There is a sentence that appears in a great many Canadian vendor contracts, procurement responses, and privacy policies: your data is stored in Canadian data centres. It is usually true. It is also doing far less work than the people relying on it believe.
Data residency is a question about geography. Where do the bytes physically sit? Data sovereignty is a question about jurisdiction. Whose courts can compel access to them? Those are different questions, they have different answers, and for a growing number of Canadian businesses the gap between the two has moved from an abstraction that interested privacy lawyers into something that shows up in customer contracts, procurement requirements, and board discussions.
The reason is straightforward. Under the United States CLOUD Act, US authorities can compel a US-headquartered company to produce data in its custody or control regardless of where in the world that data is physically stored. A Canadian data centre operated by a company with a US parent provides residency. It does not, on its own, provide sovereignty.
This article explains the distinction precisely, sets out what it actually means for a Canadian business with 20 to 200 employees, and gives you a way to assess your own technology stack without turning it into a six-month project. It is written as practical orientation, not legal advice, and where the answer depends on your specific circumstances we say so.
Data residency is where data is physically stored and processed. It is a technical and contractual commitment, it is easy to verify, and it is easy to advertise. Most major cloud platforms offer Canadian regions and will contractually commit to keeping data in them.
Data sovereignty is which country's laws govern the data and which authorities can compel its disclosure. It is determined by legal jurisdiction over the entity holding the data, which follows corporate structure rather than server location.
Analysis from Canadian firms working in this area has converged on the same formulation: sovereignty is about control, not location, and control is shaped by legal jurisdiction, corporate structure, and service provider relationships. The Government of Canada's own examination of the question concluded that Canada cannot ensure full sovereignty over its data when that data is stored in the cloud. If the federal government cannot achieve it through location alone, a Canadian business cannot either.
The practical consequence: the question worth asking a vendor is not only where the data lives. It is who can be compelled to hand it over, and who controls the encryption keys.
The Clarifying Lawful Overseas Use of Data Act, passed in the United States in 2018, established that a US-based provider must produce data in its possession, custody, or control in response to lawful US process, whether or not the data is stored inside the United States. It resolved, in favour of law enforcement, a question that had previously been litigated over whether a warrant stopped at the border.
Three points matter for a Canadian business.
It follows the company, not the server. A US-headquartered provider storing your data in Toronto is within scope. The Canadian address of the facility is not the operative fact; the corporate nationality of the entity with control is.
Corporate structure is the determining variable. Guidance from Canadian counsel on this point is reasonably consistent: an entity incorporated in Canada that is wholly Canadian-owned and Canadian-managed will generally fall outside the reach of the CLOUD Act. A Canadian subsidiary operating under the direct control of a US parent is in a materially different position. This is the single most useful distinction in the whole discussion, and it is the one most often skipped in vendor marketing.
The asymmetry is real and unresolved. A bilateral executive agreement between Canada and the United States, of the kind that would create reciprocal process, has not been concluded. US authorities can reach Canadian data held by US companies; Canadian authorities seeking data held in the US rely on the slower mutual legal assistance treaty route. That imbalance is a live policy issue rather than a settled one.
It is worth being measured about the risk. The CLOUD Act is a lawful-access mechanism used in criminal investigations, not a general-purpose surveillance programme aimed at Canadian small businesses. The probability that a 60-person engineering firm in Calgary becomes the subject of US legal process is low. The reason it matters anyway is that your obligations, and your customers' requirements, do not turn on probability. They turn on whether you can demonstrate you assessed it.
More than most business owners assume.
Research published in 2026 analysing software tools used by Canadian organizations found that roughly two-thirds were operated by companies subject to the CLOUD Act, and only about 17% were Canadian-owned. The finding that matters most for anyone relying on a residency commitment: among the 201 tools in that dataset which offered Canadian data residency, roughly one in three remained under US parent jurisdiction. Residency was being marketed as a sovereignty safeguard by vendors who could not deliver sovereignty.
The exposure is not evenly distributed. That same analysis found the concentration highest in communications tooling, the platforms used for internal email, messaging, and video calls, where the overwhelming majority fell under foreign jurisdiction, and similarly high in developer operations tooling.
