The penalties are steep. Up to $25M, or 4% of global turnover. The mandatory privacy impact assessments, the data-portability right. If you're building in Toronto or Vancouver, it's easy to file the whole thing under yet another Quebec problem, like you would have for GDPR, and just move on. But that's missing the point — in exactly the same way it would have been missing the point for GDPR back in 2018.
The actual landscape
Federally, and in every province without its own law, including Ontario, private-sector data handling runs on PIPEDA. BC and Alberta have their own PIPA. Quebec's Law 25 is the same, but stricter, and in full force. The common mixup here is that Ontario's Bill 194 is not a private-sector law, but the key is that Ontario businesses are still under PIPEDA no matter what other public-body legislation comes out on top.
Same exposure across the board
Every one of these compliance regimes holds you directly accountable for the personal data you hold or hand to a processor. Every one gets undercut the exact same way by the US CLOUD Act. If you host (or even transmit) customer data through a US-owned company, no matter where the data physically sits, US authorities can compel it, regardless of which city or province the server is in. Or isn't. PIPEDA, PIPA, Law 25, doesn't matter. The CLOUD Act cuts straight through your claim of control, because you can't guarantee it.
What does this actually mean
The key takeaway from sovereignty vs. residency vs. whatever isn't just that “sovereignty is control and residency is location.” The key is that the US CLOUD Act undermines your ability to control the data, no matter what compliance regime you're following. It's not about operating improperly or dodging the law — what's broken, in terms of chain of custody, is that even if you follow every regime correctly, you can't credibly claim full control over your customer's data as long as your counterparty (or you) are subject to US law.