Location is one dimension
Residency describes where data is stored or processed. Sovereignty also raises questions of jurisdiction, control and dependence. The federal white paper on data sovereignty and public cloud examines these issues in the Canadian government context.
Examine actual flows
We recommend asking where primary data, backups, logs and information sent to support are located. Also review subcontractors, administrator access and key management. Selecting a “Canada” region does not automatically answer every question.
For businesses subject to Quebec requirements, the CAI describes conditions for communicating personal information outside Quebec, including a privacy impact assessment. These requirements should not become a blanket claim that all data held by every Canadian business must remain in Canada.
Plan the exit
We advise testing data exports, documenting formats and estimating migration costs. Ask what is deleted when the contract ends, within what timeframe and with what evidence. These details make control over the service more concrete than a marketing claim about sovereignty.
Sources and features may change. Check the current version when planning your project.
All articles ↗