contact@ffxf.net
Console
No Quebec or federal law requires a private business to host its data in Canada. Law 25 and PIPEDA ask for something else: know where personal information goes, assess the protection it will get there, and be able to show that you did. Where your servers run mostly decides how much work that takes. And a server "in Canada" does not settle the question if the company running it answers to US law.
Sector or contract rules (public bodies, health care, government contracts) sometimes go further. This article covers the general case: a small business or a developer hosting customer data.
This is not legal advice. It summarizes laws and official guides, linked below, as they stood in mid-October 2026. For a specific case, talk to a lawyer or to Quebec's Commission d'accès à l'information.
1. What Law 25 requires when data leaves Quebec
Law 25 rewrote Quebec's Act respecting the protection of personal information in the private sector. Its section 17, in force since September 22, 2023, requires a privacy impact assessment (PIA, EFVP in French) in two cases:
- before communicating personal information outside Quebec;
- before entrusting a person or body outside Quebec with collecting, using, communicating or keeping that information on your behalf.
The second case is hosting. Renting a server or a cloud service outside Quebec means someone outside the province keeps your data. The PIA guide of the Commission d'accès à l'information (CAI), the Quebec regulator, gives "storing personal information in the cloud outside Quebec" as a typical example.
The assessment must take into account, among other things:
- how sensitive the information is;
- the purpose of its use;
- the protection measures, including contractual ones, it would benefit from;
- the legal framework of the place where it would go, including its privacy principles.
You may go ahead if the assessment shows the information would receive adequate protection, measured against generally recognized privacy principles. The transfer then needs a written agreement that reflects the assessment and, where needed, adds measures to reduce the risks it found. If the protection would not be adequate, the CAI guide is plain about it: you must not send the data.
Two details often change the decision.
- Another province is also outside Quebec. A server in Toronto needs the same assessment as a server in Virginia. The conclusion will likely be simpler for Ontario, which falls under federal law, but you still have to do it.
- The assessment is proportionate. The CAI asks you to scale it to the sensitivity of the information, its purpose, its quantity, how widely it is spread and the medium it is on. The law sets neither the method nor the format of the report. An online store's customer list does not call for the file health records would, but a written assessment, even a short one, is still the best proof that you did it.
Hosting in Quebec does not remove every assessment. Section 3.3 of the same Act requires a PIA for any project to acquire, develop or overhaul an information system that handles personal information, wherever it is hosted. Moving your application to a new host counts. The assessment is simply shorter when the data stays in the province.
2. What a failure costs
Since September 22, 2023, the CAI can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, whichever is higher, without going to court. Penal fines, imposed by a court, can reach $25 million or 4% of worldwide turnover. These are maximums, and the percentage only exceeds $10 million for very large companies. Before it gets there, the CAI can investigate and issue orders, and rebuilding an assessment after the fact costs time either way.
3. PIPEDA: accountable wherever the data is
The federal law applies to private organizations that handle personal information in the course of commercial activity. Quebec, Alberta and British Columbia have laws deemed substantially similar, and businesses there are generally exempt for activities within their province. Once personal information crosses a provincial or national border, though, PIPEDA applies, whatever province the business is in.
PIPEDA does not forbid transfers. The Privacy Commissioner's guidelines for processing personal data across borders say so directly. The organization stays responsible for information it hands to a third party, in Canada or abroad, and must use a contract or other means to get a comparable level of protection. It must also tell its customers that their information may be processed in another country and may be accessed there by the courts, law enforcement and national security authorities.
Reform is under way. Bill C-27 died on the order paper in January 2025. Its successor, Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, was tabled on June 15, 2026. According to Torys' analysis, it would require, among other things, a privacy impact assessment before transferring personal information outside Canada, close to Law 25's approach. As of mid-October 2026 it had only passed first reading, so PIPEDA is still the law.
4. The CLOUD Act: a server in Canada is not enough
Passed in 2018, the CLOUD Act added a rule to the US Stored Communications Act. In the words of the US Department of Justice FAQ, providers subject to US jurisdiction must disclose data responsive to valid US legal process that is in their possession or control, regardless of where they store it.
A US provider that opens a region in Montréal or Toronto is therefore still bound by that rule for the data stored there. The server is in Canada; the company that controls it can be compelled by a US court.
The same document says US jurisdiction is not limited to US companies. It depends on a company's contacts with the United States, case by case. For the foreign subsidiary of a US group, the question is whether the parent controls the data. A Canadian host with no US operations is far less exposed, but that is a matter of facts, not labels.
Canada and the United States announced talks in March 2022 on a bilateral CLOUD Act agreement. The Department of Justice lists no signed agreement to date. The CLOUD Act covers criminal investigations; US intelligence gathering falls under other laws.
For your assessment, the legal framework that applies to your provider is part of the analysis. If your contract is with a foreign entity, or if people can reach the data from abroad, have your case reviewed: the border that matters is not always the one around the data centre.
5. A server in Canada or a Canadian company
| Situation, for a Quebec business | Section 17 assessment | CLOUD Act reach |
|---|---|---|
| US provider, servers in the US | yes | yes |
| US provider, Canadian region | yes outside Quebec; have it reviewed in Quebec (contract, access from abroad) | yes |
| Canadian company, servers in Ontario | yes | depends on its US ties |
| Quebec company, servers in Quebec | not for the hosting itself; section 3.3 still applies | depends on its US ties |
6. What to ask a host
- Which city is the data stored in, backups included? "In Canada" is not enough for Law 25.
- Which legal entity signs the contract, and where is it registered? For a Quebec business, one search in the Registraire des entreprises confirms it.
- Does the host have a parent company, subsidiaries or operations in the United States?
- Who can access the data, and from which country: support, administrators, subcontractors?
- Which subcontractors outside Quebec receive personal information, and which ones?
- What does the contract say when an authority asks for your data?
- After a confidentiality incident, how fast will you be told? Since September 2022, Law 25 requires you to notify the CAI and the people affected when an incident presents a risk of serious injury.
Keep the answers: they are half of your assessment.
7. What we can say about FFxF
FFxF is a sole proprietorship registered in Quebec (NEQ 2282145301) and based in Montréal. Our machines are in Montréal, on our own network (AS402554), and we bill in Canadian dollars. For a Quebec business, the machines, their disks and their backups stay in Quebec: section 17 does not come into play for the hosting itself, and the section 3.3 assessment is shorter for it.
As our privacy policy states, we do not access the content of your machines: you are responsible for the personal information you host on them, and we are the host. Some of our service providers, for payments, transactional email and domain names, process account data outside Quebec; the list is available on request. None of them receives the content of your machines.
Being a Quebec company is not immunity: we comply with valid court orders, like any business here. Full contact details and registration are on the About page.