Separate survey work in 2026 found that around 40% of Canadian organizations identified changes to Canada-US data sharing as their top regulatory concern, with roughly one in five flagging the CLOUD Act specifically as a critical issue. Two years ago that would have been a fringe result.
For a business with 20 to 200 users, the honest summary is this: your productivity suite, your CRM, your accounting platform, your payroll system, your helpdesk, and your file storage are all quite likely operated by US-headquartered companies. That is not a scandal and it is not necessarily a problem you need to solve. It is a fact you should be able to state accurately when a customer, a regulator, or your own board asks.
Four forces have converged, and none of them is reversing.
Third-party risk programs at large organizations have matured to the point where they ask suppliers about sub-processors, data location, and jurisdiction, not just about MFA and backups. If you sell to a bank, a health authority, a utility, a municipality, or a federally regulated business, expect a question about where your data goes and who else can reach it. We covered the broader questionnaire dynamic recently; the sovereignty section is the part most suppliers answer worst.
Law 25 is the strictest privacy regime in Canada and it reaches any organization holding personal information about Québec residents, wherever that organization is located. Among its requirements is an assessment before transferring personal information outside Québec, which includes transfers to vendors under foreign jurisdiction. A national business with Québec customers has a documented assessment obligation, not a judgment call. Our recent coverage of Law 25 goes into the broader compliance picture.
Trade disputes and a more assertive US technology policy have moved digital sovereignty from a compliance footnote to a board-level topic in Canada, including active discussion of sovereign cloud options at multiple levels of government. Whatever one's view of the politics, the practical effect is that your customers are now more likely to ask.
Financial services and health care sit under the most specific requirements, and organizations in those sectors are pushing obligations down to their own suppliers. Our guidance for law firms and for medical practices both touch on this; the pattern is that regulated clients export their requirements to their vendors.
A common misconception is worth correcting directly: PIPEDA does not prohibit storing or processing personal information outside Canada.
What it does is keep accountability with you. Under the accountability principle, an organization that transfers personal information to a third party for processing remains responsible for that information and must use contractual or other means to provide a comparable level of protection. Federal guidance has consistently held that this includes being transparent with individuals about the fact that their information may be processed outside Canada and may be accessible to foreign authorities.
Three practical obligations follow.
Alberta and British Columbia have their own private-sector statutes with comparable accountability principles, and public bodies in some provinces face stricter location requirements than private businesses do. Québec, as above, is the strictest.
This does not need to be a consulting engagement. Six steps get you to a defensible position.
Worth doing, and usually free. It satisfies residency requirements, reduces latency, and is straightforward to verify. It does not resolve jurisdiction if the provider has a US parent. Do it, and do not overclaim it.
The most substantive technical mitigation available within a major cloud platform. If you hold the keys and the provider cannot decrypt your data, then compelled production yields ciphertext. The caveats are real: key management is an operational discipline, losing keys means losing data, and not every service in a platform supports the model. For a tier-one workload it is often the right answer. Treat vendor claims here specifically rather than generally.
The cleanest answer to the jurisdiction question, per the guidance above: a Canadian-incorporated, Canadian-owned, Canadian-managed entity with no US operations generally sits outside CLOUD Act reach. The trade-off is usually feature depth and scale relative to the hyperscalers, so this tends to be the right choice for specific workloads rather than a wholesale migration.
Full control, and a real answer for a tier-one workload with a genuine sovereignty requirement. It also means you own patching, backup, monitoring, and hardware lifecycle, which is precisely the burden most businesses moved to the cloud to shed. Sensible for a defined subset; rarely sensible as a general strategy.
The most underrated option on the list. Data you do not hold cannot be compelled, breached, or assessed. Retention limits, deletion schedules, and reduced identifiability shrink the problem rather than managing it. It is also the cheapest thing on this page.
A closing caution, because the commercial temptation here is obvious and it creates real risk.
Sovereignty language is becoming a marketing category, and a great deal of it is imprecise. Vendors describe Canadian residency as sovereignty. Some describe themselves as Canadian while operating as a subsidiary of a foreign parent. Others hold a Canadian data centre address and route support, monitoring, or administrative access through another jurisdiction entirely, which is a sub-processor question their marketing does not address.
