Rules
AI meeting notes for Canadian companies: PIPEDA rules
AI meeting notes for Canadian companies face PIPEDA consent and retention rules. The disclosure must name the purpose, retention period and storage location.
What to take away
- AI meeting notes for Canadian companies turn a recorded call into a searchable transcript, and under PIPEDA that transcript is personal information.
- PIPEDA covers meeting recordings that identify a person, and the Office of the Privacy Commissioner of Canada is the federal regulator.
- Consent is required before recording starts, and notice sent after the call does not meet the standard.
- A compliant disclosure names the purpose, the retention period, who can read the transcript, and the storage location.
- British Columbia, Alberta and Quebec each apply their own private-sector statute, so one national script will not fit every call.
- A leaked transcript is a reportable privacy breach, not an internal matter.
- Where a notetaker stores audio and transcripts, and how long it keeps them, are features to check before you buy, not settings to fix after a complaint.
Who has jurisdiction over a meeting recording
PIPEDA applies to private-sector organizations that collect personal information in the course of commercial activity, and the Office of the Privacy Commissioner of Canada enforces it. Its full title is the Personal Information Protection and Electronic Documents Act. A recorded voice identifies a person, and so does the transcript built from it.
Recording a call is collection, and keeping the summary is retention; both sit inside the same statute. The duty belongs to the organization that pressed record, not the vendor that built the app.
The transcript usually lands in the collaboration tool the team already uses, so access rules there decide who can replay a client call. team collaboration security covers the checks worth running once the file exists.
What a compliant disclosure contains
Consent under PIPEDA has to be informed, and for a recorded meeting that means telling people what will happen before they speak. The notice can be short, but it must answer the same questions every time.
Compliant disclosure checklist
- Purpose as a recognisable outcome
- Retention period and deletion date
- Who can read, search, export
- Countries outside Canada storing data
- How to request copy or withdrawal
Consent is valid only for the purpose a person was told about, so a line saying "calls may be recorded" is weak on its own. The Office of the Privacy Commissioner's Guidelines for Obtaining Meaningful Consent explain how withdrawal works and what an organisation must do when someone changes their mind.
- The purpose, written as an outcome a participant would recognise.
- The retention period and the date the file is deleted.
- Who inside the organisation can read, search or export the transcript.
- Any country outside Canada where the audio or text is processed or stored.
- How a participant asks for a copy, a correction, or the withdrawal of consent.
Provincial law adds items to this list in some places, and the differences are set out below.
Records to keep after the call
Consent is only useful if you can show it. A meeting record set holds the notice text shown to participants, the time it appeared, the responses, the transcript and the deletion log.
Retention should follow a stated purpose rather than convenience. A transcript held "just in case" has no purpose that survives a complaint. When a staff member leaves or a contractor's account closes, the access list has to change that day. account administration decisions covers the offboarding steps that look cheap now and costly later.
What happens if you do not comply
An individual can complain to the Commissioner at no cost. The office investigates, issues a findings report, and can publish the organisation's name alongside the outcome. If the complainant is not satisfied, they can apply to the Federal Court of Canada within one year of the report. The Commissioner's overview of the Act sets out that process.
The Federal Court can order an organisation to change its practices and can award damages to the complainant. Findings reports are public.
A separate duty applies to breaches under the Breach of Security Safeguards Regulations. Where a loss of personal information creates a real risk of significant harm, the organization must report it to the Commissioner and notify the people affected as soon as feasible after it determines the breach has occurred, and it must keep a record of every breach of security safeguards, reportable or not. A transcript that leaks client names, account numbers or health details usually crosses that line. In British Columbia and Alberta the provincial Personal Information Protection Act applies, and each province's Information and Privacy Commissioner can issue binding orders.
Example: a Quebec client call
A Vancouver software firm records a product demo for a client whose staff sit in Montreal. Quebec's private-sector privacy law, as amended by Law 25, applies to the client's own handling of that recording, and the Commission d'accès à l'information du Québec is the regulator. Quebec expects a privacy impact assessment before a system that processes personal information goes live.
The notice has to list the countries where the file is stored, and the transcript needs a deletion date. Where that transcript sits matters as much as what it says, and office suites security covers the review nobody schedules.
Where the rules differ by place
PIPEDA covers federally regulated employers such as banks, telecoms and airlines in every province. Provincially regulated organisations in British Columbia, Alberta and Quebec fall under a provincial statute instead.
Privacy law by jurisdiction
Federal
- Statute
- PIPEDA
- Regulator
- OPC
- Cross-border notice
- No
- Named officer
- No
BC
- Statute
- PIPA
- Regulator
- OIPC BC
- Cross-border notice
- Yes
- Named officer
- No
Alberta
- Statute
- PIPA
- Regulator
- OIPC AB
- Cross-border notice
- Yes
- Named officer
- No
Quebec
- Statute
- Law 25
- Regulator
- CAI Quebec
- Cross-border notice
- Yes
- Named officer
- Yes
| Jurisdiction | Statute | Regulator |
|---|---|---|
| Federal | PIPEDA | Office of the Privacy Commissioner of Canada |
| British Columbia | Personal Information Protection Act | Office of the Information and Privacy Commissioner for BC |
| Alberta | Personal Information Protection Act | Office of the Information and Privacy Commissioner of Alberta |
| Quebec | Private-sector privacy law as amended by Law 25 | Commission d'acces a l'information du Quebec |
British Columbia and Alberta each have a Personal Information Protection Act that requires organizations to tell people when personal information may be stored outside Canada. Quebec requires a named privacy protection officer, the responsable de la protection des renseignements personnels, and sets its own separate breach rules. Public bodies and health information sit under separate provincial statutes, so a call that involves a hospital, a school board or a patient record brings a different regulator into the room.
In every province, the disclosure is a written commitment, so it belongs with the other rules your team keeps in one place. Draft them before you look at products; write team agreements explains how.
What to check in the AI notetaker you shortlist
Most Canadian teams end up comparing the same handful of tools: Otter.ai, Fireflies.ai, Zoom AI Companion, Microsoft Teams Copilot and the Gemini notes in Google Meet. Each of them keeps audio and transcripts in vendor cloud storage, so the privacy duty travels with the subscription instead of staying on your laptop. The vendor's answers to these questions belong in the disclosure you send participants:
- Where is the audio processed, and in which country is the transcript stored?
- What is the default retention period, and can an administrator set a shorter one or a fixed deletion date?
- Are retention controls and access audit logs included in the tier you are quoted, or only in a higher one?
- Who inside the vendor can read a transcript, and does the data processing agreement say so?
- Can the tool join only when the host starts and announces the recording, rather than automatically?
- What happens to the transcript when a participant asks for a copy, a correction or deletion?
The answers decide which plan can honestly be described in a PIPEDA notice. A tool that will not name the country where it stores transcripts cannot be described in one.
