Part of Data sovereigntyLaw 25 · Guide

Law 25 and hosting: the line is Quebec, not Canada.

Law 25 does not require Canadian servers. It requires a privacy impact assessment before personal information is communicated outside Quebec, including when a provider outside Quebec keeps it for you (section 17), and one for every new system that handles personal information (section 3.3). A host in Toronto is outside Quebec. A host in Montréal is not.

Facts checked October 29, 2026

Create a free account How Canner stays sovereign →

What section 17 says

Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector. Section 17 is the one that touches hosting:

“Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment.” The assessment has to consider the sensitivity of the information, the purposes, the protection measures including contractual ones, and “the legal framework applicable in the State in which the information would be communicated”. The information may go only if it “would receive adequate protection”, and the communication needs a written agreement that reflects the assessment.

Its third paragraph is the hosting case: “The same applies where the person carrying on an enterprise entrusts a person or body outside Québec with the task of collecting, using, communicating or keeping such information on his behalf.” A hosting provider outside Quebec keeps the information on your behalf.

Where your host is changes the work

This is our reading of the Act and the CAI guide, for planning. It is not legal advice.

Where the information is kept	Section 17 assessment and agreement	What else applies
In Quebec, with a Quebec-located provider^†^†	No, not for the hosting	A written contract under section 18.3; your section 3.3 assessment for the system
In Quebec, in a region run by a US-owned provider (for example Montréal or Quebec City)^†^†	No, as long as nothing is kept outside Quebec; yes for any backup or replica kept elsewhere	Section 18.3 contract; the provider’s exposure to US orders is a risk for your section 3.3 assessment
Elsewhere in Canada (Toronto, Calgary, Vancouver)^†^†	Yes	Section 18.3 contract; the agreement must reflect the assessment
Outside Canada^†	Yes, including the foreign legal framework	Section 18.3 contract; PIPEDA’s accountability principle as well

† Competitor details come from each vendor’s own published pages on the dates shown; prices and plans change, so check the vendor before you decide. In Quebec, with a Quebec-located provider (2026-10-29) · In Quebec, with a Quebec-located provider (2026-10-29) · In Quebec, in a region run by a US-owned provider (for example Montréal or Quebec City) (2026-10-29) · In Quebec, in a region run by a US-owned provider (for example Montréal or Quebec City) (2026-10-29) · Elsewhere in Canada (Toronto, Calgary, Vancouver) (2026-10-29) · Elsewhere in Canada (Toronto, Calgary, Vancouver) (2026-10-29) · Outside Canada (2026-10-29)

Every new system needs an assessment anyway

Section 3.3 requires a privacy impact assessment “for any project to acquire, develop or overhaul an information system or electronic service delivery system” that involves personal information. That applies wherever the system is hosted, Canner included. It must be “proportionate to the sensitivity of the information”, so a contact form needs far less than a patient portal.

The same section asks that the system can give people their own computerized information “in a structured, commonly used technological format”, the portability right in force since September 2024. Your person in charge of the protection of personal information (section 3.1; by default the person with the highest authority in the enterprise) must be consulted from the start.

The contract with your provider

A host in Quebec still receives personal information from you. Section 18.3 allows that without consent when the provider performs a service for you, on two conditions: the mandate is in writing, and it states the measures the provider takes to keep the information confidential, use it only for the service, and not keep it after the contract ends. The provider must tell your person in charge of any breach of confidentiality “without delay”, and let them verify the confidentiality measures.

On Canner, the signed data processing agreement and a data-residency attestation are included with the Compliance add-on ($29/mo), along with the audit log.
Enterprise adds a custom agreement and a Law 25 assessment support pack.

What is at stake

Since September 2023, keeping or communicating personal information in contravention of the Act can bring an administrative monetary penalty of up to $10,000,000 or 2% of worldwide turnover, whichever is greater (section 90.12), and penal fines of $15,000 to $25,000,000 or 4% of worldwide turnover (section 91).

What Canner gives your assessment

Your apps, databases, files and their backups are stored on servers in Montréal, Quebec.
Canner is Canadian-owned and has no US parent or affiliate, so the US CLOUD Act does not reach it.
A short list of outside services that never hold your application data: Stripe for card payments, Cloudflare for DNS records and certificates (no traffic passes through it), and Resend for account emails. Details on the sovereignty page.
A signed data processing agreement, a data-residency attestation and the organization audit log, all in the Compliance add-on ($29/mo).

Questions

Does Law 25 require Canadian servers?

No. It requires a privacy impact assessment and a written agreement before personal information is communicated outside Quebec, including to a provider outside Quebec that keeps it for you. It does not forbid it.

Does a host in Toronto trigger section 17?

Yes, on the plain wording of the Act. Toronto is outside Quebec, and a host there keeps the information on your behalf, which is the third paragraph of section 17.

Is an AWS or Azure region in Quebec enough?

It keeps the data in Quebec, so section 17 does not apply to the hosting itself as long as no backup or replica is kept elsewhere. The provider is still US-owned and subject to the US CLOUD Act, which belongs in your section 3.3 assessment. See AWS Canada compared.

If I host on Canner, do I still need an assessment?

For the system you are building, yes: section 3.3 applies to every new system that handles personal information, on any host. For the hosting itself, no section 17 assessment is needed, because nothing leaves Quebec.

Does PIPEDA require hosting in Canada?

No. The federal Privacy Commissioner’s guidelines say PIPEDA does not prohibit transfers for processing; the organization stays accountable and must use a contract to provide comparable protection, and tell people their information may be processed abroad.

Is this legal advice?

No. It is our reading of the Act and of the CAI’s guide, with the sources linked. For a decision about your data, ask your person in charge of the protection of personal information or a lawyer.

Keep reading

Data sovereigntyWhy ownership matters as much as location.Postgres hosting in CanadaEvery managed Postgres option, by city and owner.AWS Canada comparedWhat a Montréal region does and doesn’t change.

Host in Quebec, by default.

Every Canner project runs in Montréal. Add the Compliance add-on for the signed agreement and the attestation.

Create a free account See full pricing →See pricing →