What every Canadian CIO needs to know about data sovereignty

Keeping watch on where data travels over the internet is relevant to any business that cares what country might have access to its private information. Exactly where data moves and is stored is tied to the concept of data sovereignty, the idea that data is governed by the laws of the country where it’s located.

If data stays in Canada, local privacy laws apply to personal information. But that control may be lost once data slips outside the border.

[ Lisez la version française: « Ce que tout DSI canadien devrait savoir sur la souveraineté des données » ]

Data sovereignty is creeping up the agenda for CIOs and CISOs around the world as cloud services with loose geographical boundaries become increasingly prevalent. Many countries, particularly in Europe, have implemented stricter rules to try to protect their citizens’ data.

Canada is no exception. Here’s what every Canadian CIO and CISO needs to know about data sovereignty.

Data sovereignty in Canada: Federal or provincial jurisdiction matters

How data is treated in Canada depends on the type of organization and the province where it’s located. The laws are focused on personal information belonging to citizens or consumers.