For most private-sector organizations in Canada, no law says your data has to stay in the country. The instruction still arrives, usually from somewhere other than a statute: a customer's security questionnaire, a vendor selling you its Canadian hosting region, a procurement form with a yes-or-no box.
What the law does ask for is less dramatic and more work. Know where your personal information goes. Protect it by contract when someone else handles it. Tell people about it. And if Quebec is involved, assess the destination before the information leaves. Hard residency rules do exist in a few places, but most companies meet the demand through a customer contract, not a law. Knowing which of those you are dealing with decides what you spend money on.
This is a map to help you ask better questions, not legal advice. If a contract or a regulator is putting the question to you, bring a lawyer into it.
PIPEDA allows transfers, with conditions
PIPEDA, the federal private-sector privacy law, has no residency rule. The Office of the Privacy Commissioner said so plainly in its guidelines on processing personal data across borders: "PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing."
Two conditions come with that permission.
The first is that you stay responsible. Principle 4.1.3 of the Act makes you accountable for information "transferred to a third party for processing," and says you "shall use contractual or other means to provide a comparable level of protection" while the vendor has it. Your hosting provider's contract is part of your privacy program whether you have read it or not.
The second is that you are open about it. The same OPC guidelines say organizations must tell customers that their information may be sent to another jurisdiction, and that while it is there "it may be accessed by the courts, law enforcement and national security authorities." That expectation comes from the regulator's guidance rather than the wording of the Act, and it is the one most privacy notices skip.
Those guidelines date from 2009. In 2019 the OPC floated a stricter position that would have required consent for cross-border transfers, then withdrew it after consultation and said the 2009 guidelines still apply.
Quebec's Law 25 asks for an assessment, not a ban
Quebec has the strictest rule in the country, and even there the rule is a process you follow. Section 17 of Quebec's private-sector privacy act, as amended by Law 25, opens with this: "Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment."
The assessment has to weigh four things: how sensitive the information is, what it will be used for, the protection measures that would apply (the contract included), and the legal framework in the place it is going. The information "may be communicated if the assessment establishes that it would receive adequate protection," and the transfer has to be covered by a written agreement. The same applies when you hand a company outside Quebec the job of collecting, using or keeping that information for you. The Commission d'accès à l'information lists this among the changes in force since September 2023.
Two details catch people out. The word is "may", so a transfer that passes the assessment is allowed. And the text says outside Québec, not outside Canada. On a plain reading, a server in Toronto is outside Québec, so a Montreal company using an Ontario-hosted tool for its clients' information owes the assessment too.
If you work on both sides of that border, our comparison of PIPEDA and Law 25 covers the wider differences.
Where residency is a real rule
There are fewer of these rules than the questionnaires suggest, and most apply to the public sector.
Nova Scotia. The province's Personal Information International Disclosure Protection Act requires public bodies, and their service providers, to make sure personal information "is stored only in Canada and accessed only in Canada." There are exceptions, including one the head of the public body can grant when storage or access outside Canada is needed for the body's operations. If you sell to the Nova Scotia public sector, this rule arrives in your contract.
British Columbia. BC used to have a residency rule for its public bodies and repealed it in 2021. Section 33.1 now lets a public body disclose personal information outside Canada "only if the disclosure is in accordance with the regulations," and the regulation asks for an assessment when sensitive information will be stored outside Canada. Anything you read that still cites the old section 30.1 is out of date.
Federal government. Treasury Board's Directive on Service and Digital, requirement 4.3.24, says computing facilities inside Canada must "be identified and evaluated as a principal delivery option" for information categorized as Protected B, Protected C or classified. That is a strong default rather than a flat ban. A vendor who wants the work has a much easier time with Canadian hosting.
Your own sector. Health, financial services and some regulated industries carry their own rules, and they change. Check the current rule with your regulator or your lawyer.
Most of the time, the requirement comes from your customers
Most private companies that get asked about residency are being asked by a customer. A public body passes its own rule down to its suppliers. An enterprise security team copies a residency clause into its vendor questionnaire because it is easier than reasoning about each vendor. A procurement form asks a yes-or-no question and nobody wants to be the one who answered no.
Federal buying is leaning the same way. The Buy Canadian Policy, announced in December 2025, directs departments to prioritize Canadian suppliers and Canadian content on purchases of $25 million and over, with plans to extend it to contracts of $5 million or more. Shared Services Canada has launched a procurement for "Sovereign Canadian Cloud capabilities" that prioritizes Canadian-owned and controlled providers. Neither one is a residency law for your company, and both show you where the big buyers are heading.
A residency clause you signed is binding on you as part of the contract, whether or not any law sits behind it. Read what it asks for before you price the fix. Storage only, or access too? Backups? The vendor's support staff logging in from another country? The other companies your vendor passes data to? Two clauses that both say "Canada" can cost very different amounts to meet.
Residency is not sovereignty
Where your data sits is one question. Who can be ordered to hand it over is another, and for many companies it is the more important one.
A Canadian region run by a provider with a US parent is still reachable by US courts. The CLOUD Act requires a provider to produce data in its "possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States." The OPC made the same point from the other direction back in 2009: "No contract can override the criminal, national security or any other laws of the country to which the information has been transferred."
That is the difference between residency and sovereignty. We argued the practical case for keeping sensitive data on your own infrastructure in why we keep recommending self-hosted, so there is no need to repeat it here. The same reasoning applies to AI tools that send your documents to a model in someone else's cloud, which we covered in AI compliance without sending your data to the cloud.
What to do on Monday
- List where your personal information actually sits. Include backups, the tools your staff sign into, and any vendor whose support team can reach your data. You will need the same list if you ever report a breach, and PIPEDA expects you to keep a record of every breach for 24 months.
- Pull every contract that mentions residency and write down exactly what each one asks for. Storage, access, backups, subcontractors.
- If you hold Quebec residents' information and it leaves Quebec, and a server in Ontario counts, run the section 17 assessment, write it down, and put the written agreement in place.
- Update your privacy notice to say information may be processed outside Canada, if it is. That is the OPC's expectation and it costs you an afternoon.
- Decide which data would hurt most if a foreign order reached it, and keep that data closest to home.
The data to keep closest
For most companies, near the top of that last list is their own security assessment. The policies, the configurations, the notes on which controls are missing. Put together, it is a map of where you are weak, and it is one of the easiest datasets to keep at home.
That is why NISTForge runs on your own servers. It reads your documents and quotes the passage behind every match, and the documents it reads and the findings it writes never leave your network. If you would rather have a person work through a Law 25 assessment or a residency clause with you, our team does that too.