Data sovereignty.

Sovereignty is about control and jurisdiction, not only geography. The US CLOUD Act requires a provider to produce data in its "possession, custody, or control" wherever that data is stored, so a Canadian hosting region does not by itself keep data out of US reach. Most Canadian private-sector organizations are not required by law to keep data in Canada. PIPEDA allows transfers abroad as long as the organization stays accountable, protects the data by contract, and is open about it. Law 25 in Quebec requires a privacy impact assessment, adequate protection and a written agreement before personal information leaves Quebec, which is a process rather than a ban. Hard residency rules apply in narrower places, such as Nova Scotia public bodies and their service providers, and federal Protected B data, where Canadian facilities are the default option. Most companies meet a residency requirement through a customer contract. Practical responses include Canadian-headquartered providers, self-hosted infrastructure, or keeping the most sensitive data on premises.