The risk of repeating an overclaim is not reputational, it is contractual. If you attest to a customer that their data is subject only to Canadian jurisdiction, and that attestation turns out to be wrong because your provider's parent is elsewhere, you have signed something you cannot support. That is the same failure mode as an inaccurate cyber insurance application, and it has the same consequence: the problem surfaces at the worst possible moment.
The defensible posture is accuracy. Know your stack, state what is true, document what you assessed, and be specific about what you have and have not mitigated. A supplier who can say precisely where their data sits, who the parent company is, which sub-processors touch it, and what they decided about each tier is in a stronger competitive position than one making broad claims, because the first answer survives a follow-up question.
GAM Tech has supported Canadian businesses with 20 to 200 users since 2012, from eight offices across Alberta, British Columbia, Ontario, and Quebec, with bilingual support in Ottawa and Montréal.
On this subject specifically, our position is structural rather than a claim:
What is the difference between data residency and data sovereignty? Residency is where data is physically stored. Sovereignty is which country's laws govern it and which authorities can compel disclosure. Residency follows the server; sovereignty follows the corporate structure of the entity holding the data.
If my data is in a Canadian data centre, is it protected from US access? Not necessarily. If the provider is US-headquartered or controlled by a US parent, the CLOUD Act can reach data in its custody or control regardless of where it is stored. Canadian storage improves your residency and compliance posture without creating a jurisdictional barrier by itself.
Does PIPEDA prohibit storing Canadian data outside Canada? No. PIPEDA permits cross-border transfers but keeps accountability with your organization, requiring comparable protection through contractual or other means and transparency with individuals about processing outside Canada and potential foreign access.
What does Québec's Law 25 require for cross-border transfers? Law 25 requires an assessment before personal information is transferred outside Québec, including to vendors under foreign jurisdiction, and it applies to any organization holding personal information about Québec residents regardless of where that organization is located. The assessment needs to be documented.
Do customer-managed encryption keys actually solve the problem? They are the strongest technical mitigation available inside a major cloud platform, because a provider that cannot decrypt your data cannot produce readable data under compulsion. The practical caveats are that key management is an operational responsibility, key loss means data loss, and not every service supports the model. Verify per service rather than per vendor.
Is a Canadian-owned provider genuinely outside the CLOUD Act? Canadian legal guidance indicates that an entity incorporated in Canada, wholly Canadian-owned and Canadian-managed, with no US operations, will generally fall outside its scope, whereas a Canadian subsidiary controlled by a US parent will not. Whether a specific arrangement qualifies is a question for your counsel.
How exposed is a typical Canadian business? More than most expect. Research in 2026 found roughly two-thirds of tools used by Canadian organizations were operated by companies subject to the CLOUD Act, with only about 17% Canadian-owned, and roughly one in three tools advertising Canadian residency still sat under US parent jurisdiction.
Do we need to move everything to Canadian-owned providers? Almost certainly not, and attempting it would be expensive and disruptive. The proportionate approach is to classify systems by data sensitivity and apply stronger controls only to the tier holding regulated or highly sensitive information.
What should we do if a customer asks about data sovereignty in a questionnaire? Answer accurately with the specifics: where data is stored, who the corporate parent is, which sub-processors have access, and what you have assessed and decided. A precise answer, including honest limitations, is stronger than a broad claim, because the broad claim invites a follow-up question you cannot answer.
Where do we start? Map your data flows for the systems holding sensitive information, record the four facts for each, classify by sensitivity, and write the assessment down. The document is the deliverable, because it is what satisfies a Law 25 obligation, a PIPEDA accountability expectation, and a customer questionnaire alike.
Most Canadian businesses in this size range cannot currently answer, in writing, which of their systems hold sensitive data, which corporate parent controls each one, and which foreign sub-processors have access. That answer is increasingly a condition of doing business with larger customers, and under Law 25 it is an obligation rather than a nice-to-have.
GAM Tech offers a data flow and jurisdiction assessment across all eight of our Canadian markets. We map the systems holding sensitive information, identify the parent company and sub-processors for each, classify by sensitivity, and produce the written assessment you need for a Law 25 transfer obligation or a customer security questionnaire — with honest guidance on which workloads genuinely warrant a change and which do not.
Call 1-833-GAM-TECH or book a consultation. Since 2012, Canadian-owned and built without outside capital, SOC2 certified, B Corp certified, 24/7 internal staff, never outsourced.