Storing and processing data outside Canada

For organizations under PIPEDA, the short answer is yes. The Office of the Privacy Commissioner of Canada's (OPC) Guidelines for processing personal data across borders explain that Canada has taken an organization-to-organization approach rather than the 'adequacy' model used in the European Union. PIPEDA does not prohibit transferring personal information to an organization in another jurisdiction for processing. It holds the transferring organization accountable for protecting it.

The OPC also explains that a transfer for processing is a 'use' of the information, not a disclosure. If the information is used only for the purpose it was originally collected for, additional consent for the transfer is not required. PIPEDA does not distinguish between domestic and international transfers in this respect.

Other laws can be stricter. Quebec requires an assessment before personal information leaves the province, some public bodies restrict or condition storage outside Canada, and some contracts and professional rules add their own limits.

PIPEDA's accountability principle (clause 4.1.3 of Schedule 1) makes an organization responsible for personal information transferred to a third party for processing, and requires it to use contractual or other means to provide a comparable level of protection while the third party processes it. The OPC says 'comparable' means generally equivalent to the protection the information would have received if it had not been transferred, not identical in every respect.

The OPC also points out what a contract cannot do: it cannot override the laws of the foreign jurisdiction, including laws that let courts, law enforcement or national security agencies there access the information. PIPEDA does not require a measure-by-measure comparison of foreign law, but it does require organizations to consider all the circumstances. The OPC notes some information may be so sensitive that it should not be sent to a particular jurisdiction, or abroad at all.

• Confidentiality and use limited to your purposes
• Security controls appropriate to the sensitivity of the data
• Prompt breach notification to you, with defined content
• Restrictions and notice for sub-processors
• Your right to audit or receive assurance reports
• Return or deletion at the end of the contract
• How the provider handles foreign government access requests

The OPC expects organizations to make it plain to individuals that their information may be processed in a foreign country and may be accessible to the courts, law enforcement and national security authorities of that jurisdiction. This should be in clear and understandable language and, ideally, given at the time the information is collected. In practice, that means your privacy policy should name the countries or regions where data is stored or processed, or at least state that it may be processed outside Canada, and name the main types of service providers involved.

Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, goes further. Under section 17, before communicating personal information outside Quebec, an enterprise must conduct a privacy impact assessment that takes into account, in particular, the sensitivity of the information, the purposes for which it will be used, the protection measures (including contractual ones) that would apply, and the legal framework in the destination, including its privacy principles. The information may be communicated only if the assessment shows it would receive adequate protection, and the communication must be covered by a written agreement that reflects the assessment's results and any agreed mitigations.

The same rule applies when an enterprise entrusts someone outside Quebec with collecting, using, communicating or keeping information on its behalf. Note that 'outside Quebec' includes other Canadian provinces, so an Ontario-hosted system holding Quebec residents' data can trigger it.

Public bodies operate under different statutes, and the OPC's cross-border guidelines expressly do not cover them. Provincial and municipal institutions often set data-residency requirements by contract, policy or procurement rules, and some sectors, such as health and education, have their own expectations. If you supply services to a public body, assume data location will be asked about and may be a contract condition, and check the specific statute and policy that applies to that client.

1. 01

   Find out where your data actually lives

   In Microsoft 365, the admin centre shows the data location for your tenant's core services. In Google Workspace, data regions are a policy setting available only in certain editions. Record what you find in your data inventory.

2. 02

   Check what isn't covered

   Residency commitments often apply to data at rest for core services only. Add-ons, AI features, support access and third-party apps connected to your tenant may store or process data elsewhere.

3. 03

   Review the contract terms

   Read the provider's data protection addendum for sub-processors, breach notice and government-access commitments. Microsoft's Copilot documentation, for example, says Copilot is covered by the data residency commitments in its Product Terms and Data Protection Addendum.

4. 04

   Control third-party apps

   Restrict user consent to third-party apps, so staff can't quietly connect services that copy data offshore.

5. 05

   Update your notices

   Make your privacy policy accurate about cross-border processing.

6. 06

   Do the Quebec assessment where it applies

   Document the section 17 assessment and keep the written agreement with it.