A growing majority of Canadian organizations now say the single most important thing about a security tool is not what it does, but where the data lives and who can legally reach it.
That is the headline from CIRA's 2025 Cybersecurity Survey, and it marks a real shift in how Canadian buyers think. "Data sovereignty" used to be a phrase for banks, hospitals, and governments. In 2026 it is turning up in the buying decisions of ordinary small businesses, driven by a mix of privacy law, cross-border legal reality, and a tense trade relationship with the United States.
What the numbers say
CIRA, the not-for-profit that runs Canada's .ca domain, surveys Canadian security decision-makers each year. In the 2025 edition, 69 percent said data sovereignty is now the most important factor when they choose a cybersecurity solution, up from 60 percent the year before. Eighty-two percent said a provider's country of origin matters more than it used to, and 56 percent said they had specifically reconsidered a U.S. vendor over the past year because of trade and political uncertainty.
Those are not fringe numbers. They describe a mainstream Canadian buyer who has started asking a question most owners have never had to answer: where does our data actually live, and whose laws apply to it?
Why "where" is really a "who" question
It helps to separate two ideas that get blurred together. Data residency is about geography: the physical country where your data is stored. Data sovereignty is about jurisdiction: whose laws can compel access to that data, which usually follows the home country of the company holding it, not just the location of the server.
The reason the distinction matters is the U.S. CLOUD Act of 2018. It lets U.S. authorities compel a U.S.-headquartered provider to hand over data in its custody, even if that data sits in a datacenter in another country. Because the biggest cloud platforms most small businesses run on, Microsoft, Google, and Amazon, are U.S. companies, data stored in a Toronto datacenter can still, in principle, be reached under U.S. law. Canadian residency does not on its own put data beyond U.S. legal reach.
Why it matters for a small business
- Where your data physically sits and who legally controls the company holding it are two different questions. Sovereignty is about the second one, and it is the one most vendor marketing skips.
- For regulated data, such as health information, or for Quebec businesses under Law 25, where and how data is handled can carry real legal obligations.
- It is increasingly a procurement question your own customers ask. If you handle client data, expect "where is it stored and who can access it?" to show up in more contracts and RFPs.
- It is not a reason to panic or rip out your cloud. It is a reason to make a deliberate, informed choice instead of a default one.