Federal residency rule for Protected B data

The Treasury Board's Directive on Service and Digital requires departments to identify and evaluate computing facilities in Canada "as a principal delivery option" for data categorized Protected B, Protected C or classified. It is a default to evaluate, not a ban on storage abroad.

The Government's own white paper on data sovereignty says "data residency does not mitigate against the application of foreign laws," names the US Foreign Intelligence Surveillance Act as the main risk, and commits the government to encrypting Protected data and keeping exclusive control of the keys.

The Canadian Centre for Cyber Security assesses cloud providers against Low, Medium and High profiles (Medium covers up to Protected B). Its assessments do not consider data residency, and the list of assessed providers is not public. In 2026 Shared Services Canada launched a procurement for "Sovereign Canadian Cloud" capabilities that "prioritizes Canadian-owned and controlled cloud service providers."