Where Does Your Accreditation Data Live?

You probably don't think about it much. Your accreditation evidence lives in spreadsheets on your departmental server, or in a shared drive, or in the cloud service your IT department approved three years ago. The question of where the data physically sits seems like someone else's problem. Until the procurement committee asks, "Where does this tool host our data?" and suddenly the question is yours.

For Canadian engineering programs, data residency is a question your privacy office and procurement committee will almost certainly ask. The landscape is more complicated than it used to be, with stricter provincial privacy rules (Quebec’s Law 25 in particular), AI tools that may process your evidence on foreign servers, and a US law called the CLOUD Act that lets US authorities compel US service providers to produce data they control — regardless of where it is stored.

This post breaks down what data residency actually means for accreditation evidence, what the laws require, and why the choice of tool matters more than most coordinators realize.

What Is Data Residency, and Why Should a Coordinator Care?

Data residency is the physical and legal location where your organization's data is stored and processed. It is not the same as data sovereignty, which is the broader question of which country's laws apply to your data. But the two are related: where data lives determines which government can access it.

For accreditation, the data in question includes:

• Student assessment scores and learning outcome data
• Faculty teaching evaluations and course outlines
• Continuous improvement reports and corrective action plans
• Self-study documents and evidence of Graduate Attribute coverage
• Visitor team reports and compliance findings

Much of this is personal information under Canadian privacy law: student names linked to assessment data, faculty performance information, individual course-level results. Which law applies depends on who holds the data. The Office of the Privacy Commissioner (OPC) notes that PIPEDA covers private-sector organizations collecting, using or disclosing personal information in the course of commercial activity, and that universities are generally covered by provincial laws, although PIPEDA may apply in certain situations [3]. In practice, that means your institution’s own obligations usually come from provincial legislation, while a vendor selling you the tool is likely subject to PIPEDA or a provincial private-sector law.

Privacy law does not just say "keep data safe." PIPEDA’s fair information principles, for example, include identifying the purposes for collection, limiting use to those purposes, and applying safeguards appropriate to the sensitivity of the information [2]. When you choose a cloud-based accreditation tool, you are handing your personal information to a third party. Where that third party stores and processes the data determines your compliance exposure.

What PIPEDA Actually Requires

PIPEDA is built on ten fair information principles [2]. The ones most relevant to data residency are:

Safeguards (Principle 7): Personal information must be protected by appropriate security relative to the sensitivity of the information [2]. The OPC’s cross-border guidance adds that, wherever the information is processed, the organization must take all reasonable steps to protect it, and that the third-party processor must provide a “comparable level of protection,” which the OPC describes as generally equivalent rather than identical [1].

Accountability (Principle 1): An organization is responsible for personal information under its control [2], including information transferred to a third party for processing, where it must use contractual or other means to provide a comparable level of protection [1]. You cannot outsource your accountability.

PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing, and it does not distinguish between domestic and international transfers [1]. But the Privacy Commissioner has published guidelines for processing personal data across borders that set out what is expected [1]:

• You remain accountable for the data even after it leaves Canada
• The primary means of protecting information sent to a processor is a contract, and the organization should be satisfied that the processor has appropriate policies and security measures in place
• You cannot override the laws of a foreign jurisdiction by contract
• Organizations should make it plain to individuals that their information may be processed in a foreign country and may be accessible to that country’s law enforcement and national security authorities

In short: PIPEDA does not forbid US-hosted tools, but accountability stays with the organization that sends the data. The OPC also notes that some transfers may be unwise because of the uncertain nature of the foreign regime, and that some information may be so sensitive that it should not be sent to any foreign jurisdiction [1]. If a US-based accreditation tool stores Canadian student data on US servers, your institution's privacy officer needs to be comfortable with that arrangement.

The CLOUD Act Problem

Here is the part that most software vendors don't tell you. In March 2018, the US Congress adopted the Clarifying Lawful Overseas Use of Data Act — the CLOUD Act. Among other things, it amends the Stored Communications Act to make explicit that US service providers must preserve and produce data they control regardless of where it is stored [6]. It was aimed at criminal investigations.

This means a US service provider may be subject to a US production order for data it controls even if that data sits in a Canadian data centre, so the provider’s corporate structure matters alongside its server location. How the Act applies to a Canadian subsidiary of a US company is a question for legal counsel, but it is worth asking the vendor directly.

The OPC’s own guidance recognizes the underlying issue: information processed in a foreign country may be accessible to that country’s courts, law enforcement and national security authorities, and organizations should say so plainly to the people concerned [1].

Whether your accreditation evidence counts as sensitive is a judgment for your privacy office, but student-linked outcomes and faculty assessments are the kind of material they tend to take seriously.

Quebec's Law 25 Raises the Bar

If your institution is in Quebec, the rules are stricter. Quebec’s modernized privacy law (Law 25, formerly Bill 64) amended both the Act respecting the protection of personal information in the private sector, which applies to vendors operating an enterprise in Quebec [4], and the Act respecting access to documents held by public bodies, which covers Quebec’s university institutions [5]. Among the requirements:

• Privacy impact assessments (PIAs): Required for any project to acquire, develop or overhaul an information system involving personal information, and before communicating personal information outside Quebec (ss. 3.3 and 17 of the private-sector act; ss. 63.5 and 70.1 of the public-sector act) [4][5]
• Person in charge of personal information: By default the person with the highest authority in the organization, who may delegate the function in writing; the title and contact information must be published [4]
• Notice of possible transfers: When collecting personal information, the organization must inform the individual, where applicable, of the possibility that the information could be communicated outside Quebec (s. 8) [4]
• Breach notification: Where a confidentiality incident presents a risk of serious injury, the Commission d'accès à l'information and the people concerned must be notified promptly (s. 3.5) [4]
• Penalties: Under the private-sector act, administrative monetary penalties of up to CAD 10 million or, if greater, 2% of worldwide turnover for the preceding fiscal year, and penal fines of up to CAD 25 million or, if greater, 4% of worldwide turnover (ss. 90.12 and 91) [4]

For a Quebec-based engineering program evaluating a new accreditation tool, this means a privacy impact assessment is part of the process, and the tool’s data residency and cross-border transfer practices belong in it. Your institution’s privacy office can tell you exactly how the rules apply to your situation.

