Outsourcing lead follow-up under Québec's Law 25: what to ask your vendor

Why vendor choice is a compliance decision

When you hand your leads to an outside team, you are not handing off your obligations. Under Québec's Law 25, the company that collected the personal information stays accountable for it, even when a service provider is the one picking up the phone. If your vendor mishandles a prospect's data, it is your name on the incident report.

That is why choosing a lead follow-up partner is as much a privacy decision as a sales one. The good news: a handful of direct questions will tell you quickly whether a vendor takes this seriously.

Is there a written agreement that protects the data?

Law 25 lets you share personal information with a service provider without the individual's consent, but only under a written contract. That contract should spell out the security measures the vendor applies, limit use of the data to the mandate you gave them, and require them to destroy or return it when the work ends. It should also oblige the vendor to tell you promptly about any breach and to let you verify that they comply.

Ask to see this clause before anything else. A vendor that hesitates to sign it is telling you something.

Who is accountable, and how are incidents handled?

Every organization subject to Law 25 needs a person in charge of the protection of personal information, and their title and contact details must be published on the organization's website. Ask your vendor who that person is on their side and how to reach them.

Then ask how they handle a confidentiality incident. Law 25 requires organizations to keep a register of incidents and to notify the Commission d'accès à l'information (CAI) and the people affected when an incident presents a risk of serious injury. A serious vendor will be able to walk you through their process, who gets notified and how fast.

Will the data leave Québec?

Before personal information is communicated outside Québec, Law 25 requires a privacy impact assessment to confirm the information will be adequately protected. Many lead follow-up tools, dialers and CRMs store data in other provinces or countries.

Ask where the vendor's agents work, where call recordings and lead data are stored, and which subcontractors or software providers touch the data. You need those answers to complete your own assessment.

How do they handle consent for calls, texts and emails?

Follow-up by text and email falls under Canada's Anti-Spam Legislation (CASL). Every commercial message needs valid consent, must clearly identify who is sending it, and must include an unsubscribe mechanism that works. Unsubscribe requests have to be honoured within 10 business days.

Phone calls bring the CRTC's Unsolicited Telecommunications Rules into play: checking the National Do Not Call List where it applies, keeping an internal do-not-call list, identifying the caller and respecting permitted calling hours. Ask the vendor to show you how consent is recorded for each lead and how opt-outs flow back into your systems.

A quick checklist for your vendor review

• A written contract limiting use of the data and requiring its destruction at the end of the mandate
• A named person in charge of personal information, with published contact details
• A documented incident register and notification process
• A clear answer on where agents work and where data is stored
• Consent tracked for every lead, and opt-outs processed within 10 business days
• Encryption, access controls and background checks for agents

This article is for general information and is not legal advice. Consult qualified counsel about your obligations.

Philippe Lebel, Head of Operations & Privacy Officer at Multiply
Philippe runs day-to-day operations at Multiply and is responsible for how the company protects the personal information it handles for its partners.
LinkedIn