Data Residency in Canada: What Law 25 and PIPEDA Actually Require (2026)
- No general law bans storing Canadian personal data outside Canada. Some sectors and contracts do require local storage.
- Quebec's Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec, plus a written contract. "Outside Quebec" includes other Canadian provinces.
- Under PIPEDA you stay accountable for data a provider processes for you and must give comparable protection by contract and be transparent about it.
- Choosing a Canadian cloud region helps, but it is not by itself a compliance answer.
Residency, sovereignty and transfer: three different ideas
| Term | Plain meaning | Why it matters |
|---|---|---|
| Data residency | The physical place where data is stored | Sets which servers and regions hold your data |
| Data sovereignty | Whose laws can reach the data | A foreign provider can be subject to foreign legal demands even if the servers are in Canada. Take legal advice if this risk matters to you. |
| Cross-border transfer | Communicating, storing or giving access to personal information outside a jurisdiction | Triggers assessment and contract duties, including remote access and service providers |
Quebec Law 25: transfers outside Quebec, step by step
Law 25 amended Quebec's Act respecting the protection of personal information in the private sector. The transfer rule is in section 17 of that Act. The Act is published on LegisQuébec, and the summary below follows the law firm analysis in BLG's article on cross-border transfers. Confirm the exact wording with counsel.
- Identify the transfer. Any communication of personal information outside Quebec counts, including entrusting a service provider and giving remote access. Other provinces count as outside Quebec.
- Complete a privacy impact assessment before the transfer. Consider how sensitive the information is, why it is being used, the protection measures including contractual ones, and the legal framework of the destination, judged against generally recognized principles of personal information protection.
- Conclude the information would receive adequate protection. If not, do not transfer it.
- Sign a written agreement that reflects the assessment's results and any mitigation measures. For service providers, the Act expects contract terms on confidentiality, use only for the mandate, no retention afterwards, incident notice and verification.
- Tell people. Separate from the assessment, you must inform individuals at collection about the possibility that their information may be communicated outside Quebec.
One practical consequence: choosing a "Canadian region" does not make the question disappear for a Quebec business whose provider hosts in Ontario. It does make the legal framework easier to assess than a destination in a country with different laws.
PIPEDA and processing across borders
PIPEDA allows organizations to use service providers, including outside Canada, but the organization remains accountable. The Office of the Privacy Commissioner's guidelines for processing personal data across borders explain that you must use contracts or other means to provide a comparable level of protection and be transparent that information may be processed in another jurisdiction and may be accessible to that country's authorities. See our PIPEDA checklist.
When local storage is effectively required
Outside privacy statutes, residency requirements usually come from sector rules, public-sector procurement or customer contracts. Examples to check, not conclusions: provincial health information rules, rules for public bodies and their suppliers, and contract clauses from banks, governments or large corporate clients. Several provinces have had or have specific rules for public-sector or health data, so confirm the current law in your province and sector before assuming either way.
If a client contract says "Canadian data residency", clarify whether it means storage only, support access, backups and logs as well, and whether Canada, Quebec or a named region is required.
How to check where your tools store data
- Microsoft 365. Check your tenant's data location in the Microsoft 365 admin center and read Microsoft's data locations documentation. Microsoft lists Canada as a geography with Advanced Data Residency options for core services such as Exchange Online, SharePoint, OneDrive and Teams, and lists some other services separately without the same commitments. Read the current list for the services you use. See also Microsoft 365 pricing in Canada.
- Google Workspace and Google Cloud. Google publishes a Law 25 compliance page and regional options. Check what applies to your edition.
- Other SaaS, payroll, CRM, accounting and AI tools. Read the vendor's data processing terms and sub-processor list, and ask support to confirm the storage region in writing. We have not verified the regions of other vendors, so we do not list them here.
Vendor data-flow table (copy and complete)
| Tool | Personal information held | Storage region | Support access from | Sub-processors reviewed | PIA done and date | Contract signed |
|---|---|---|---|---|---|---|
| [Email and files] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| [CRM or client system] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| [Payroll, accounting, backup, AI tools] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
Privacy impact assessment mini-template
A short, structured record is better than none. Adapt these ten headings, and have a lawyer review the first one you complete.
- Project and owner: what the tool does, who is responsible, date.
