The Office of the Privacy Commissioner of Canada updated its guidance on the safe handling of voice data when recording customer calls, published October 8. Three points in it change how a small business should think about something most do casually, and the first one quietly removes an assumption nearly everyone makes.
One: it does not matter who called whom
Organizations subject to PIPEDA must comply with the Act when recording calls regardless of whether the customer or the organization initiated the call. The common assumption is that an inbound call is different, that someone who rang you has accepted whatever happens next. The OPC is explicit that this is not the distinction that matters. If you record, the obligations apply, and the guidance addresses the circumstances under which meaningful consent may be required.
Two: a voiceprint is sensitive biometric information
The guidance describes voiceprints as uniquely identifying voice characteristics that are considered sensitive biometric information, and it was updated to align with best practices for handling biometric data. This is the part that catches businesses out, because a voiceprint is not something most of them think they collect.
But consider what is arriving in ordinary small-business tooling. Phone systems offering voice authentication so callers do not have to answer security questions. Contact-centre features that identify a returning caller by voice. AI transcription and note-taking that captures every call, which we wrote about when Google switched meeting notes on by default for the small-business plan tiers. There is a real line between a recording of a conversation and a biometric template derived from a voice, and the second one carries a higher standard. Knowing which of those your phone or meeting vendor creates is now a question worth asking in writing.
Three: your call centre is your problem
Businesses that contract out to call centres, telemarketers and similar services must also ensure that third parties follow the rules. This is the same accountability principle the OPC leaned on in its recent draft guidance on assessing third-party service providers: outsourcing the activity does not outsource the obligation. If an answering service, overflow call centre or outsourced appointment desk records calls on your behalf, how they handle those recordings is attributable to you.
What to actually do
- List where voice is captured. Phone system, meeting tools, AI note-takers, the answering service, the voicemail transcription nobody set up on purpose. Most businesses find more than they expected.
- Ask the biometric question of each vendor, in writing: do you create or store a voiceprint or voice template, and if so, where and for how long. A recording and a biometric identifier are different products of the same call.
- Fix the notice. If calls are recorded, say so clearly at the start, in plain language, including what the recording is used for. This is cheap and it is the thing most commonly missing.
- Stop treating inbound differently. If your practice has been to record inbound calls without announcement, that is the habit this guidance speaks to most directly.
- Give recordings a retention period and actually delete on it. Indefinitely retained call audio is a liability that grows while providing no benefit.
- Check your outsourced providers. Written confirmation of what they record, how they get consent, where it is stored and when it is destroyed.
The takeaway
Voice used to be the least-examined data a small business held. Between recording for quality purposes, AI transcription, and voice authentication appearing as a convenience feature, a lot of businesses now hold sensitive biometric information without ever having made a decision about it. The work here is small: know where voice is captured, ask vendors what they derive from it, say so to the people on the call, and delete it on a schedule.