Data residency

Who owns my data in business software?

Ownership is a contract question. Accountability is a statutory one. You can own every record in a system and still be the person answering for it when something goes wrong — and you usually are.

The sixty-second answer

In most contracts you own the records you put into business software, and the vendor holds a limited licence to process them. But ownership is only one of three questions. The others — can you actually extract the data, and who answers for it under Canadian law — matter more in practice.

Three questions that get confused with each other

"Who owns my data" sounds like one question. It is three, and mixing them up is how small businesses end up with a contract that says the right thing and a situation that does not.

Ownership is contractual. It decides who has the legal claim to the records and what the vendor may do with them. It is written down and it is negotiable.

Access is practical. It decides whether you can actually get the records out, in a usable form, on a day when the relationship has gone cold. No clause guarantees this; only a tested export does.

Accountability is statutory. It decides who answers when a customer asks what you hold about them, or when something leaks. In Canada this does not move with the data. It stays with the business that collected the information.

A contract can settle the first. Only you can settle the second. And the third was never yours to give away.

What the contract usually says

Most reputable business software contracts state that the customer retains ownership of customer content, and grant the vendor a licence to host, process, transmit and display that content solely to provide the service. That is the shape you want. Read for four specific things.

Scope of the licence. "Solely to provide the service" is the phrase that matters. A licence broad enough to cover product improvement, analytics across customers, or model training is a materially different agreement, and it should be an explicit choice rather than a default.

Export rights. Look for a right to export in a machine-readable format, at any time, without a fee. If export is described only as something support can help with, that is not a right.

Retention after termination. A stated number of days during which you can still retrieve everything, and a stated fate afterwards. Ambiguity here is the most expensive kind, because it only becomes relevant when you are already leaving.

Deletion on request. The ability to require deletion, and to receive confirmation of it. You need this to meet your own obligations, which is the next section.

Accountability does not transfer

This is the part that surprises owners. If you collect personal information from your customers, PIPEDA's obligations attach to you. Schedule 1 requires that the purposes for collection be identified before or at the time of collection (Principle 2), that collection and use rest on the individual's knowledge and consent (Principle 3), and that information not be used or disclosed for purposes other than those consented to (Principle 5) [1].

Two further principles determine whether your software choice is workable. Principle 8 requires that your policies and practices relating to the management of personal information be made readily available to individuals [1] — which means you have to know what those practices are, including whose servers are involved. Principle 9 provides that on request an individual shall be informed of the existence, use and disclosure of their personal information, be given access to it, and be able to challenge its accuracy and have it amended [1].

Read that last one against the software you actually run. A customer emails asking what you hold. Can you tell them, completely, within a reasonable time? If the answer requires exports from five systems and a search of an inbox, your problem is not the contract. It is the architecture. Our guide to PIPEDA requirements for small businesses works through the obligations in order.

Clause 4.5.3 is the one most often ignored: personal information that is no longer required should be destroyed, erased or made anonymous, and organisations shall develop guidelines and implement procedures to govern that destruction [1]. A vendor cannot do this for you, because only you know what you still need.

Where the data physically sits

Canadian law does not forbid storing personal information outside Canada. What it does is keep the accountability with you wherever the data goes, which turns location into a practical question rather than an ideological one: who can compel access to these records, under whose legal process, and how quickly can you get a straight answer about it?

There is a national dimension here that Parliament has stated in plain terms in a related field. Section 7 of the Telecommunications Act opens by affirming that telecommunications performs an essential role in the maintenance of Canada's identity and sovereignty, and sets out policy objectives including the orderly development throughout Canada of a telecommunications system [6]. The infrastructure that carries a country's business is treated as a matter of sovereignty, not merely of price.

For a small business the practical version is simpler. Ask the vendor where the data sits and who operates the facility. A vendor that answers with a region code and nothing else has told you they do not expect the question. Our article on Canadian-hosted business software covers what the answer should look like.

Ownership means nothing without an exit

The clearest test of ownership is whether you can leave. Not whether you want to — whether you could, this month, with everything.

Domain names are the useful comparison because the rules there are explicit. Under ICANN's Transfer Policy, registered name holders must be able to transfer their registrations between registrars, transfer processes must be clear and concise, a registrar may deny a transfer only in enumerated instances and must give the reason to both the holder and the gaining registrar, and a transfer lock must be removed or an accessible removal method provided within five calendar days [2]. That is what portability looks like when someone has written it down.

Business software has no equivalent regime, so you have to create the equivalent yourself: request a full export during your trial, open it, and confirm it contains history and attachments rather than a list of names. Do that once, before you commit, and again periodically. Our walkthrough on switching business software without downtime covers what to do with the export when the day comes.

Testing what a vendor tells you

Data-handling claims are marketing claims, and Canadian law treats them accordingly. Under the Competition Act, a representation to the public that is false or misleading in a material respect is reviewable, and a representation about the performance or efficacy of a product must be based on an adequate and proper test — the proof of which lies on the person making the representation [3]. If a vendor states a security or reliability figure, asking what supports it is not adversarial; it is the statute's own allocation of proof.

The same discipline applies to anything you send. Canada's Anti-Spam Legislation requires consent, express or implied, before a commercial electronic message and requires prescribed identifying and contact information within it [5]. If your consent records live in a vendor's system, your ability to prove consent depends on your ability to get those records out — which loops back to the export question.

