Last updated: August 12, 2025
If you operate in Canada, ask AI vendors about (1) exact storage and processing regions, (2) cross-region inference/caching, (3) residency and no-training commitments in a DPA, (4) retention controls for chats/logs, and (5) subprocessors and their regions. Get each answer in writing.
Canadian privacy law (PIPEDA) doesn’t force domestic storage, but it does make you accountable for comparable protection when data leaves Canada—typically via contracts and controls. Public sector bodies operating under FOIPPA often prefer or require in-Canada processing. Start with these five questions and capture the answers in your contracts and admin settings.
1) Data location: where is our information stored and processed?
Ask for precise regions for storage (at rest) and runtime processing (during inference). Some vendors let you pin both to Canada; others only pin storage. Request a sentence like: “Customer content and telemetry are stored and processed in Canada (Toronto/Montréal or ca-central-1) with no cross-region processing.”
Why it matters: Data may traverse other regions during model inference unless disabled.
2) Cross-region inference/caching: does it happen, and can we turn it off?
Some platforms accelerate performance by routing or caching requests outside your chosen region. Ask for a yes/no, the default behavior, and the admin control to disable it. Document the setting in your configuration checklist.
3) Contract terms: will you sign a DPA that commits to Canadian residency (if required) and no training on our data?
Under PIPEDA, you remain accountable when vendors or subprocessors handle personal information. Require a Data Processing Addendum that commits to residency (when needed), forbids training on your content, and names all subprocessors. Ensure audit and breach-notice language match your policies.
4) Retention controls: what are the defaults for chats, files, logs, and telemetry—and can we minimize them?
Short retention reduces risk. Confirm default periods, admin controls to shorten them (including zero where possible), and how legal holds affect deletion. Record the exact settings in your security runbook.
5) Subprocessors: who are they, and can any of them move data outside Canada?
Ask for the live subprocessor list, their regions, and the flow of data between entities. Make sure each subprocessor is bound by the same residency, security, and notification obligations you expect from the primary vendor.
Quick RFP checklist (copy/paste)
- Named storage and processing regions (city/region codes).
- Statement on cross-region inference/caching + how to disable.
- Signed DPA: residency where required + no-training on customer data.
- Retention defaults and admin controls for chats/logs/telemetry.
- Subprocessor list with regions and data-flow map.
Why this matters in Canada
- PIPEDA (private sector): No blanket residency rule, but organizations must ensure comparable protection through contracts, controls, and transparency when data leaves Canada.
- FOIPPA (public sector): Many institutions prefer or require in-Canada storage/processing; federal guidance emphasizes risk management, governance, and procurement diligence.
FAQ
No. Residency isn’t mandated, but accountability is: you must ensure comparable protection, especially with foreign processors.
Use stronger contractual controls, minimize retention, and avoid sensitive data—or select a provider that supports Canadian regions for both storage and inference.
Works Cited (MLA)
- Office of the Privacy Commissioner of Canada. “Guidelines for Processing Personal Data across Borders.” Office of the Privacy Commissioner of Canada, 27 Jan. 2009, www.priv.gc.ca. Accessed 12 Aug. 2025.
- Treasury Board of Canada Secretariat. “Guide on the Use of Generative AI.” Canada.ca, 3 June 2025, www.canada.ca. Accessed 12 Aug. 2025.
- Microsoft. “Data, Privacy, and Security for Microsoft 365 Copilot.” Microsoft Learn, 2025, learn.microsoft.com. Accessed 12 Aug. 2025.
- Google Cloud. “Data Residency | Generative AI on Vertex AI.” Google Cloud Documentation, 2025, cloud.google.com. Accessed 12 Aug. 2025.
- Amazon Web Services. “Model Support by AWS Region in Amazon Bedrock.” AWS Documentation, 2025, docs.aws.amazon.com. Accessed 12 Aug. 2025.
- OpenAI. “Data Residency for ChatGPT (Enterprise).” OpenAI Help Center, 2025, help.openai.com. Accessed 12 Aug. 2025.
Need a vendor Go/No-Go matrix with must-have clauses? Book a quick consult and I’ll tailor one to your stack.
WORK WITH SUE