Suggested URL slug: call-recording-laws-canada-policy-template
Meta description: Simple, province-aware guide to recording calls in Canada plus a ready-to-use policy template and checklist for compliance and operations.
Last reviewed: September 30, 2025
Two quick facts up front: in Canada the Criminal Code allows recording when at least one party to the conversation consents, but privacy law and provincial rules add notice, purpose, retention, and access obligations that businesses must follow. This post gives a practical checklist, a compact policy template you can copy, and the province-specific flags to watch when you enable call recording.
TL;DR: You can record telephone calls in Canada if one party consents, but that alone does not meet your obligations as a business. Follow PIPEDA (or applicable provincial privacy law), give clear notice and purpose, limit retention, control access, and document legal-hold and redaction procedures. Use a short recorded prompt for customer calls, explicit employee notice when required, and a governance log for audits.
At-a-glance checklist (first screen)
| Action | When required | Quick wording |
|---|---|---|
| Criminal-law consent | Always — one-party consent suffices for interception law | Implicit if caller proceeds after prompt; otherwise obtain verbal consent. Criminal Code, s.184 |
| Privacy notice & purpose | Customer calls, marketing, training, quality assurance | “This call may be recorded for quality and training.” — state purpose clearly. OPC guidance |
| Retention & access | Always — set retention by purpose and document it | Example: customer disputes = 2 years; training = 90 days. |
| Employee recordings | If recording employee conversations, notify and justify | Include in workplace policy and collective bargaining if unionized. See provincial guidance below. |
Key takeaways
- Criminal-law consent (one-party) is necessary but not sufficient for business use. Criminal Code, s.184.
- PIPEDA and provincial privacy laws require notice, limited purposes, safeguards, retention limits and access rights. OPC recording guidance.
- Quebec and other provinces add stricter consent and transparency duties—treat Quebec as higher-touch. Quebec (Law 25 / Bill 64).
- Operationalize with a short IVR prompt, an employee notice, a retention schedule, and a secure access log.
- Start small: pilot recording on one queue, measure access requests and redaction needs, then roll out.
What is the legal baseline for recording calls in Canada?
Short answer: criminal interception rules allow recording when at least one party to the conversation consents, but privacy statutes govern how organizations collect, use, disclose, secure and retain recordings. The Criminal Code makes interception without consent an offence; the Code’s consent exception is commonly called “one-party consent.” See s.184.
Separately, federal privacy law (PIPEDA) and provincial private-sector laws set obligations for organizations that record calls as part of their business processes: give meaningful notice, limit collection to necessary purposes, secure recordings, retain them only as long as necessary, and allow access or correction requests. The Office of the Privacy Commissioner has explicit guidance for recording customer calls. OPC guidance on recording.
How do federal and provincial rules differ — what to watch for
Federal PIPEDA applies to federally regulated organizations and to organizations in provinces without substantially similar private-sector laws. British Columbia, Alberta and Quebec have their own private-sector privacy laws that overlap with PIPEDA but include local specifics. Quebec’s recent modernization (Law 25, previously Bill 64) strengthened consent, transparency and administrative penalties; treat recording practices in Quebec as needing extra documentation and explicit, clear consent in many contexts. Overview: Law 25 (Bill 64).
Practical implication: where you do business in multiple provinces, use the strictest applicable rule as your minimum safe practice — explicit notice, clear purpose statements, and a retention schedule by province and by purpose.
Our point of view
We recommend designing recording programs as governance-first projects. First prove the need and define purpose by queue or team. Second, design the user-facing notice and consent path (IVR prompt or agent script). Third, lock down access, retention, and redaction workflows before enabling recordings broadly. This reduces legal risk and operational pain during access requests or legal holds.
Trade-off: stronger consent and shorter retention reduce legal exposure but may hinder dispute-resolution and training use. Our POV: minimize retention for general QA (example: 30–90 days) and keep longer retention only where justified and logged (billing disputes, regulatory obligations).
How to implement — a short operational framework
Follow a three-step framework: Decide, Configure, Govern.
- Decide (policy & purpose) — map call flows, label queues (sales, billing, support, collections), and set a purpose for each. Document who needs longer retention (e.g., collections).
- Configure (notice, tech, storage) — add IVR prompts or agent scripts, set retention rules in the recording platform, store recordings with encryption and region controls, and enable audit logging.
- Govern (access, legal hold, audit) — restrict access to named roles, require documented approval for retrievals, log exports, and implement redaction workflows for payment data and sensitive health information.
Compact matrix (one small diagram description):
| Use case | Consent/Notice | Retention (example) | Access |
|---|---|---|---|
| General customer support | IVR prompt; implied consent if caller continues | 30–90 days | Supervisor with logged request |
| Billing and disputes | IVR prompt; verbal reconfirmation for disputes | 1–2 years (documented) | Compliance and billing staff |
| Collections | IVR prompt; check provincial debt-collection rules | 2+ years per business need | Limited to collections team, audit trail required |
| Employee coaching & QA | Notice in employment policy; opt-out rules as required | 30–90 days | HR and managers with consent rules |
Diagram description (for designers or CMS): “Caller → IVR notice (recording yes/no) → Call routing → Recording service → Encrypted storage (region) with access roles and retention tags.” Alt text suggestion: “Call flow showing IVR notice to recording storage and access roles.”
