A professional event collects a large amount of personal information: names, contact details, organizations, roles, interests, meetings, sometimes payment details. That data belongs to your organization and your attendees. You’re accountable for it.
That’s why more and more organizers ask vendors where their data is hosted. The answer “in Canada” is reassuring. But it doesn’t tell the whole story.
Location doesn’t guarantee jurisdiction
Data sovereignty is the principle that data collected or processed in Canada remains primarily subject to Canadian law. Yet a server located in Canada can belong to a company that answers to another country’s laws.
The most cited example is the U.S. CLOUD Act, passed in 2018. Under this law, U.S. authorities can compel U.S.-based companies, or U.S.-controlled subsidiaries, to hand over data, even when it’s stored in Canada. What matters isn’t where the server sits, but who has custody or control of it.
The Government of Canada has reached the same conclusion. A federal white paper on digital sovereignty warns that storing data in the country isn’t enough to rule out the jurisdiction of foreign courts.
This isn’t about alarmism: such requests go through structured legal procedures and don’t grant open access to data. But for an organization responsible for the information of hundreds or thousands of attendees, the question deserves a clear answer.
What Quebec’s Law 25 means for you
In Quebec, Law 25 adds a concrete obligation. Before communicating personal information outside Quebec, a business must conduct a privacy impact assessment (PIA). That assessment must show the information will receive adequate protection. The requirement has been in force since September 2023.
In other words, your choice of technology vendor has a direct impact on your compliance obligations.
Questions to ask your vendors
Don’t stop at “where is our data?” Also ask:
- Who owns and operates the server? A Canadian company, or the subsidiary of a foreign group?
- Which laws does this vendor answer to? Is it subject to the CLOUD Act or another foreign law?
- Does the data pass through anywhere else? Think backups, analytics tools and subcontractors.
- Who can access the data, and from where?
- How do you retrieve your data and have it deleted at the end of the engagement?
B2B/2GO’s commitment
At B2B/2GO, your attendees’ data is hosted on a sovereign Canadian server. We don’t just tell you where your data is: we can explain which jurisdiction it falls under.
For an organization that collects information from its members, partners and attendees, that’s peace of mind on top of a successful event experience.
Evaluating vendors for your next event? Ask us these questions. We’ll be glad to answer.
This article is provided for information purposes and does not constitute legal advice.
Sources: BLG, data sovereignty and the CLOUD Act (2026) · Osler, data sovereignty and the CLOUD Act (2025) · Noovo Info, federal digital sovereignty white paper · McCarthy Tétrault, Law 25 and transfers outside Quebec
