OPINION | Cloudy with a chance of sovereignty: protecting our data beyond borders

As governments and enterprises across Canada continue to digitally transform as a means to stay competitive and efficient in a fast-changing, tech-driven world, one concept is rising to the forefront of strategic technology conversations: cloud sovereignty. While often misunderstood or oversimplified as “just keeping data in Canada,” true cloud sovereignty is about much more than data residency. It’s about ensuring full jurisdictional control over who manages, sees, and governs that data, and the infrastructure it sits on. At a time when cyber threats are deeply linked to geopolitical risks, and when legislative frameworks like the U.S. CLOUD Act, which permits American law enforcement to access data stored overseas by U.S.-based companies, raise questions about foreign oversight of Canadian data, the concept of digital self-determination has become increasingly critical. Yet, many organizations believe that it’s sufficient to ensure that the data they have stored with a global provider is housed in Canada — it’s not. To protect Canada’s digital future, we must go beyond physical location and embrace a three-tiered model of sovereignty: data, operations, and technology. Data sovereignty: The starting point, not the destination Historically, data sovereignty referred to keeping data within national borders to comply with Canadian privacy laws like the Personal Information Protection and Electronic Documents Act (PIPEDA) or sector-specific frameworks such as the Personal Health Information Protection Act (PHIPA). However, it’s important to understand that location alone doesn’t equal control. The reality is that many Canadian workloads are stored in infrastructure owned or operated by non-Canadian entities. Even if the data is physically located in Canada, foreign-owned providers can be compelled by their home countries to hand over access, bypassing Canadian legal processes. This puts governments and critical infrastructure at risk of silent surveillance or data seizures without recourse. Data residency is table stakes. True sovereignty means ensuring data is subject only to Canadian laws, oversight, and enforcement. Operational sovereignty: Who runs the cloud matters The second, often overlooked, pillar of cloud sovereignty is operational sovereignty — who really holds the keys to the kingdom? Many cloud services are operated or maintained by personnel based outside Canada, or by multinational teams with global access privileges. This opens the door to accidental or intentional exposure, foreign influence, or non-compliance with public-sector procurement rules. In contrast, a truly sovereign solution ensures that all personnel managing and supporting cloud services are: - Canadian citizens or permanent residents; - Vetted and cleared, especially for sensitive workloads; and - Don’t allow outsourcing or subcontracting to foreign firms. This isn’t just a matter of national pride; it’s a matter of accountability and a traceable chain of custody. Technology sovereignty: Control over the infrastructure stack The third layer is technology sovereignty, being the ability to independently operate, secure, and evolve the technology stack without relying on foreign-owned platforms or intellectual property. This doesn’t mean Canada must build everything from scratch or reject global technology. Rather, it means ensuring that the core infrastructure, orchestration, and security layers are fully under Canadian jurisdiction. In a sovereign model, the provider (not a foreign hyperscaler) controls: - Underlying hardware and networking; - Orchestration and monitoring tools; and - All access controls, encryption, and audit capabilities. Why now? There’s a growing understanding that Canada’s digital independence cannot be taken for granted. The federal government’s introduction of Bill C-26, which seeks to secure critical cyber infrastructure, is a strong signal that sovereignty is not just a philosophical ideal; it’s becoming a legislative imperative. In addition, geopolitical instability, foreign espionage, and cross-border legal conflicts are increasing in frequency and severity. The stakes are higher than ever. Cloud sovereignty is no longer a niche requirement for national defense — it’s a mainstream necessity for any organization handling sensitive data or engaging with public sector clients. Getting sovereignty right Canada has the talent, infrastructure, and policy frameworks to lead the world in sovereign cloud adoption. But we need to get the definition right and stop accepting watered-down versions of sovereignty that don’t stand up to real-world risk. Organizations evaluating cloud partners should ask three simple questions: 1) Where is the data stored? 2) Who operates the environment and where are they located? 3) Who owns and controls the technology stack? Unless the answer to all three is “Canada," the solution isn’t truly sovereign. Our path to true data sovereignty may seem like we’re navigating through clouds, but the forecast is clear. In the 21st century, data is power and sovereignty is about ensuring that power stays in the right hands. As Canada builds its digital future, we need to ensure that our most sensitive data, systems, and services remain governed by Canadian values, protected by Canadian laws, and operated by Canadian professionals. Cloud sovereignty isn’t about isolation, it’s about resilience. It’s about choice. And it’s about trust. John Menezes is president and CEO of Stratejm, a Bell Canada Company. Menezes is a cybersecurity veteran with more than 30 years of experience. In 2015, he founded Stratejm with a mission to revolutionize managed security services. Under his leadership, Stratejm has become a pioneer in cybersecurity mesh architecture, providing end-to-end security and compliance solutions. The Wire Report welcomes submissions of opinion pieces from outside contributors who are knowledgeable on the subject matter discussed. For more information on what should be included with opinion piece submissions, click here: hilltimes.com/submit-an-article. Submissions can be sent to editor Hannah Daley at hdaley@thewirereport.ca. To see previous opinion piece submissions, click here: thewirereport.ca/tag/opinion/.

OPINION | Cloudy with a chance of sovereignty: protecting our data beyond borders

Opinion |
By John Menezes
| May 26, 2025

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

OPINION | Cloudy with a chance of sovereignty: protecting our data beyond borders

Opinion | By John Menezes | May 26, 2025

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

OPINION: What should communications policy look like under a Carney government?

OPINION: Safeguarding Canada’s sovereignty, economy, democratic institutions depends on strengthening our cybersecurity posture

OpenMedia calls federal digital policy ‘disaster’, makes pitches for feds’ consideration

Online harms and more in focus as Parliament returns

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Opinion |
By John Menezes
| May 26, 2025