Policy template — copyable and short (editable)
Below is a compact, operational policy template you can paste into your employee handbook or compliance binder. Edit bracketed items to match your environment.
Call Recording Policy
Purpose: [State business reasons: quality assurance, dispute resolution, training, regulatory].
Scope: Applies to all incoming and outgoing voice calls on systems managed by [Company], and to recordings stored in [region/service].
Legal basis: Recording is permitted where at least one party consents under the Criminal Code; in addition, recordings are collected and handled under applicable privacy laws (PIPEDA or provincial law as applicable).
Notice and consent:
- Customer-facing calls: An IVR prompt will state: “This call may be recorded for [quality/training/dispute-resolution]. If you do not consent, please hang up or request an alternative.”
- Agent scripts: Agents will open calls with: “This call may be recorded for quality and training.”
- Employee conversations: Employees will be notified in the workplace privacy policy that business calls may be recorded for legitimate business reasons. [If unionized, consult collective agreement].
Retention: Recordings are retained by purpose:
- Quality/training: [30–90] days
- Billing/disputes: [12–24] months
- Legal hold: retained until notice of release
Access and controls:
- Only authorized roles [list roles] may retrieve recordings; every retrieval must be logged with reason, requestor, and time.
- Exports require manager approval and must be transmitted with secure links.
Redaction: Sensitive fields (payment card data, health identifiers) must be redacted before export. Where automated redaction is used, verify a human check for accuracy.
Security: Store recordings encrypted at rest and in transit; keep backups in the same data residency region unless legally required to transfer.
Access requests and complaints: Individuals may request access or make complaints following [Company]’s privacy request procedure; escalate to Privacy Officer at [email/phone].
Review: This policy will be reviewed annually or when laws change. Effective date: [date].
How this maps to common personas & ICPs
Contact center manager: prioritize clear IVR wording, per-queue retention, and a supervisor-only retrieval log. Pilot for busiest queue for 30 days.
Compliance officer / legal counsel: document lawful basis, retention schedule, legal-hold steps, and an auditable access trail; treat Quebec records with stricter notice and consent clarity. Law 25 overview.
HR Director: add employee notice to handbook, coordinate with union reps, and define when covert monitoring (rare) is permitted and how it will be authorized.
Common objections and pitfalls — and how to avoid them
“We already have implied consent via the IVR.” Implied consent can work, but only if the caller is given clear purpose and an alternative. The OPC explicitly recommends meaningful notice and alternatives. OPC guidance.
“One-party consent makes everything legal.” One-party consent addresses interception under the Criminal Code but does not relieve you from privacy obligations around collection, retention, access, and use. Always document purpose and safeguard recordings. Criminal Code, s.184.
“Employees can record without telling anyone.” Legally an employee who participates can record, but secret recordings can create employment-law and trust issues and may violate internal policy; a proactive workplace policy reduces surprises. See recent practice notes for workplace contexts. HRD Canada: workplace recording considerations.
Practical scripts and IVR prompt examples
IVR (short): “This call may be recorded for quality and training. If you do not consent, hang up or press 2 for an alternative.”
Agent (on connect): “Hello, I’m [name]. This call may be recorded for quality and training; do you consent to continue?” — use for sensitive queues.
Agent (if requested): If a caller objects, route to an unrecorded line or offer a written/online alternative and log the preference.
Checklist for enabling call recording (runbook)
- Map queues and purposes (support, billing, collections, HR).
- Draft IVR prompt and agent scripts; run legal review in Quebec and any applicable provinces.
- Configure recording platform: retention tags, encryption, region controls, and access roles.
- Pilot on one queue for 30 days; track retrieval requests and complaints.
- Review logs, validate redaction, update policy, roll out in phases.
Brand bridge — how Sunco helps
If you want us to review or validate your call-recording policy across Canadian provinces, tell us which provinces and we will draft a tailored policy and pilot plan that maps to your queues and retention needs.
FAQ
Do I need consent from both parties to record a call in Canada?
No — the Criminal Code allows recording if at least one party to the call consents. But businesses must still meet privacy-law obligations (notice, purpose, retention). Criminal Code, s.184.
What if a caller objects to being recorded?
Provide an alternative channel when feasible (unrecorded line, branch visit, online option), document the objection, and do not use recorded material for purposes beyond those disclosed. OPC guidance.
How long should we retain recordings?
Retention depends on purpose. For QA, 30–90 days is common; for billing disputes or regulatory needs, keep longer with explicit justification and an access log. Always document retention choices and deletion procedures.
Sources
- Criminal Code of Canada — Interception (s.184)
- Office of the Privacy Commissioner of Canada — Recording of Customer Telephone Calls
- McMillan LLP — Bill 64 / Quebec privacy reform (Law 25)
- HRD Canada — workplace recording considerations (practice note)
“,
