Guide
Data residency and sovereignty in public sector IT contracts
What data residency and data sovereignty rules mean for IT suppliers to government, how requirements differ by country and province, and how to answer them in a bid.
Data residency is now one of the most common requirements in public IT tenders, especially for cloud, SaaS and managed services. Getting it wrong can make your bid non-compliant.
Residency, sovereignty and localization
- Data residency: where data is physically stored.
- Data sovereignty: whose laws apply to the data. Data held in-country by a provider subject to foreign laws may raise sovereignty concerns.
- Data localization: a legal requirement to keep data in a country.
How rules differ
- Canada: federal policy requires sensitive government data to be stored in Canada in many cases, and buyers often ask for Canadian hosting. Provinces have their own rules. British Columbia, for example, relaxed its strict in-Canada storage rule in 2021 but requires public bodies to assess and approve disclosures outside Canada, and Nova Scotia has its own personal information protection law with residency rules.
- EU: the GDPR controls transfers of personal data outside the European Economic Area, and many buyers prefer EU hosting. See GDPR for public sector IT suppliers.
- UK: buyers commonly ask for UK or EEA hosting for personal data, and assess offshoring risks.
- Australia: many agencies require government data to be hosted in Australia, often with providers certified under the Hosting Certification Framework.
- US: federal agencies generally require data in US locations for FedRAMP services, and some states have their own rules.
Questions buyers ask
- Where is data stored, including backups and disaster recovery copies?
- Where are support staff who can access the data located?
- Which subprocessors are used, and where?
- Which laws could compel your provider to disclose data?
- Can you guarantee data won't leave the country?
How to answer in a bid
- Name your hosting regions precisely, including backups.
- List subprocessors and their locations.
- Explain remote access by support staff, and the controls on it.
- Describe encryption and who holds the keys.
- Commit contractually to the location requirements.
Common questions
Does government data have to be stored in Canada?
Often, but not always. Federal policy and some provincial rules require or strongly prefer Canadian storage for sensitive data. Check each tender's requirements.
Is data in a Canadian region of a US cloud provider "sovereign"?
It's stored in Canada, which meets most residency requirements. Some buyers have concerns about foreign laws such as the US CLOUD Act, which is a sovereignty question. Be ready to explain your controls.
Do backups count for data residency?
Yes. Buyers usually expect backups and disaster recovery copies to meet the same location requirements.