Data residency

Data residency is the geographic location of storage and processing. It matters because law follows geography: data in a US data center is realistically subject to US legal process, and some sectors and provinces set residency expectations for certain records.

In Canada, PIPEDA does not require personal information to stay in the country. An organization that sends it to a vendor for processing, including an AI tool, remains accountable for it and must use contractual or other means to ensure a comparable level of protection. The Office of the Privacy Commissioner also expects organizations to tell people their information may be processed in another country and could be accessed by that country's courts and authorities.

Quebec goes further. Under section 17 of its private-sector privacy act, as amended by Law 25, a business must complete a privacy impact assessment before communicating personal information outside Quebec, and may proceed only if the assessment shows the information would be adequately protected, under a written agreement. Some public-sector rules are stricter still: Nova Scotia's PIIDPA generally requires public bodies to store and access personal information only in Canada.

Most consumer AI tiers offer no residency choice: prompts go wherever the vendor's infrastructure is. Enterprise tiers increasingly sell regional options (EU boundaries, in-country processing). For each tool, residency is a per-tier fact worth verifying, not a brand attribute.