Data sovereignty: Law 25, the Cloud Act, and where your data really lives
Is your data truly protected if it's hosted with a U.S. giant? What Law 25 requires, what the Cloud Act allows, and why local hosting changes everything.
“Our data is in the cloud, it’s safe.” That reassuring phrase hides a rarely asked question: in whose cloud, and under which law? For a Quebec business, the answer has very real legal consequences.
Law 25: what Quebec requires
Law 25 (modernizing the rules on the protection of personal information) imposes concrete obligations on Quebec organizations: framing collection, securing personal information, notifying incidents, and — crucially — assessing the risks before communicating data outside Quebec.
In plain terms: you are responsible for knowing where your data is and who can access it. Hosting “somewhere in the cloud” is no longer enough.
Cloud Act: what the United States allows
This is where many companies are stunned. The U.S. CLOUD Act allows American authorities to require a U.S. provider to hand over access to data — even if that data is stored abroad, including in Canada.
In other words: if your data is hosted with a U.S. giant, it can, in theory, be accessible to American authorities, wherever it physically sits. The location of the server isn’t enough; it’s the nationality of the provider that matters.
The real criterion: sovereignty, not just location
Sovereignty is often reduced to “my data is in Canada.” That’s necessary, but not sufficient. True sovereignty combines two conditions:
- Location: the data is physically hosted in Quebec or Canada;
- Provider: the host is a Canadian company, not subject to the Cloud Act.
A data centre located in Canada but operated by a U.S. multinational does not shield you from the Cloud Act. A Quebec host that hosts on its own infrastructure does.
Why local hosting changes everything
Choosing a sovereign Quebec host brings concrete advantages:
- Easier compliance with Law 25: you know where your data is and who operates it.
- Beyond the Cloud Act’s reach: your information falls under Canadian law only.
- A reachable team, here, in your time zone and language.
- Zero egress fees: unlike hyperscalers, getting your data out costs nothing.
At Rēzau, your data stays in Quebec and Ontario, operated by a local company. Whether on private cloud or public cloud, sovereignty is built in by default, not sold as an option.
Frequently asked questions
Is my data in Canada safe from the Cloud Act? Not necessarily: if your provider is a U.S. company, the Cloud Act can apply even to data hosted in Canada. It’s the provider’s nationality that counts.
Does Law 25 ban hosting abroad? No, but it requires you to assess the risks and protect the information. Local sovereign hosting greatly simplifies that compliance.
Sovereignty = more expensive? Not necessarily. And with no egress fees, the total cost is often more predictable than with a hyperscaler.
Want to host with full sovereignty? Explore our trust centre and sovereignty approach, or create your account to see our offerings hosted in Quebec.