Where are my signed documents stored?

What data residency means

Data residency is the place where data is stored and processed. For an e-signature service that is more than the signed PDF: it is also the uploaded documents, the audit trail and certificate, the backups, and the names and email addresses of everyone who signs. Each can sit in a different place, run by a different company.

What federal privacy law asks

Under PIPEDA’s accountability principle, an organization is responsible for personal information in its possession or custody, including information transferred to a third party for processing, and must use contractual or other means to provide a comparable level of protection while a third party processes it (Schedule 1, clause 4.1.3).

The Office of the Privacy Commissioner of Canada (OPC) explains that PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing, and that such a transfer is a use of the information, not a disclosure. The main way to provide comparable protection, it says, is through contract.

The OPC adds that organizations need to make it plain to individuals that their information may be processed in a foreign country and may be accessible to law enforcement and national security authorities there.

Openness is a principle too: an organization must make information about its policies and practices for managing personal information readily available (Schedule 1, principle 4.8). Our guide to PIPEDA and e-signatures has more on these principles.

What Quebec asks

Before communicating personal information outside Quebec, or entrusting a person or body outside Quebec with keeping it on its behalf, a business must conduct a privacy impact assessment, and the communication must be the subject of a written agreement (Act respecting the protection of personal information in the private sector, s. 17).

The Commission d’accès à l’information, Quebec’s privacy regulator, notes that this covers communication to another province as well as to another country.

When it collects personal information, a business must also tell the person, where applicable, about the possibility that the information could be communicated outside Quebec (s. 8). Our guide to e-signatures in Quebec has more on these rules.

Public bodies: where storage in Canada is the rule

Some public-sector laws go further. Two examples, from the statutes themselves:

• Nova Scotia: the Personal Information International Disclosure Protection Act requires public bodies, and their service providers, to ensure that personal information in their custody or under their control is stored only in Canada and accessed only in Canada, unless the person has consented, the storage or access is for a disclosure the act allows, or the head of the public body has allowed it to meet the public body’s operational requirements (ss. 2 and 5). A new Freedom of Information and Protection of Privacy Act (S.N.S. 2025, c. 13) is set to take effect on April 1, 2027.
• British Columbia: the province’s Freedom of Information and Protection of Privacy Act used to require public bodies to ensure that personal information was stored only in Canada and accessed only in Canada (former s. 30.1). That section was repealed effective November 25, 2021, and a public body may now disclose personal information outside Canada only in accordance with the regulations, if any, made by the minister (s. 33.1).

Rules like these bind public bodies and those who serve them. A private business can still ask for Canadian storage in its contract with a provider.

Questions to ask any provider

Ask the same questions of every provider, in writing:

• Where are the documents stored, and where are the backups?
• Where are the audit trail and the certificate of completion kept?
• Where do signers’ names and email addresses go, for example to an email delivery service?
• Who operates the service, and where is that company based?
• Which other companies (subprocessors) handle the data, and in which countries?
• Is the location written into the contract, or only described as how the service runs today?
• Does the location depend on your plan or your account?