Rules
The rules buyers are held to
Different laws ask different questions. Some care where data is stored, one cares where it is accessed from, the CLOUD Act cares who controls it, and several mostly require an assessment. Summaries only; each page links the law or the regulator. Not legal advice.
| Rule | Applies to | Turns on |
|---|---|---|
| US CLOUD Act United States | Any provider subject to US jurisdiction: US companies, and foreign companies with enough US contacts. | Ownership |
| Federal residency rule for Protected B data Government of Canada | Federal departments and agencies, and the vendors that serve them. | Storage, Ownership, Assessment |
| PIPEDA and Bill C-36 Canada (private sector) | Private-sector organizations under federal privacy law. | Processing |
| Nova Scotia: PIIDPA, and FOIPOP from 2027 Nova Scotia | Public bodies, municipalities and their service providers. | Storage, Access |
| Québec Law 25 and health information Québec | Businesses, public bodies, and health and social services bodies in Québec. | Storage, Processing |
| British Columbia FIPPA British Columbia | Public bodies: ministries, health authorities, school districts, municipalities, universities. | Storage, Processing |
| Alberta: Protection of Privacy Act and Health Information Act Alberta | Public bodies (POPA); health custodians such as physicians, clinics and Alberta Health Services (HIA). | Assessment |
| Ontario PHIPA Ontario | Health information custodians in Ontario. | Processing |
| OCAP® (First Nations) First Nations | First Nations governments and anyone handling First Nations data. | Ownership, Storage |