October 27, 2026 Compliance 8 min read

Canadian Data Residency: What Small Businesses Need to Know

By Omer Segoly, CISM | Published October 27, 2026

PIPEDA does not require Canadian data residency for personal information. The Office of the Privacy Commissioner of Canada's Guidelines for processing personal data across borders states that "PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing." However, Quebec Law 25 requires a privacy impact assessment before transferring data outside Quebec, and some public sector contracts require Canadian storage.

This guide explains what Canadian private sector privacy law actually requires, what additional rules may apply, and what to ask vendors before you sign. This is informational context (not legal advice).

Does PIPEDA Require Canadian Data Residency?

No. PIPEDA does not require that personal information stay in Canada. The OPC's Guidelines for processing personal data across borders, published in January 2009, summarizes key findings from the Commissioner's investigations: "PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing," and "PIPEDA does not distinguish between domestic and international transfers of data."

What PIPEDA does require is accountability. Principle 4.1.3 of Schedule 1 states that an organization is responsible for personal information transferred to a third party for processing and must "use contractual or other means to provide a comparable level of protection while the information is being processed by a third party."

In practice:

• You remain accountable even when a cloud provider stores data outside Canada
• You must use contracts to ensure comparable protection
• The OPC guidance states that organizations "must be transparent about their personal information handling practices" including advising customers that data "may be sent to another jurisdiction for processing" and "may be accessed by the courts, law enforcement and national security authorities"
• No contract can override the laws of a foreign country where data is stored

For a broader overview of PIPEDA and provincial privacy laws, see our guide to Canada's privacy landscape.

What Does Quebec Law 25 Require for Data Transfers Outside Quebec?

Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) imposes stricter requirements than PIPEDA for data transfers outside the province. Section 17 of the Act, in force since September 22, 2023, requires a privacy impact assessment before communicating personal information outside Quebec.

The assessment must consider the sensitivity of the information, the purposes for which it will be used, the protection measures (including contractual ones), and the legal framework in the destination jurisdiction. Section 17 paragraph 2 states that the written agreement "must take into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified."

Section 17 paragraph 3 states that the same applies "where the person carrying on an enterprise entrusts a person or body outside Quebec with the task of collecting, using, communicating or keeping such information on his behalf." An Ontario-hosted SaaS provider storing Quebec customer data triggers these requirements.

For customer notice, section 8 requires that at the time of collection, if applicable, the person be informed of "the possibility that the information could be communicated outside Quebec."

For businesses handling Quebec customer data, our Quebec Law 25 compliance guide covers the privacy impact assessment requirement in detail.

Do BC or Nova Scotia Have Data Residency Laws for Private Businesses?

Neither law applies to an ordinary private business's own customer data. British Columbia's FOIPPA and Nova Scotia's PIIDPA are public sector statutes. However, a private business contracted by a public body to handle that body's personal information may be directly bound by PIIDPA in Nova Scotia or subject to contract requirements flowing from FOIPPA in British Columbia.

British Columbia: FOIPPA previously required public bodies to store and access personal information only in Canada. Effective November 25, 2021, the province repealed section 30.1 ("Storage and access must be in Canada"), along with sections 30.2 and 30.4; section 30.3 was amended, not repealed. B.C. Reg. 294/2021 (effective November 26, 2021) requires an additional assessment within the section 69 PIA when sensitive personal information is stored outside Canada. This does not apply to programs, projects, or systems already in existence when the regulation came into force.

Nova Scotia: PIIDPA section 5(1) directly binds both public bodies and their service providers: "a public body shall ensure that personal information in its custody or under its control and a service provider or associate of a service provider shall ensure that personal information in its custody or under its control is stored only in Canada and accessed only in Canada" unless an exception applies. Section 2(g) defines a service provider as a person retained under contract to perform services for a public body who uses, stores, or accesses that body's personal information. Section 13 makes breach by a service provider an offence, with fines up to $25,000 for an individual service provider and $500,000 for a corporation. The section 5(1) exceptions are: (a) consent in the prescribed manner, (b) storage or access for a disclosure allowed under the Act, or (c) the head of the public body has allowed it under section 5(2) to meet the necessary requirements of the public body's operation.

