The 60-second summary
On 8 October 2026, the OPC updated its customer-call recording guidance to align with biometric-data practices. It applies to organisations subject to PIPEDA, including outsourced call services and calls initiated by either party. Voiceprints used for authentication are sensitive biometric information; express consent may be required. The guidance connects purpose-specific explanations, meaningful choice, access, safeguards and retention. This is updated regulatory guidance on existing obligations, with no newly announced application date.
Timeline that matters
8 October 2026
Existing obligations
10 November 2026
What changed
The OPC expressly identifies biometric voiceprints and meaningful-consent considerations as key updates.The revised recording guidance distinguishes a call's content from incidental personal information and identity-verification voiceprints.Its practical scope includes outsourced providers; responsibility requires checking the actual recording workflow.Background biometrics guidance calls for separately explaining biometric extraction and revisiting consent when uses expand.
Who should care
Contact-centre and customer-service ownersVoice-authentication and fraud teamsPrivacy, sensitive-data discovery and records teamsCall-centre providers, procurement and legal specialists
Why this matters for global organisations.
Audio workflows can produce transcripts, identity templates and incidental sensitive information with different purposes and risks. Inventory each output, give users understandable choices and verify controls throughout outsourced services.
13 actions to start now
- Name an accountable owner for recording and voice-authentication workflows.
- Confirm applicable privacy laws and document any consent exception with counsel.
- Map inbound and outbound recording, transcription, analytics and template-creation paths.
- Inventory sensitive information in transcripts and metadata; validate audio and biometric discovery coverage separately.
- Record a specific purpose and owner for every retained output.
- Review whether a voiceprint is necessary and assess alternatives before deployment.
- Test the notice and consent journey with representative callers, including accessibility needs.
- Provide a workable alternative when recording or biometrics are not integral and no exception applies.
- Check that vendor settings do not enable unapproved secondary uses or model training.
- Restrict access to recordings, transcripts and templates; test export permissions.
- Set retention and deletion rules by output and purpose, including supplier copies and backup handling.
- Rehearse access, withdrawal and incident-response requests across connected systems.
- Retain test results and require a new review when purposes, providers or features change.
Evidence worth retaining
- Processing inventory separating audio, transcripts, metadata and voiceprints
- Applicability, purpose and biometric-necessity assessments
- Versioned notices, consent records and tested alternative routes
- Vendor instructions, feature settings and subprocessor register
- Access/export tests and retention/deletion evidence
- Rights-request rehearsals and change approvals
Questions to take to counsel or your conformity team
These are discussion prompts, not legal advice or conclusions.
- Does PIPEDA apply to this activity, or does a substantially similar provincial law govern it?
- Which outputs are sensitive, and what form of consent or valid exception supports each use?
- Is voice recording or biometric authentication integral to the service?
- Do existing notices cover transcription, profiling and any proposed model training?
- How will withdrawal and retention restrictions propagate through suppliers and backups?
Official sources
- OPC announcement, 8 October 2026
- OPC recording customer calls guidance, updated 8 October 2026
- OPC adopted biometrics guidance, background
- OPC PIPEDA legislation and related regulations
PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.
PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.