Data sovereignty: where your data is, and why it matters in Quebec
An organisation that entrusts its data to a foreign cloud is still accountable under the law. Understanding the difference between my data, the data held about me, and where it sleeps prevents most misunderstandings.
An organisation that entrusts its data to a foreign cloud is still accountable under the law. Understanding the difference between my data, the data held about me, and where it sleeps prevents most misunderstandings.
Sovereignty is not confidentiality
Hosting data in Quebec does not protect it automatically, and a service operated abroad may meet stricter requirements than a local one. Sovereignty answers a precise question: who can order access, under which laws, and with what recourse.
Three distinct questions
Who is accountable? Privacy law places responsibility on the organisation holding the information, not on its provider. Where is the data? A single service may replicate data in several countries, and back up elsewhere again. Who can access it, on whose order? Access rules on demand vary by hosting country.
What Quebec law already requires
A person responsible for the protection of personal information, written policies, a privacy impact assessment before entrusting information to a third party, a contract governing the service provider (purpose, security, destruction, no other use), and notification of the individuals and the access to information commission after an incident presenting a serious risk of harm.
Questions to ask a provider in writing
In which countries will data be stored, processed and backed up, and will we be told before a subcontractor change? Which subcontractors can access the data? What encryption, logging and access controls apply, including for the provider's own staff? What happens if a foreign authority demands access? On termination, how do we get the data back, in what format, and with what attested destruction?
Official sources
- Commission d'acces a l'information du Quebec
- Quebec — cybersecurity and digital
- Office of the Privacy Commissioner of Canada