Why this is a small-business problem specifically

As of December 2024 there were 1.10 million employer businesses in Canada, and 1.08 million of them — 98.2 per cent — were small [4]. Almost nobody at that scale has counsel reviewing a software agreement. The realistic defence is not legal review of every contract; it is a short checklist applied consistently: do I own it, can I export it, how long after cancellation, and can they use it for anything else.

Where we sit

Your data in MapleWorkSuite is yours. We hold it to run the apps you have switched on, on Canadian infrastructure operated by a Canadian company, and we will tell you where any specific piece of it sits if you ask. We do not use your customer records for anything other than operating your account.

Export is available in a form you can open without us, because a vendor that makes leaving difficult has told you what they think of their own product. And we will not claim that choosing us makes you compliant — nothing you buy does that. What consolidation does is remove the excuse of not knowing where your data is, which is where most small-business privacy failures actually begin.

If you are auditing this across everything you run, start by listing every system holding customer records. Our guide to how many subscriptions you actually need is built around that same count, and it is usually longer than owners expect.

Frequently asked questions

Who owns my data in business software?

In most contracts, you do — the customer records, documents and content you put in remain yours, and the vendor holds a licence to process them in order to run the service. But ownership on paper is only one of three things that matter, alongside whether you can extract the data and who is accountable for it under Canadian law.

If I own my data, why can it be hard to get out?

Because ownership and access are separate. A contract can grant you ownership while the practical export is a partial file missing history, attachments or timestamps. Always test the export before you depend on it, and treat a vendor's willingness to demonstrate one as part of the buying decision.

Does my privacy responsibility transfer to the software vendor?

No. If you collect personal information from your customers, you remain accountable for it under PIPEDA, including for identifying purposes, obtaining consent, and making your policies readily available. Choosing a vendor is a way of meeting that responsibility, never a way of transferring it.

What happens to my data if I stop paying?

This is the single most important clause to read before you sign. Ask how long the data is retained after cancellation, in what form it is available, and what happens after that window. Assume access ends the day billing does unless the contract says otherwise in plain words.

Does it matter where my data is physically stored?

It matters for who can compel access to it and how quickly you can get answers. Canadian privacy law does not prohibit storing data outside Canada, but it keeps you accountable for it wherever it goes, so you need to be able to say where it sits and who can reach it.

Can a vendor use my customer data to train or improve their systems?

Only if you have permitted it and your own consents allow it. Read the clause specifically. Your customers gave you their information for your stated purpose, and PIPEDA bars use or disclosure for other purposes without consent — a secondary use by your vendor is exactly that kind of new purpose.

What should a data ownership clause actually say?

That you retain ownership of your content; that the vendor's licence is limited to operating the service for you; that you can export in a machine-readable format at any time; that the retention window after cancellation is stated in days; and that the data is deleted on request with confirmation.

How do I check a vendor's claims about security and data handling?

Ask what test or audit supports any specific claim. Under Canadian competition law the proof of an adequate and proper test for a performance claim rests on the party making it, so requesting the basis of a stated figure is fair. Vague assurances that cannot be evidenced should be treated as marketing.

Sources and evidence

Every link below was fetched and read on September 2, 2026. Where a source did not support a claim, the claim was cut rather than softened.

  1. Personal Information Protection and Electronic Documents Act, Schedule 1 Principle 2 requires purposes to be identified before or at collection; Principle 3 requires knowledge and consent; Principle 5 bars use or disclosure for other purposes without consent; clause 4.5.3 requires information no longer required to be destroyed, erased or made anonymous under developed guidelines and implemented procedures; Principle 8 requires policies and practices to be readily available to individuals; Principle 9 gives individuals access on request and the right to challenge accuracy and have information amended.
  2. ICANN Transfer Policy Registered Name Holders must be able to transfer registrations between registrars and transfer processes must be clear and concise; denial is limited to enumerated grounds and a registrar must give the reason to both the holder and the gaining registrar, with locks removable within five calendar days.
  3. Competition Act, section 74.01 Paragraph (1)(a) covers representations to the public that are false or misleading in a material respect; paragraph (1)(b) requires performance or efficacy claims to rest on an adequate and proper test, the proof of which lies on the person making the representation.
  4. Innovation, Science and Economic Development Canada — Key Small Business Statistics 2025 As of December 2024 there were 1.10 million employer businesses in Canada, of which 1.08 million (98.2%) were small businesses, 16,953 medium-sized and 3,380 large.
  5. Canada's Anti-Spam Legislation (Electronic Commerce Protection Act), section 6 Subsection 6(1) prohibits sending a commercial electronic message unless the recipient consented expressly or by implication and the message complies with subsection 6(2), which requires prescribed identifying and contact information.
  6. Telecommunications Act, section 7 Affirms that telecommunications performs an essential role in the maintenance of Canada's identity and sovereignty and sets out the objectives of Canadian telecommunications policy, including the orderly development throughout Canada of a telecommunications system.

MapleWorkSuite runs on Canadian infrastructure operated by a Canadian company. Ask us where any specific piece of your data sits and you will get a direct answer rather than a region code.

See all products See all products More articles