal discussion.
- Financial-information calls (taking credit-card numbers over the phone) — PCI DSS scope; either do not record the card-number portion, or use a tokenizing service. The OPC's call-recording guidance explicitly cautions against capturing more financial information than necessary [1].
- Calls involving minors — specific consent considerations under provincial child-protection and privacy frameworks.
What a compliant AI receptionist should do
If you are evaluating an AI receptionist that records or transcribes calls, the buyer-side checklist looks like this:
- The opening greeting announces that the call may be recorded.
- The system offers a meaningful alternative path on request (e.g., "Press 9 to speak with a person, no recording").
- Recordings are encrypted at rest (AES-256 or equivalent).
- Recordings are encrypted in transit (TLS 1.2+).
- Recordings are stored on Canadian-located servers.
- The vendor is a Canadian-incorporated entity.
- Retention is configurable per account (e.g., default 30 days, optionally up to 12 months).
- Audit logs record every playback and download.
- The vendor provides a Data Processing Agreement on request.
- The vendor supports access requests — if a caller asks for a copy of their recording, the business can produce it within the 30-day PIPEDA window.
MapleReceptionist ships all ten of these defaults out of the box on the Business ($99 CAD/month) and Team-Pro ($199 CAD/month) tiers, which include call recording and transcription. Solo and Starter tiers do not record by default — call summaries are generated from live transcription and the audio is discarded immediately after summarization, which is the most-conservative posture for the smallest businesses.
What happens if you get it wrong
The OPC handles PIPEDA complaints. Outcomes range from a written finding to recommendations to mandatory corrective action. Repeat or egregious cases can be referred to the Federal Court, which has the power to award damages. Quebec's CAI under Law 25 has actual monetary penalties — up to $10 million or 2% of worldwide turnover for serious offences. Ontario's IPC can issue PHIPA orders and recommend prosecution.
For most Canadian SMBs the practical risk is not a million-dollar fine; it is reputational damage from a public OPC finding, plus the cost of fixing the underlying compliance gap retroactively (deleting recordings, notifying callers, updating policies). Doing it right the first time is far cheaper.
"Tell the caller. State the purpose. Offer an alternative. Limit what you keep. Safeguard it." That is the entire OPC compliance checklist in twelve words.
Recommended retention policy template (SMB starting point)
- Default retention: 30 days for all inbound call recordings.
- Dispute hold: 12 months for any call associated with a customer complaint, refund, or escalation.
- Health information (PHIPA): retain per provincial clinical-records rules (typically 10 years for adults), separately from non-clinical call recordings.
- Access requests: respond within 30 days. Provide the caller their own recording free of charge on the first request.
- Deletion: hard-delete on schedule. Soft-delete only is not enough; PIPEDA expects actual destruction at the end of retention.
Bottom line
Call recording in Canada is legal, useful, and low-risk when you follow the OPC's five-point test: notify, state purpose, offer alternative, limit retention, safeguard the data. Use a Canadian-resident vendor that stores recordings in Canada and supports PHIPA where applicable. Set a default retention of 30 days. Respond to access requests within 30 days. Done.
If you want a recording-capable AI receptionist that ships PIPEDA + PHIPA defaults out of the box — with Canadian data residency, Canadian incorporation, and bilingual EN/FR call handling — the side-by-side comparison in the 2026 Canadian AI receptionist buyer guide shows where MapleReceptionist lines up against the rest of the market.