Canadian Data Sovereignty
PIPEDA, .ca, in-country hosting rationale.
Learning objectives
- Explain Canadian data residency and sovereignty concerns for SMBs
- Understand PIPEDA basics and provincial health/education nuances
- Evaluate hosting providers for Canadian presence and subprocessors
What is data sovereignty?
Data sovereignty asks: where does my data physically live, which country's laws apply, and who can compel access? Workshop Co. stores customer names, emails, and payment references in PostgreSQL — Alberta residents booking Edmonton classes. Marcus needs clarity even if he is not a lawyer.
Choosing a Montreal or Toronto VPS keeps primary data on Canadian soil. That does not automatically make you compliant — but it aligns with customer expectations and many RFP requirements from Canadian schools and municipalities.
PIPEDA in practical terms
The Personal Information Protection and Electronic Documents Act (PIPEDA) governs private-sector handling of personal information in federal scope. Practical obligations for Workshop Co.:
- Collect only what booking requires (name, email, phone)
- Protect data with reasonable safeguards (encryption, access control)
- Know where data is stored and which vendors process it (Google, Stripe, Swift Host)
- Breach notification and accountability — document policies
Alberta also has provincial privacy law (PIPA) for private organizations — overlap exists; when in doubt, consult qualified counsel for your sector.
Worked example — vendor map
| Vendor | Data | Region | Notes |
|---|---|---|---|
| Proxmox on-prem | Full booking DB | Edmonton, AB | Marcus responsible for physical security |
| Swift Host VPS | Encrypted backups | Montreal, QC | DPA in contract; Canadian entity |
| Google Workspace | Staff email, some docs | Global infra | Google DPA + data region settings |
| Stripe | Payment tokens | US + global | PCI handled by Stripe; minimize local card storage |
| Calendly | Appointment metadata | US SaaS | Consider Canadian alternative if policy requires |
Questions to ask Canadian hosts
- Where are servers physically located (city, province)?
- Are backups and snapshots in the same region?
- Who are subprocessors (CDN, DDoS scrubbing)?
- Can data be processed only in Canada?
- What happens on US subpoena vs Canadian court order?
100% Canadian-only stack is rare for email and payments. Document trade-offs: keep authoritative customer DB in Canada; use global SaaS only where necessary with contracts and minimal data fields.
.ca and sovereignty are different
Owning workshopco.ca (CIRA) signals Canadian presence but does not determine where servers live. DNS can point anywhere on earth — sovereignty is about compute and storage location, not TLD.
Try it yourself
Workshop Co. considers moving primary DB to Swift Host Montreal. List three sovereignty benefits and two risks vs keeping DB in Edmonton.
Sample answers
Benefits: professional datacenter power/cooling, Canadian jurisdiction clarity, off-site from single basement flood risk.
Risks: data transits internet to cloud (encrypt in transit), latency vs local LAN apps, monthly cost vs owned hardware.
Check your understanding
- Does hosting in Canada automatically satisfy all PIPEDA requirements?
- Why document subprocessors in a privacy policy?
Answers
- No — you still need security, consent, retention limits, and breach processes.
- Transparency obligation — customers should know who processes their personal information.