Policies Internal operating policies
Data Residency Policy
Defines where Map.ca stores and processes data. Canadian-first residency wherever practical; disclosure when trusted vendors process data outside Canada.
- Version
- 0.1.0
- Effective
- May 20, 2026
- Last reviewed
- May 20, 2026
- Review cycle
- every 6 months
- Master Policy Index entry
- §4 #11
Policy text
Map.ca’s default is Canadian-first data residency wherever practical, with clear disclosure when trusted vendors process data outside Canada. The Data Residency Policy defines which categories of data must stay in Canada, which can be processed elsewhere under disclosure, and how that disclosure is surfaced to users.
It applies to engineering, procurement, and any staff member who selects a vendor. The AI Vendor Policy and Vendor Security Policy carry through specific residency requirements for AI and security vendors.
Principles this policy enforces
- Collect less, protect more
- Public data and personal data are not the same thing
- Indigenous data sovereignty is foundational
What it requires
- Default sensitive data to Canadian residency.
- Disclose vendor residency publicly when data is processed outside Canada.
- Apply stricter residency rules to civic and Indigenous data.
What it forbids
- Do not move sensitive data outside Canada without disclosure.
- Do not engage a vendor whose residency cannot be verified.
How it applies
- Engineering and infrastructure teams
- Procurement
- Vendors processing Map.ca data
References
- PIPEDA — accountability for transferred personal information
- Quebec Law 25 — cross-border transfer requirements
Related policies
AI Vendor Policy
Standards that AI vendors must meet to handle Map.ca traffic — data handling, training restrictions, audit requirements.
Vendor Security Policy
Security requirements Map.ca holds vendors to before, during, and after engagement.
Privacy Policy
What Map.ca collects, why, how long it is kept, who it is shared with, and what rights people have.
Indigenous Data Sovereignty Policy
How Map.ca handles Indigenous community data, cultural places, traditional knowledge, names, language, heritage, and map layers.