Data Sovereignty In Canada By Province

Legislative and legal federal framework

Hard localization fixes data within Canadian borders by law.
Qualified localization lets data travel so long as the controller proves it remains just as well protected abroad. Foreign ownership can pierce Canadian hosting, such as laws as the American CLOUD Act, which enacts the right for the US to access data outside of its territory if it is stored by an American company.

The Canadian baseline for data sovereignty at the federal level is the Personal Information Protection and Electronic Documents Act (PIPEDA) which still governs private‑sector privacy across Canada pending passage of Bill C‑27 (CPPA).

Bill C‑27, officially the Digital Charter Implementation Act, seeks to introduce Canada’s first horizontal AI statute. C‑27 died on the Order Paper in January 2025 but the government has signalled an intent to put back the law on the table. As of July 22, 2025 no new bill has appeared.

Would replace PIPEDA with the Consumer Privacy Protection Act (CPPA), adding GDPR‑style rights such as erasure, data mobility, and algorithmic explanation, plus administrative fines up to the greater of CA $10 million or 3 % of global revenue.
Would create a Personal Information and Data Protection Tribunal to hear appeals from the Privacy Commissioner and impose those penalties.
Would enact the Artificial Intelligence and Data Act (AIDA), a risk‑based regime for “high‑impact” AI systems that required impact assessments, bias mitigation and incident reporting, backed by similar fine levels.

Provincial/territorial legislative and legal frameworks

Provinces with “substantially similar” private‑sector statutes (AB, BC, QC) which supersede PIPEDA for local operations.

Alberta

Key laws: Personal Information Protection Act (PIPA – private sector), Protection of Privacy Act (POPA, modernized public‑sector privacy, in force since June 11, 2025).
Localization: No blanket data‑residency mandate. Outsourcing requires reasonable safeguards and transfer assessments.

British Columbia

Key laws: Freedom of Information and Protection of Privacy Act (FIPPA – public bodies) and Personal Information Protection Act (PIPA – private sector).
Localization: 2021 amendments removed the public‑sector in‑Canada storage mandate. Transfers are allowed, and subject to privacy impact assessment (PIA) and contractual safeguards.

Québec

Key law: Act respecting the protection of personal information in the private sector, overhauled by Law 25.
Localization: Cross‑border transfers (even inter‑provincial) require a privacy impact assessment (EFVP) and “essentially equivalent” protection.
Provinces with NO “substantially similar” private‑sector statutes

Manitoba

Key law: Personal Health Information Act (PHIA).
Localization: PHIA imposes disclosure controls but not a categorical residency rule.

New Brunswick

Key laws: Right to Information and Protection of Privacy Act (RTIPPA) and Personal Health Information Privacy and Access Act (PHIPAA).
Localization: PHIPAA allows out‑of‑country disclosure only with comparable protection measures.

Newfoundland & Labrador

Key laws: Personal Health Information Act (PHIA), Access to Information and Protection of Privacy Act, 2015 (ATIPPA).
Localization: No across‑the‑board residency rule, but PHIA requires policies and safeguards for extra‑jurisdictional hosting.

Northwest Territories

Key laws: Health Information Act (HIA), ATIPP for public bodies.
Localization: HIA uses information‑management agreements to manage extra‑territorial storage.

Nova Scotia

Key laws: Personal Information International Disclosure Protection Act (PIIDPA) and FOIPOP.
Localization: PIIDPA generally prohibits public bodies/service providers from storing or accessing personal information outside Canada unless an exception applies.

Nunavut

Key law: Access to Information and Protection of Privacy Act (ATIPPA – Nunavut).
Localization: No strict residency rule, though stronger privacy supports are under discussion.

Ontario

Key laws: Personal Health Information Protection Act (PHIPA), FIPPA / MFIPPA for public bodies.
Localization: No explicit in‑Canada requirement, compliance hinges on safeguards and contractual controls.

Prince Edward Island

Key law: Freedom of Information and Protection of Privacy Act (FOIPP).
Localization: No categorical residency rule; cross‑border disclosures must be authorized and safeguarded.

Saskatchewan

Key laws: The Health Information Protection Act (HIPA) plus FOIP for public bodies.
Localization: No outright ban on extra‑Canada hosting, but section 18 of the HIPA requires an information‑management agreement (IMA) with any service provider handling PHI.

Yukon

Key law: Health Information Privacy and Management Act (HIPMA) plus ATIPPA for public bodies.
Localization: HIPMA controls transfers but does not impose a strict residency mandate.

The distinct case of Quebec

Québec now operates the strictest, most comprehensive cross‑border regime in Canada.

September 22, 2023: Every transfer of personal information outside Québec, including to another province, must undergo a privacy‑impact assessment addressing (EFVP/TIA) that weighs sensitivity, purpose, safeguards and crucially, the legal regime applicable in the receiving jurisdictions, be it another province, state, or country. The transfer can proceed only if the exporting organisation concludes that the destination offers protection “essentially equivalent” to Québec law and embeds those safeguards in a written contract. 
These obligations, added by Law 25, apply to all private‑sector entities and to public bodies alike, and are backed by administrative fines that can reach the greater of CA $10 million or 2 % of worldwide revenue (up to CA $25 million/4 % for penal offences).

Conclusion

Across Canada, the usual approach is “qualified” rather than “hard” localisation. Organisations can outsource or move data so long as they ensure “comparable protection” through contracts and security safeguards, with Québec standing alone in requiring a “hard” formal, documented adequacy finding, and imposing GDPR‑style penalties if they get it wrong.

No other province pairs a blanket, private‑sector transfer‑assessment duty with an equivalency test, which makes Quebec the only province to provide a comprehensive “data sovereignty” on cross-borders transfers of personal data among all the Canadian jurisdictions. Nova Scotia’s PIIDPA is also “harder” than the rest of the provinces, as public bodies generally may not store or allow access to personal information outside Canada at all, except for a few exceptions; but it still leaves room for the private sector, as they only need to comply to federal PIPEDA rules which are less strict. In contrast, Québec’s Law 25 apply even to private-sector entities.