Blog

Where is your data? The register your legal advisor will ask for

2026-08-21 · 6 min

A vendor offers you a tool. Your legal advisor asks a simple question, and the room goes quiet: where is the data, who processes it, and which companies does it pass through?

That question is not a formality. Under Quebec’s Law 25, an organization adopting a system that processes personal information has to be able to answer it. Most vendors cannot — not out of bad faith, but because nobody ever asked them in writing.

What the law actually requires

Two sections come up constantly in these conversations, and they are routinely confused.

Section 17 requires a privacy impact assessment before entrusting a third party with communicating personal information outside Quebec — taking into account the legal regime of the processing location. Not outside Canada: outside Quebec. That distinction changes everything, and it escapes a lot of people.

Section 3.3 requires an assessment for any project to acquire, develop or overhaul an information system or electronic service delivery involving the life cycle of personal information — a transfer outside Quebec is not a condition. A vendor promising to exempt you is either mistaken or misleading you.

No software makes you compliant. The obligation exists either way. What differs between vendors is how hard the assessment is to produce — and how good an answer you can put in it.

The document to demand

Ask for a table. This format is not prescribed by law — neither section 3.3 nor section 17 imposes a shape. It is a recommended format, because it gathers what an assessment needs in a form your advisor can file as-is.

• The function — hosting, backup, email, analytics, payment, support.
• The provider — the contracting entity, named.
• The processing location — the city, not the country.
• What passes through — the data actually involved, not a vague category.

If a vendor cannot fill those four columns within a day, they do not know themselves. That is information about them.

The question that makes the difference

Server location is only one factor. Exposure to foreign law depends on the contracting entity, its affiliates, the applicable jurisdiction, and who holds possession, custody or effective control of the data.

A vendor can host in Quebec while being the subsidiary of a company under a foreign regime. Another can host elsewhere with a more protective contractual structure. Which is why the right question is not “where is the server” but “who controls the data, and under which law”.

What we publish

Our own table is in our privacy policy, section 8. It names every provider, every location, and what passes through. We publish it because it is exactly what a client needs to file — and because demanding from a vendor what you do not provide yourself makes no sense.

Our primary hosting is in Beauharnois, Quebec. That exempts you from no assessment. It may simplify the part of the analysis dealing with transfers outside Quebec, subject to your other providers and other data flows. The assessment under section 3.3 remains proportionate to the sensitivity, purposes, quantity, distribution and medium of the information.

Probaro does not guarantee compliance with any law or standard. This article provides general information as of the date shown; it is not legal advice and does not replace analysis by a qualified advisor who knows your situation.

Frequently asked questions