Rules
Data residency and cross-border transfers for Canadian small businesses
What PIPEDA requires when a Canadian small business sends personal data, or uses an MSP or cloud service, outside Canada, and what the Cyber Centre baseline says to check.
What to take away
- PIPEDA does not ban storing or processing personal information outside Canada, and it has no list of approved countries. The Office of the Privacy Commissioner (OPC) says a transfer for processing is a use of the information, not a disclosure.
- Your business stays responsible for personal information it hands to a provider. The OPC expects a comparable level of protection, usually secured by contract.
- Customers should be told, in plain language, that their information may be processed in another country and may be accessible to that country's courts and authorities.
- The Canadian Centre for Cyber Security baseline for small and medium organizations asks you to assess the legal jurisdictions and the physical location of data centres and administrators used by outsourced providers.
- Provincial privacy laws, including Quebec's, may add rules. Check the law that applies where your customers live.
Data residency is a business decision, not a federal rule
Many owners assume Canadian personal data must stay in Canada. For a private-sector small business covered by PIPEDA, the OPC's guidelines on processing personal data across borders say otherwise. PIPEDA does not prohibit transferring personal information to a processor in another country and does not apply an adequacy test to the destination.
What changes is the work you owe. The OPC states that an organization remains responsible for personal information in its possession or custody, including information transferred to a third party for processing. It must use contractual or other means to provide a comparable level of protection while the information is being processed. "Comparable" means generally equivalent, not identical.
So residency is a risk question. Where the data sits, who can reach it and under whose laws all affect the risk. The OPC adds that some transfers may be unwise, and that highly sensitive information may not belong in any foreign jurisdiction.
What an MSP or cloud provider changes
A managed service provider (MSP) often has administrator access to your systems, mailboxes and backups. That access can sit in a different country from the servers. Both facts count.
The Cyber Centre's baseline controls for small and medium organizations, written for organizations with fewer than 499 employees, include a group on cloud and outsourced IT. Among them:
- Assess your comfort with how outsourced providers handle and access sensitive information (BC.10.2).
- Assess your comfort with the legal jurisdictions where providers store or use sensitive information (BC.10.3).
- Ask cloud providers for an AICPA SSAE 18 SOC 3 report, and if they cannot supply one, consider other providers (BC.10.1).
- Require two-factor authentication for cloud administrator accounts, kept separate from internal admin accounts (BC.10.5).
The document also lists items to consider with each provider: privacy and data-handling policies, notification when private data is accessed without authorization, destruction of data at the end of the contract, the physical location and security of outsourced data centres, and the physical location of outsourced administrators.
Those last two items are the practical core of data residency. A provider may host your data in Toronto and support it from a team elsewhere. Ask for both answers in writing.
Put the protection in the contract
Contractual protection is how the OPC expects a comparable level to be achieved. In practice the OPC says the organization should take reasonable steps to prevent unauthorized use and disclosure, confirm that the processor has policies, staff training and effective security measures, and keep the right to audit how the processor handles and stores the data, using that right when warranted.
A short contract checklist for an MSP or cloud vendor:
- Name the countries where data is stored, processed and backed up, and where administrators work.
- Limit use of the data to the purposes needed to deliver the service.
- Require notice before the location or a subcontractor changes.
- Require the provider to tell you promptly about a breach and to give you what you need to assess it.
- Set out return or secure destruction of data when the contract ends.
- Reserve audit or inspection rights, or at least the right to receive current assurance reports.
The same questions appear in the site's guide to a vendor risk assessment for small business and the vendor security review for Vancouver importers, which uses a worked example.
The OPC also makes a point owners overlook: no contract can override the criminal, national security or other laws of the country where the information is processed. A clause cannot stop a foreign authority from lawfully asking for data held there. That is why jurisdiction belongs in the assessment, not only in the paperwork.
Tell customers
The OPC says organizations must tell people, in clear language and ideally at the time of collection, that their information may be processed in another jurisdiction and may be accessible to that country's courts, law enforcement and national security authorities. For a small business, this is usually a short paragraph in the privacy notice, written to match what the provider actually does.
Update the notice when you change provider. A notice that says "Canada only" while a support team abroad can open the records is the kind of mismatch that causes complaints.
Breaches at a provider
If the provider has a breach, the duty to report usually sits with you. The OPC's guidance on mandatory breach reporting says the organization that transferred the data to a processor is generally responsible for reporting, notifying and record-keeping, and should have contracts with the processor covering these obligations. Control is assessed case by case.
The reporting test under PIPEDA is a breach of security safeguards involving personal information under your control that poses a real risk of significant harm. You assess the sensitivity of the information and the probability it will be misused. When the risk exists, you report to the OPC and notify affected individuals as soon as feasible after determining it.
Keep a record of every breach, including those that do not meet the threshold. The OPC says to keep these records for two years, or longer if other laws require it. Your provider must therefore tell you about incidents you might judge to be minor, not only the serious ones. Pair this with an incident response plan that names who calls whom.
Backups and the location question
Backups travel too. A cloud backup can be replicated to another region by default. Your backup and recovery settings should state the region, and the vendor's documentation should confirm it. The Cyber Centre baseline calls for backups of essential systems with tested restores, long-term copies stored offline and offsite, and encryption with restricted access.
Encryption helps with exposure but does not remove the location question. Keys held by the provider, or by a provider employee in another country, put you back in the same risk assessment.
A practical sequence for a small business
- List the personal information you holdcustomers, staff, suppliers. Note the sensitive items.
- List every provider that stores or touches it, including email, accounting, payroll, CRM, backup and your MSP.
- For each, record where the data sits, where support staff work, and what the contract says.
- Decide what you accept. For highly sensitive data, consider a Canadian-hosted option.
- Update the privacy notice and the contract terms to match what you decided.
- Review once a year or when a provider changes hosting, ownership or subcontractors.
Neither the OPC nor the Cyber Centre sets one answer for every business. The standard is that you looked, decided, wrote it down and can show it. Provincial law may add duties, and Quebec's private-sector privacy law in particular has its own requirements for communicating personal information outside Quebec, so a business with Quebec customers should confirm them before moving data. For fraud and scam reports specific to small firms, see the guide on Canadian Anti-Fraud Centre data for Alberta small businesses.
This article is general information, not legal advice.
