Canadian brokerages hold claims histories, financial information and commercial risk profiles on behalf of their clients. Regulators, carriers and clients increasingly want to know where that information is stored and whose laws apply to it. Data residency is the physical location of the data. Data sovereignty is the question of which country’s laws can compel access to it. The two are related, and a vendor can satisfy the first while failing the second.
Overlapping Regulatory Obligations
A brokerage falls under several legal and regulatory frameworks. PIPEDA, Canada’s federal privacy law, holds you accountable for the privacy and security of client information that you store with a third-party data service provider, and your contract with that provider must ensure a comparable level of protection. It says nothing about where the servers must be located.
Some provinces have their own legislation that may apply. Quebec’s Law 25 specifies that before personal information leaves Quebec, including for another province, you must complete a privacy impact assessment, conclude that the information will be adequately protected, and put a written agreement in place. Alberta’s PIPA requires you to notify individuals when their information is transferred to a service provider outside Canada, and your privacy policies must name the countries involved.
Your carriers add another layer. OSFI’s Guideline B-10 lists insurance brokers among the third-party arrangements a federally regulated insurer must manage. For high-risk or critical arrangements, its due diligence list includes the geographic location of a third party’s operations and subcontractors, and the legal risks of those jurisdictions. How hard a carrier presses any one broker depends on how it rates the relationship, but the framework is in place.
As far as I can tell, no rule requires a private brokerage to store client data in Canada. However, it is in your best interest to know where your data goes and to be able to document it.
Foreign Legal Exposure
The US CLOUD Act allows American authorities to compel a provider subject to US jurisdiction to produce data in its possession, custody or control, regardless of where that data is stored. That reaches the American hyperscalers, which operate Canadian data centres and remain American companies. The Treasury Board’s 2018 white paper on public cloud states that as long as a provider operating in Canada is subject to foreign law, Canada will not have full sovereignty over its data. A provider with no US parent and no meaningful US footprint is generally outside the CLOUD Act’s reach, so ownership belongs on your vendor questionnaire alongside location.
The Patriot Act is the statute most often cited in these conversations, usually out of habit. Its Section 215 business-records power expired in March 2020. The Treasury Board paper names a different law as the primary risk: the US Foreign Intelligence Surveillance Act. Section 702 of FISA authorizes warrantless collection targeting non-US persons abroad, with compelled help from US providers. It lapsed on June 12, 2026 when Congress failed to renew it. Court-approved collection continues until about March 2027, and the most recent reporting I found, from September, shows no renewal.
Client Trust
A 2026 CIRA survey of 2,000 Canadians found that 67% say it is important their personal data be stored on servers in Canada, and 8% say it is unimportant. That is a general-population online panel, not a poll of insurance buyers, and it measures preference rather than buying behaviour.
Clients nonetheless entrust their brokers with claims histories and financial records. In commercial lines, that extends to information they would not want a competitor to see. When a client asks where that information is held, “I’ll find out” is a weak answer. A broker who has already documented the answer, including any disclosure Alberta’s PIPA requires, has an easy conversation.
Questions for Your Vendors
Ask where your data is hosted, processed and backed up, and whether support staff outside Canada can access it. Ask who owns the provider and which country’s courts can compel it to produce data. Ask where each answer appears in the contract, since a sales deck is not a contract. Have those answers on file before a client, a carrier or a regulator asks for them.
