Canadian social sector organizations are making significant technology investments, including case management platforms, cloud-based records systems, and service coordination tools. Many have taken deliberate steps to ensure their data is stored in Canada. That is an important decision. It is also an incomplete one.

Where data is stored and under whose legal authority it is held are different questions. Legislation like the U.S. CLOUD Act means that a vendor's country of incorporation, not the physical location of its servers, can determine which courts have the authority to compel access to the information your organization holds on behalf of clients.

For organizations working with vulnerable populations, the distinction carries real weight. For Indigenous-led organizations and programs serving First Nations, Métis, and Inuit communities, the conversation extends further, into questions of data sovereignty, community-level governance, and the First Nations principles of OCAP® (Ownership, Control, Access, and Possession).