Does the US CLOUD Act apply to my data if it's hosted in Canada?

What is the CLOUD Act?

The Clarifying Lawful Overseas Use of Data Act is a 2018 US law. It added Section 2713 to the Stored Communications Act, which says a provider must preserve or disclose customer data it controls "regardless of whether such communication, record, or other information is located within or outside of the United States."

It covers criminal investigations. US authorities use a warrant, subpoena or court order, served on the provider, not on you.

Does it apply to data stored in a Canadian region?

Yes. The location of the server is not the test. Control by a company that answers to US law is. The Government of Canada's own white paper on data sovereignty says it directly:

"As long as a CSP that operates in Canada is subject to the laws of a foreign country, Canada will not have full sovereignty over its data."

The same paper notes that data residency "does not mitigate against the application of foreign laws." Keeping bytes in Montreal or Toronto is useful for latency and some contracts. It is not a legal shield.

Canadian region vs Canadian-owned

This is the distinction most "Canadian cloud" marketing skips. Ask two questions: where does the data sit, and who controls the company that holds it?

The middle row is a real legal grey zone. If your vendor has any US entity, ask your own counsel. BLG and Stikeman Elliott both published guidance on this in April 2026 (see sources).

The CLOUD Act does let a provider challenge an order when it conflicts with a foreign country's law, but only for countries that have signed an executive agreement with the US. Canada has not signed one, so that path is not open for Canadian data.

What did Microsoft actually admit?

On June 10, 2025, Microsoft France's director of public and legal affairs told a French Senate inquiry that he could not guarantee data hosted in the EU would be protected from a US government request. Canadian headlines reported it as a Canadian story. It was said in France, about EU data.

The reasoning still applies here. A US company bound by a valid US order cannot promise to refuse it because the data sits in another country, and that includes Canada.

CLOUD Act vs FISA Section 702

People often mix up two different US laws. Canadian ownership matters for both, because both work by compelling US companies.

FISA status checked October 1, 2026. Congress may act before March 2027.

Does encryption protect my data?

Only if you hold the keys. A provider can be forced to hand over data, but if it never had the keys, all it can hand over is ciphertext it cannot read. If the keys live in the provider's own key management service, an order can reach them too.

The federal government took this position in the same white paper, directing that it "maintain exclusive control of the encryption keys" for data in the cloud.

Encryption has a limit: metadata. Who connected, when, from where and how much data moved can still be visible to the provider. Ownership and key custody work best together.

Is there a Canada–US CLOUD Act agreement?

Not yet. The two governments announced negotiations on March 22, 2022. As of August 2026, Lawfare reported that no deal had been reached and that new Canadian surveillance legislation could put it at risk.

An agreement would make cross-border requests faster in both directions. It would not stop the CLOUD Act from applying to US companies holding Canadian data.

Doesn't data sovereignty just slow Canadian companies down?

Sometimes, yes. Sovereign options have fewer regions, smaller ecosystems and fewer ready-made integrations than the hyperscalers, and moving costs engineering time. That trade-off is not worth it for everything.

• Usually worth it: health records, public sector work, financial data, personal information covered by Quebec Law 25, and any customer whose procurement team asks about foreign jurisdiction.
• Usually not worth it: public content, marketing sites, and data you would publish anyway.

The useful question is not "is Canadian better?" but "which of my data would hurt if a foreign government could compel access to it?"

Frequently asked questions

Does the CLOUD Act apply to Canadian companies?

It applies to providers that are subject to US jurisdiction. A Canadian company with no US parent, subsidiary or operations is much harder to reach. A Canadian company with a US affiliate may be reachable, and lawyers disagree on how far that goes.

Can US authorities get data stored in AWS Montreal?

Yes. Amazon is a US company, so the CLOUD Act can compel it to produce data in its possession, custody or control, including data in its Canada (Central) region.

Is PIPEDA enough to protect my data from US access?

No. PIPEDA does not forbid sending personal information outside Canada. It requires comparable protection by contract and openness about where data goes, and it cannot override a lawful US order to a US company.

What does Quebec Law 25 require before data leaves Quebec?

A business must complete a privacy impact assessment before communicating personal information outside Quebec, including a look at the legal framework where the data will go. It can proceed only if the assessment shows the information will be adequately protected.

Does PHIPA require health data to stay in Canada?

PHIPA does not, by itself, say health data must be stored in Canada. It makes the health information custodian responsible for protecting it, including when a vendor holds it, so where that vendor answers to foreign law is a fair question to ask.