Canadian data residency and cloud regions: PIPEDA, Quebec Law 25 and what it costs

For most private-sector businesses in Canada, no general law requires personal information to be stored in Canada. Under PIPEDA you may use a provider that processes data abroad, but you remain accountable for it, must protect it by contract and should tell people their information may be processed in another country. Quebec adds a firm step: before personal information is communicated outside Quebec, an enterprise must carry out a privacy impact assessment and put a written agreement in place. Stricter location rules come mainly from public-sector laws, sector regulators and contracts. Choosing a Canadian region can simplify these obligations, and it can change the price.

This guide is part of the pricing overview. It is general information, not legal advice.

PIPEDA: accountability for processors

PIPEDA's Schedule 1 sets out ten fair information principles. Principle 4.1.3 says an organisation is responsible for personal information in its possession or custody, including information transferred to a third party for processing, and must use contractual or other means to provide a comparable level of protection while the third party processes it.

The Office of the Privacy Commissioner of Canada's Guidelines for processing personal data across borders (2009) explain how that works in practice:

• PIPEDA does not prohibit transferring personal information to a processor in another country.
• A transfer for processing is treated as a use for the original purpose, so it does not need new consent, but organisations must make it plain to individuals that their information may be processed in a foreign country, ideally when it is collected.
• The contract is the main tool: it should require security safeguards, limit use to your purposes and let you check compliance.
• No contract can override foreign law: information held abroad may be accessible to that country's courts, law enforcement and national security authorities, and organisations should weigh that risk, particularly for sensitive information.

Note that a provider with a Canadian data centre may still be subject to foreign laws through its parent company, and support staff abroad may access systems. Ask where support, logs and backups are handled, not only where the primary servers are.

Quebec Law 25: assessment before data leaves Quebec

Quebec's private-sector privacy Act, as amended by Law 25, requires since 22 September 2023 that an enterprise conduct a privacy impact assessment before communicating personal information outside Quebec, including when it entrusts a service provider outside Quebec with holding or processing it (section 17 of the Act respecting the protection of personal information in the private sector). The assessment considers, among other things, the sensitivity of the information, the purposes, the protection measures (including contractual ones) and the legal framework of the place where it will go, including the personal information protection principles that apply there; the CAI's guide on privacy impact assessments lists the same factors. The communication may proceed if the assessment shows the information would receive adequate protection, and it must be covered by a written agreement.

Practical consequences for hosting:

• "Outside Quebec" includes other Canadian provinces, not only other countries. A Toronto region is outside Quebec for this purpose.
• Keep the assessment on file; the Commission d'accès à l'information (CAI) can ask for it.
• If the assessment is a burden, a host or region in Quebec may be the simpler choice for Quebec personal information.

Public bodies and regulated sectors

British Columbia's FOIPPA applies to public bodies (ministries, municipalities, health authorities, school boards, universities and others), not to private businesses. The former requirement that personal information be stored and accessed only in Canada (sections 30.1 and 30.2) was repealed in 2021; disclosure outside Canada must now follow any regulations made by the minister. If you are a supplier to a BC public body, the contract may still impose location and access conditions.

Nova Scotia's Personal Information International Disclosure Protection Act (S.N.S. 2006, c. 3) sets rules on storage of, and access to, personal information outside Canada for public bodies, municipalities and their service providers. The head of a public body can allow storage or access outside Canada when it is needed for the body's operations, subject to conditions, and must report those decisions to the Minister of Justice each year. Check the Act and the contract if you supply Nova Scotia public bodies.

Federal government suppliers, health information custodians under provincial health privacy laws, and federally regulated financial institutions can face location or outsourcing requirements in contracts, guidelines or provincial statutes. Check with the contracting authority, regulator or your lawyer.

Canadian cloud regions

The large public clouds operate regions in Canada. As listed in each provider's own documentation in October 2026:

Many Canadian hosting companies and colocation providers also run data centres in Canada. Region lists change; check the provider's current documentation.

How location affects price

• Regional rates: providers price each region separately. A Canadian region may cost more than the cheapest US region for the same machine.
• Service availability: some newer services, instance types or GPUs may not be available in every Canadian region, pushing you to a larger or different size.
• Redundancy within Canada: if you need a second region for disaster recovery and want it in Canada, your choice is narrower, and inter-region transfer is charged; see egress and data transfer.
• Compliance work: a non-Canadian region may be cheaper per hour but cost more in assessments, notices and contract review.

Illustrative example. A VM costs an illustrative $0.11 an hour in a Canadian region and $0.10 in a US region: 730 × $0.01 = $7.30 a month difference per VM. For a five-VM set-up, $36.50 a month, about $438 a year. Compare that with the cost of a Quebec privacy impact assessment, extra contract review or customer concerns. For many small businesses the Canadian region is worth the difference; for others the gap is larger. Run the numbers.

Checklist

• Map which systems hold personal information and whose (Quebec residents?)
• Confirm primary region, backup region, log storage and support access locations
• Update the privacy notice if any processing is outside Canada
• Sign a contract with security, use-limitation, breach-notification and audit clauses
• Complete a Quebec privacy impact assessment where required
• Check public-sector, sector-regulator and customer contract requirements

The full selection list is in the best-fit checklist. Who secures what in the cloud is covered in shared responsibility and the Cyber Centre's guidance, and the cost side of choosing a region in cost estimates.

FAQ

Is a Canadian data centre enough to keep data "in Canada"?

Not always. Backups, replicas, logs, support access and the provider's parent company can all sit outside Canada. Ask the provider where each happens and what the contract says.

Does PIPEDA apply in Quebec, Alberta and BC?

Those provinces have private-sector privacy laws that are considered substantially similar, and they generally apply to organisations' activities within the province, while PIPEDA continues to apply to federal works and to cross-border transfers in many cases. If you operate in several provinces, ask a lawyer which laws apply to which data.

Is federal privacy reform in force?

The earlier Bill C-27 died when Parliament was prorogued in January 2025. A newer privacy bill, Bill C-36 (Protecting Privacy and Consumer Data Act), was introduced on 15 June 2026; in October 2026 LEGISinfo showed it at second reading in the House of Commons, so it is not law. Check the Office of the Privacy Commissioner and LEGISinfo for the current status.

Sources

• Office of the Privacy Commissioner of Canada — PIPEDA and the guidelines for processing personal data across borders
• Justice Laws Website — PIPEDA, Schedule 1, Principle 4.1.3
• Commission d'accès à l'information du Québec — Law 25, communication of personal information outside Quebec
• BC Laws — Freedom of Information and Protection of Privacy Act
• Government of Nova Scotia — Personal Information International Disclosure Protection Act and regulations
• LEGISinfo — status of federal bills, including Bill C-36
• Canadian Centre for Cyber Security — cloud security risk management