Totara hosting in Canada: data residency, sovereignty and what the law requires

"Is our data stored in Canada?" is usually the first hosting question in a Canadian LMS evaluation. It is a good question, and it is rarely the whole one. Where your learning records physically sit, which law can compel access to them, and what your own privacy obligations require are three different things, and a hosting decision made on the first alone can leave the other two unanswered.

This guide covers what Canadian privacy law requires, where the real residency obligations sit, and the questions worth putting to any host of your Totara LMS, including us.

Residency and sovereignty are not the same thing

Data residency is geography: the data centre your Totara site and its backups run in.

Data sovereignty is jurisdiction: which country's laws can reach that data, and through whom.

Think of a safety deposit box. Residency tells you which city the bank is in. Sovereignty tells you whose court orders the bank has to obey. A Canadian vault run by a company answerable to a foreign court is in Canada, and it is still within that court's reach.

That is the point of the US CLOUD Act. It confirms that a provider subject to US jurisdiction must produce data in its possession, custody or control whether that data is stored inside or outside the United States. The test is the provider's exposure to US jurisdiction, not the location of the server, and it is not limited to US-headquartered companies.

Residency still matters. It fixes which privacy statutes and breach rules apply to the stored data, and for some organizations it is a legal requirement. It is the necessary first answer, not the complete one.

What Canadian law actually requires

Less than most procurement templates assume, and more in a few specific places.

Private sector organizations under PIPEDA

PIPEDA does not prohibit transferring personal information outside Canada for processing. The Office of the Privacy Commissioner of Canada treats that transfer as a use of the information, and holds the transferring organization accountable for protecting it in the processor's hands, typically through contract. In September 2020 the OPC confirmed it would keep that position.

So for most private sector employers, Canadian hosting is a risk and trust decision rather than a statutory one.

Québec

Québec's private sector law does not ban transfers either, but section 17 sets a process. Before personal information is communicated outside Québec, the organization must complete a privacy impact assessment, conclude that the information will be adequately protected, and put the transfer under a written agreement that reflects the assessment.

The detail that catches people: "outside Québec" includes the rest of Canada. A Toronto data centre is in Canada and outside Québec. If you hold personal information about Québec residents, ask your host which province your data centre is in, and plan the assessment either way.

Public bodies in British Columbia and Nova Scotia

British Columbia was the strictest province until November 2021, when amendments to its Freedom of Information and Protection of Privacy Act removed the requirement that public bodies store and access personal information only in Canada. BC public bodies now work under a risk-based model with assessment requirements for sensitive information.

Nova Scotia's Personal Information International Disclosure Protection Act still makes it unlawful for public bodies and municipalities to store personal information outside Canada, or allow access to it from outside Canada, unless the head of the body authorizes it as necessary for operations. It also places obligations on service providers acting for those bodies. The province has announced that these rules will move into modernized legislation, so check the status at the time you buy.

Healthcare, funded organizations and contract flow-downs

Health information custodians in several provinces work under their own health information statutes, which add assessment and agreement obligations on top of the general privacy law. Check yours, and check your own policy, which may be stricter than the statute.

The most common residency requirement in practice is not a statute at all. It is a clause flowed down from a government funder, a health authority or an enterprise client. If your organization delivers training under someone else's contract, read that contract before you read the privacy law.

Your three ways to host Totara

Totara is not tied to a single vendor's cloud, which is what makes the location question yours to answer.

Self-hosted. Totara can be installed on your own infrastructure, in your own data centre or your own cloud tenancy. You control location and jurisdiction completely, and you carry patching, upgrades, backups, security monitoring and availability yourself.

Hosted by Totara. Totara runs its own hosted service, Totara Cloud. Ask which region your site and backups would sit in, and put that answer in the agreement.

Hosted by a partner. A Totara partner runs the platform for you and usually adds implementation, support and integration work. Location, infrastructure and jurisdiction vary by partner, which is why the questions below matter.

Questions to put to any Totara host

Ask these in writing. A host that answers them clearly is telling you something, and so is one that does not.