Service providers working with government clients should review the contract terms and the statute.

What Does Canadian Data Residency Actually Protect Against?

Storing data in Canada addresses some risks but not others. The Government of Canada's 2018 White Paper on Data Sovereignty and Public Cloud explains the distinction. (The Government of Canada has since published the Digital Sovereignty Framework, which extends this work.)

The 2018 White Paper defines "data residency" as "the physical or geographical location of an organization's digital information." Its summary table states: "Data residency does not mitigate against the application of foreign laws."

Data sovereignty is about legal control. The White Paper states that "regardless of where the cloud resources are physically located, when data is stored in a cloud environment, the stored data may be subject to the laws of other countries." A cloud provider with foreign operations "could be required to comply with a warrant, court order or subpoena request from a foreign law enforcement agency."

The Canadian Centre for Cyber Security's guidance on securing cloud and outsourced IT services advises organizations to "learn where outsourced providers will house their services."

For small businesses, Canadian residency is one layer of protection, but it does not guarantee that a foreign government cannot compel disclosure.

What Should You Ask Cloud and SaaS Vendors?

The Canadian Centre for Cyber Security advises organizations to "learn where outsourced providers will house their services" and evaluate "legal jurisdiction where outsourced providers store and use sensitive information." Quebec's section 18.3 requires that a mandate or contract to handle personal information be in writing, specify confidentiality measures, and provide that the third party not keep the information after the mandate ends.

Where is data stored at rest? Confirm the specific data centre regions. "North America" is not specific enough if you need Canadian residency.

Where is data processed and accessed from? Data may be stored in Canada but accessed by support staff elsewhere.

Does the vendor use sub-processors? Ask for a list of sub-processors and where they operate.

Who holds the encryption keys? The 2018 White Paper states that "data that is encrypted using a strong cryptographic algorithm is protected from anyone who does not have the decryption key" and directs that the Government of Canada "maintain exclusive control of the encryption keys." If your vendor holds the keys, they can decrypt your data.

What are the breach notification commitments? The contract should specify how quickly the vendor will notify you of a breach. This matters for your incident response plan.

What happens at contract end? Quebec's section 18.3 requires that the third party not keep the information after the contract ends. Get these terms in writing.

For a broader view of vendor risk, see our guide to vendor and third-party risk. For cloud security fundamentals, see cloud security basics.

What Should You Tell Your Customers?

If you transfer customer data outside Canada, PIPEDA requires transparency. The OPC guidance states that organizations must advise customers "that their personal information may be sent to another jurisdiction for processing and that while the information is in another jurisdiction it may be accessed by the courts, law enforcement and national security authorities." This notice should appear in your privacy policy. If Quebec Law 25 applies, section 8 requires that at collection, if applicable, the person be informed of "the possibility that the information could be communicated outside Quebec."

One Question to Ask Your IT Provider

"Which of our systems store or back up customer data outside Canada, and who can access it?"

If your IT lead or managed service provider cannot answer this question, that conversation is where your data residency work should start.

Assess Your Cloud and Vendor Practices

Understanding your Canadian data residency obligations starts with knowing your current practices. Our free cybersecurity assessment evaluates your organization against the Canadian Centre for Cyber Security's 13 Baseline Control areas, including cloud security and access control. It takes under 30 minutes, requires no signup, and your answers stay in your browser. The results show you where to focus first.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Canadian Data Residency: What Small Businesses Need to Know. Retrieved from https://cybersecuritycanada.ca/news/posts/data-residency-canada-small-business-guide/

Permanent URL: https://cybersecuritycanada.ca/news/posts/data-residency-canada-small-business-guide/ · Published October 27, 2026