AI Tools Add Another Layer

The accreditation software market has a new category of tools that use AI to analyze evidence — mapping syllabi to learning outcomes, drafting self-study sections, identifying gaps. These tools introduce a data residency question that goes beyond storage: where does the AI processing happen?

Some AI services process data on cloud infrastructure controlled by US companies. When you upload a syllabus to an AI-powered accreditation tool, that document may be transmitted to a US server for analysis, stored temporarily in a US jurisdiction, and potentially used to improve the AI model itself. Even if the final output is returned to you, the intermediate processing has occurred under US jurisdiction.

This raises two distinct compliance questions:

1. Is the AI processing itself a cross-border transfer? If your evidence document crosses the border for AI analysis, that is a transfer of personal information for processing. Under PIPEDA, the organization remains accountable and must use contractual or other means to provide a comparable level of protection [1]; in Quebec, a privacy impact assessment is required before communicating personal information outside the province [4][5].

2. Is the AI using your data for model training? Some AI providers include customer data in their training sets unless you opt out. For accreditation evidence, this could mean your institution's assessment data — including student performance information — is being used to train a model that serves other organizations. Under PIPEDA’s limiting use principle, personal information can only be used for the purposes for which it was collected unless the individual consents otherwise [2].

When evaluating AI accreditation tools, ask these questions before you upload anything:

1. Where is the AI processing hosted?
2. Is the processing covered by a Canadian data processing agreement?
3. Is your data used to train the underlying AI model?
4. Can you delete all traces of your data after processing?
5. Does the provider have a Canadian subsidiary or entity that takes legal responsibility for the data?

What Canadian Universities Actually Do

Practice varies widely by institution, so check your own IT procurement and privacy policies. Themes you are likely to encounter include:

• Preference for Canadian hosting: Some institutions require or prefer that SaaS tools host data within Canada, either as a formal policy or as a procurement preference.
• Data processing agreements (DPAs): If data must leave Canada, institutions commonly require a legally binding DPA. This document specifies the processor's obligations, security standards, and cross-border transfer safeguards.
• Privacy review for sensitive systems: Tools handling student or faculty data typically go through a privacy review before procurement approval. The privacy officer will ask about data residency, cross-border transfers, and security certifications.

The bottom line: if your institution has a data residency policy, the accreditation tool you use must comply, and a US-hosted tool may not pass procurement review regardless of its features.

Three Questions to Ask Before You Choose

When evaluating accreditation software, these are the data residency questions that matter:

1. Where is the data stored? Not just the production database, but backups, logs, analytics, and any AI processing infrastructure. Ask for a data map: where each category of data lives, and whether any category crosses borders.

2. Who owns the data? Your evidence, your mappings, your assessments — you should own them outright. The tool should provide full data export on demand, in a structured format. If the vendor retains copies for "service improvement" purposes, that should be opt-in, not default.

3. What is the legal jurisdiction? A Canadian company hosting data in Canada means Canadian law applies. A US company — even with Canadian data centres — means the CLOUD Act can apply. A Canadian subsidiary of a US company may mean both jurisdictions apply. Ask about corporate structure, not just server location.

The Practical Bottom Line

Data residency is not a checkbox on a feature comparison sheet. It can block a software purchase at the final stage if the privacy office or procurement review rejects it because the data crosses the border.

For Canadian engineering programs, the simplest path is a Canadian-hosted tool that handles CEAB accreditation natively, keeps all data within Canadian jurisdiction, and provides a DPA that aligns with your institution's policy. That is what MapOutcomes was built for. Canadian-hosted. PIPEDA-compliant. CEAB-native from day one.

The alternative is building a business case for cross-border data transfer. That may mean a privacy impact assessment, a legal review of the provider's terms, a DPA negotiation, and a procurement exception if your institution's policy requires Canadian hosting. If the features of a US-hosted tool are worth all that effort, go for it. But know what you are signing up for.

References

1. Office of the Privacy Commissioner of Canada, "Guidelines for processing personal data across borders," Privacy Commissioner of Canada. [Online]. Available: https://www.priv.gc.ca/en/privacy-topics/personal-information-transferred-across-borders/gl_dab_090127/
2. Office of the Privacy Commissioner of Canada, "PIPEDA fair information principles," Privacy Commissioner of Canada. [Online]. Available: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/
3. Office of the Privacy Commissioner of Canada, "PIPEDA requirements in brief," Privacy Commissioner of Canada. [Online]. Available: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/
4. Gouvernement du Québec, "Act respecting the protection of personal information in the private sector, CQLR c. P-39.1," LegisQuébec. [Online]. Available: https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1
5. Gouvernement du Québec, "Act respecting access to documents held by public bodies and the protection of personal information, CQLR c. A-2.1," LegisQuébec. [Online]. Available: https://www.legisquebec.gouv.qc.ca/en/document/cs/A-2.1
6. Eurojust, "The Cloud Act," European Union Agency for Criminal Justice Cooperation. [Online]. Available: https://www.eurojust.europa.eu/publication/cloud-act