Hosting Reviews & Comparisons
PIPEDA and Canadian Hosting: Understanding Data Sovereignty & Storage
Last reviewed
Summary: PIPEDA does not require private-sector websites to keep data in Canada, but it does make your organisation accountable for personal information you send to a hosting provider, in Canada or abroad. You need a contract that protects the data, and you must tell people when their information may be processed outside the country. This page is general information, not legal advice.
What PIPEDA covers
The Personal Information Protection and Electronic Documents Act applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity. Alberta, British Columbia and Quebec have their own substantially similar private-sector laws that apply instead for activity within those provinces. Quebec's Law 25 adds a requirement to assess privacy impacts before communicating personal information outside Quebec.
What counts as personal information on a website
- Contact form submissions, account records and order histories
- Email addresses on newsletter lists
- IP addresses and user agents in web server access logs, where they can be linked to an individual
- Cookies and analytics identifiers
- Database backups and snapshots containing any of the above
01
Visitor
Submits a form or loads a page
02
CDN / proxy
May log IP addresses at edge locations
03
Origin server
Access logs, application database
04
Backups
Snapshots, off-site copies
05
Third parties
Email, analytics, payment processors
Each step can sit in a different country. Data residency is only as strong as the weakest link: a Toronto server with backups replicated to the United States is not a Canadian-only setup.
Accountability for cross-border transfers
The Office of the Privacy Commissioner of Canada treats a transfer to a service provider as a use of information for the purpose it was collected, not a new disclosure. You remain responsible. In practice that means a written agreement with the host covering security safeguards, limits on use, breach notification and deletion at the end of the contract, plus transparent notice to your users.
Breach reporting
Under PIPEDA, organisations must report breaches of security safeguards that create a real risk of significant harm to the Privacy Commissioner, notify affected individuals, and keep a record of every breach for 24 months. Make sure your host will tell you promptly if their systems are compromised.
Hosting compliance checklist
- Document which country stores servers, backups and logs
- Sign a data processing agreement with your host
- List third-party processors in your privacy policy
- Set log retention limits (for example 30–90 days)
- Encrypt data in transit with TLS and at rest where supported
- Restrict server access with SSH keys and least privilege
- Keep a breach response plan and a breach record
Our own approach is described in our privacy policy. For server-side safeguards, see the Linux server hardening checklist, and for choosing a Canadian region, return to the Canadian hosting guide.
Get new technical guides by email
Occasional, practical server and hosting tutorials for Canadian webmasters. Unsubscribe any time.