- Personal information involved: categories, volume, sensitivity.
- Purposes: why the information is collected and used.
- Data flow: where it is collected, stored, accessed from and backed up.
- Recipients and sub-processors: who else handles it.
- Destination legal framework: the privacy laws and government access rules where it ends up, and your assessment of them.
- Safeguards: encryption, access control, logging, contract terms.
- Risks and mitigations: what could go wrong and what you will do.
- Conclusion: whether the information would receive adequate protection, and the decision.
- Review date: when you will reassess, and after which changes.
Vendor contract checklist
- ☐ Personal information is used only to deliver the service
- ☐ Confidentiality obligations bind the vendor and its staff
- ☐ Data is deleted or returned when the contract ends
- ☐ The vendor must notify you promptly of any incident
- ☐ You can verify compliance and review sub-processors
- ☐ Storage and support-access locations are stated
- ☐ Changes to location or sub-processors require notice
Common mistakes
- Assuming a Canadian vendor needs no assessment. A vendor hosting in another province is still outside Quebec for a Quebec business.
- Ignoring sub-processors and support access. Data can be viewed from another country even if it is stored in Canada.
- Copying a European template. GDPR concepts differ from Quebec's rules, and a GDPR-style 72-hour breach deadline is not Quebec's rule. Quebec says to report promptly.
- One assessment for everything. New tools, including new AI features, need their own review.
- No notice to individuals. Say in your privacy policy where information may be communicated.
Action checklist
- ✅ List every tool that stores or accesses personal information
- ✅ Record the storage region, support access and sub-processors for each
- ✅ Complete and file a privacy impact assessment before transfers outside Quebec
- ✅ Put the required terms in a written contract
- ✅ Update your privacy policy to mention possible transfers
- ✅ Check sector and client contract rules for local storage
- ✅ Review each year and when a tool changes
Related: privacy officer guide, Law 25 penalties, Law 25 for small business. Need help mapping your tools? IT Cares can help review your cloud setup.
Frequently asked questions
Does data have to be stored in Canada?
Not as a general rule. Neither PIPEDA nor Law 25 bans storage abroad, but both require safeguards, accountability and transparency. Some sectors, public bodies and customer contracts do require Canadian storage, so check the rules that apply to you.
Does Law 25 require data to stay in Quebec?
No. It requires you to complete a privacy impact assessment before communicating personal information outside Quebec, to conclude that it would receive adequate protection, and to have a written agreement that reflects the results. The assessment considers the sensitivity of the information, the purposes, the protection measures including contractual ones, and the legal framework in the destination.
Do I need a privacy impact assessment to use Microsoft 365?
If you are in Quebec and personal information will be communicated outside Quebec, including through remote access or a service provider, the assessment is required before the transfer. One well-documented assessment of your tenant, its data location and the provider's terms is a practical starting point. Ask your lawyer to confirm for your case.
Is an Ontario data centre a transfer for a Quebec business?
Under the Quebec rules as practitioners read them, yes. The wording is outside Quebec, which covers other provinces as well as other countries. Storing data in Quebec, or accessing Quebec-hosted data from Quebec, is generally not a transfer.
What must my cloud vendor contract say?
For a service provider handling personal information, Law 25 expects a written contract covering confidentiality, use only for the mandate, no retention after the contract ends, notice to you of any incident, and your right to verify. Check the exact wording in the Act with counsel.
What about ChatGPT and other AI tools?
Treat them like any other service provider. If staff paste personal information into a tool hosted outside Quebec, that can be a communication outside Quebec that needs an assessment, a contract and clear notice. Set a policy on what may be entered.
Where does Microsoft 365 store Canadian data?
Microsoft documents Canada as a geography with Advanced Data Residency options for its core services, with data centre regions in Toronto and Quebec City according to its documentation. Some supporting services are listed separately without the same commitments, so read Microsoft's data locations page and check your tenant settings.
What are the penalties under Law 25?
Law 25 provides for administrative monetary penalties and penal fines for serious failures. We do not restate figures here because they should be confirmed against the Act and the Commission d'accès à l'information. See our Law 25 penalties guide for what we have verified.
Get a free assessment
Tell us where you are, we send back a clear, no-pressure plan. Leads only, no payment.