• Which country and province are the production site, the backups and the disaster recovery copy in?
• Is the hosting location written into the agreement, and what notice do we get before it changes?
• Who owns and operates the data centre, and are they subject to foreign jurisdiction?
• Which sub-processors can access our data, and from which countries do support staff and administrators connect?
• What independent attestation covers the infrastructure, and can we see the current report?
• How and when will you tell us about a legal demand for our data, where the law allows you to?
• On exit, how do we get a complete copy of our data, and how is deletion confirmed?

Choosing Canadian hosting is not always right

If you are a private sector employer with no public sector, health or contractual obligation, PIPEDA lets you host outside Canada with proper safeguards. A host in another country with stronger operational fit may be the better choice for you, and the decision should rest on your risk assessment rather than on a flag.

If your privacy concern is foreign government access, Canadian residency alone does not close it. Look at the jurisdiction of every company in the chain, and at encryption and key control.

How Lambda Learning hosts Totara, answered against our own questions

We do not own data centres. Lambda Learning hosts Totara on Amazon Web Services, currently in four regions: Canada (ca-central-1), the United States (us-east-1 and us-west-2) and Europe (eu-west-1).

For a Canadian customer, that means data is stored, loaded, updated and deleted on services wholly within the Canadian region.

It also means the honest answer to our own third question is that AWS is a US-headquartered provider and therefore within the reach of the CLOUD Act, as almost every major cloud platform is. We would rather you read that here than discover it in a procurement review. If foreign jurisdiction is the risk you are managing rather than residency, that fact belongs in your assessment, and we will work through it with you.

Totara runs on the same hosting infrastructure as our managed Moodle service. The independent attestation for that infrastructure is AWS's own SOC 2 Type II report, issued for AWS and available to AWS customers through AWS Artifact. We operate the service in line with PIPEDA and our privacy policy at https://www.lambdalearn.io/company/legal/privacy-policy

Hosting is one part of the service. Lambda Learning also delivers Totara implementation, upgrades, integrations and support, so the people who run your servers are the people who know your configuration. We have been running enterprise learning platforms since 2002.

We will answer every question in the list above in writing during your evaluation, and if a host outside Canada or self-hosting suits your obligations better, we will tell you.

Frequently asked questions

Can Totara be hosted in Canada? Yes. Totara can be self-hosted, hosted by Totara or hosted by a partner, so the location is your decision. Lambda Learning hosts Totara in the AWS Canadian region.

Does PIPEDA require data to stay in Canada? No. PIPEDA allows transfers outside Canada for processing, provided the organization remains accountable and protects the information through contract and other means.

Is Canadian data residency the same as data sovereignty? No. Residency is where data is stored. Sovereignty is which country's laws can compel access to it. A provider subject to foreign jurisdiction can be required to produce data it stores in Canada.

Does hosting in Canada satisfy Québec Law 25? Not automatically. Section 17 applies to any communication of personal information outside Québec, including to other provinces, so a data centre elsewhere in Canada still calls for a privacy impact assessment and a written agreement.

Which Canadian organizations are legally required to keep data in Canada? The clearest statutory requirement applies to Nova Scotia public bodies and municipalities and their service providers. British Columbia removed its equivalent rule in 2021. In practice, many requirements come from funder, health authority or client contracts rather than statute.

Where does Lambda Learning host Totara? On Amazon Web Services, in four regions: Canada, two in the United States, and Europe. Canadian customers are hosted wholly within the Canadian region.

Is Totara Cloud hosted in Canada? Ask Totara directly and confirm the region in your agreement. We have not verified Totara Cloud's current hosting regions.

Talk it through

Bring your residency requirements, your funder clauses and your procurement questions. We will tell you what Canadian hosting solves for you and what it does not.

Book a demo: https://www.lambdalearn.io/schedule-a-meeting-lambda-suite

Talk to a specialist: https://www.lambdalearn.io/schedule-a-meeting-lambda-suite

This page summarizes privacy legislation for general information and is not legal advice.

Totara is a registered trademark of Totara Learning Solutions Ltd. Lambda Learning Inc. is a Totara Platinum Partner.