Bill 25 and GDPR — what applies to you
Bill 25 (An Act to modernize legislative provisions as regards the protection of personal information) applies to any Quebec organization that collects, uses, or discloses personal information in the course of its commercial activities. If you send NPS surveys to your Quebec customers, you are subject to this law.
GDPR applies if you process data belonging to residents of the European Union, regardless of your geographic location.
| Obligation | Bill 25 (Quebec) | GDPR (EU) |
|---|---|---|
| Legal basis required | Yes — consent or legitimate interest | Yes — 6 possible legal bases |
| Right of access to data | Yes — 30 days to respond | Yes — 30 days to respond |
| Right to deletion | Yes | Yes (right to be forgotten) |
| Breach notification | 72 h to the CAI + affected individuals | 72 h to the supervisory authority |
| Impact assessment (PIA) | Required for high-risk projects | DPIA required (equivalent) |
| Privacy officer | Privacy Protection Officer required | DPO (if applicable) |
Configuring Cortex Voice for compliance
Cortex Voice automatically includes a compliant unsubscribe link in every survey email. Verify it is active under Settings → Compliance → Unsubscribe section. Never remove this link — its absence constitutes a violation of Bill 25 and PIPEDA.
In the survey editor → Footer, add a brief notice informing respondents how their data will be used. Example: "Your responses are confidential and used solely to improve our services. In accordance with Bill 25, you may access your data or request its deletion by writing to [email]."
Settings → Compliance → Data Retention. Set the maximum retention period for survey responses (recommended: 24 months for NPS data). Cortex Voice will automatically delete data once the configured period expires.
Managing respondent rights
If a respondent requests access to their data, go to Contacts → search by email → Export Data. The generated PDF file contains all responses, scores, and verbatims associated with that person — deliver it within 30 days of the request.
Contacts → select the contact → Delete Permanently. This action removes the email address, all associated responses, and adds the address to the permanent suppression list to prevent future sends. Deletion is irreversible and takes effect immediately.
If a respondent wishes to correct a data point (e.g., an incorrect email address), go to their profile in Contacts → Edit. Verbatims cannot be modified after submission — if a respondent wants to withdraw a comment, use the permanent deletion option instead.
Bill 25 requires every organization to designate a Privacy Protection Officer. This person (often the CEO in smaller organizations) must be publicly identified. Publish their contact information on your website and include their title in the footer of your Cortex Voice surveys.
Cortex Voice compliance checklist
- Unsubscribe link active in all survey emails
- Privacy notice included in survey footers
- Data retention period configured (max. 24 months recommended)
- Documented procedure to respond to access requests within 30 days
- Documented procedure for deletion requests (right to be forgotten)
- Privacy Protection Officer designated and publicly identified
- Two-factor authentication (2FA) enabled for all account administrators
- Data Processing Agreement (DPA) signed with Comulead
Key takeaways
- Bill 25 applies as soon as you collect data from Quebec customers — NPS surveys are included
- The unsubscribe link is mandatory and automatically generated by Cortex Voice — never remove it
- You must respond to access or deletion requests within 30 days
- Configure automatic data retention under Settings → Compliance
- Cortex Voice's Montreal-hosted infrastructure simplifies your compliance by eliminating cross-border data transfer obligations
