Data Residency in Canada: Microsoft's $19B Buildout and Law 25

On December 9, 2025, Microsoft announced that its investments in Canada will reach 19 billion dollars (CAD) between 2023 and 2027, including 7.5 billion in new commitments over the next two years (per Microsoft On the Issues). A large share of that money goes into datacentre capacity for the Canada Central region in Toronto and the Canada East region in Quebec City, with new capacity coming online in the second half of 2026. If your business runs on Microsoft 365, the obvious question follows: what does data residency in Canada actually mean for your tenant?

The answer has more nuance than the headlines suggest. Some of your Microsoft 365 data already sits in Canadian datacentres and has for years. Some of it never touches Canada at all. And under Quebec's Law 25, where your data sits is only half the compliance story, because the law cares about any personal information that leaves the province, not just the country.

Here's what Microsoft committed to, what stays on Canadian soil in your tenant, what doesn't, and what to verify before answering a client questionnaire with confidence.

Key Takeaways

• Microsoft plans 19 billion dollars in Canadian investments through 2027, with new datacentre capacity arriving in late 2026.
• Exchange, SharePoint, OneDrive, Teams and Copilot interaction data already sit in the Canada geo for Canadian tenants.
• Entra ID, Intune and Forms data for Canadian tenants is stored in the United States.
• Law 25 requires a privacy assessment before personal information leaves Quebec, including transfers to other provinces.
• Verify your data location in the Microsoft 365 admin centre before promising residency to anyone.

What Microsoft Announced for Canada in 2026

The December announcement is Microsoft's largest infrastructure commitment in Canada to date. The concrete pieces, all confirmed in the official blog post:

• 19 billion dollars invested between 2023 and 2027, with 7.5 billion of that landing over the next two years.
• Expanded capacity in both Canadian Azure regions, Canada Central (Toronto) and Canada East (Quebec City), coming online in the second half of 2026.
• Three sovereignty measures for 2026: in-country processing for Copilot interactions, an expanded Azure Local offering for customer-owned environments, and a Sovereign AI Landing Zone for Canada.
• A new Threat Intelligence Hub in Ottawa, plus a pledge to defend the continuity of cloud services for Canadian government customers.

Microsoft frames the package as a way to "keep Canadian data on Canadian soil", and the message lands: in its 2026 Internet Trends Report, CIRA found that 67 per cent of Canadians consider it important that their personal data be stored on servers in Canada (per CIRA). Quebec SMBs feel the same pressure in client contracts and RFPs, where data sovereignty questions now show up by default.

What Data Residency in Canada Actually Covers in Microsoft 365

Data residency means one specific thing: where your customer data is stored at rest. It doesn't automatically cover where data gets processed, where support engineers connect from, or where telemetry ends up. Keep that distinction in mind, because vendors blur it constantly.

Stored in the Canada geo by default

If your tenant was created with a Canadian billing address, Microsoft's Product Terms commit to storing core customer data at rest in the Canadian datacentre geography, which spans Toronto and Quebec City (per Microsoft Learn). That covers:

• Exchange Online mailbox content
• SharePoint and OneDrive files
• Teams chat and channel messages
• Microsoft 365 Copilot and Copilot Chat interactions: prompts, responses, citations and the semantic index (per Microsoft Learn)
• Planner and Viva Learning data for Canadian tenants

You can confirm your own tenant's location in the Microsoft 365 admin centre under Settings, Org settings, Organization profile, Data location. Two minutes, and you have evidence for your compliance file.

What lives outside Canada

Several services that Canadian tenants use every day store their data in the North America geography, which runs on datacentres in the United States:

• Microsoft Entra ID. Directory data for Canadian tenants maps to the North America geo, with no Canada-specific commitment (per Microsoft Learn). Your user accounts, groups and Conditional Access configuration live there.
• Microsoft Intune. Intune's North America region uses US datacentres, and Canada isn't one of Intune's local geographies (per Microsoft Learn). Device inventory and policy data for a Quebec tenant sits in the US.
• Microsoft Forms and others. Forms data for Canadian tenants is stored in the United States, and advanced Viva Insights reports resolve to the broader Americas region.

Processing is the other gap. Until the in-country commitment ships, Copilot requests from Canadian tenants can be processed by infrastructure outside the country even though the stored interaction history stays in Canada. That gap is exactly what Microsoft's 2026 commitment is meant to close, so watch the rollout instead of assuming it's already live.

Law 25 Cross-Border Data Transfer Rules Still Apply

Law 25 requires an assessment of privacy-related factors, better known as a privacy impact assessment (PIA), before a business communicates personal information outside Quebec. Not outside Canada. Outside Quebec. Storage in a Toronto datacentre is a cross-border communication in the eyes of the law, exactly like storage in Virginia.

The assessment weighs the information's sensitivity, its purposes, the protections applied, and the destination's legal regime. The transfer can proceed only if the information will receive adequate protection, and it must be covered by a written agreement.

In practice, Canadian residency makes the exercise much easier. Ontario storage supports a straightforward adequacy argument; US storage demands more analysis, particularly around government access laws. That's why the Entra ID, Intune and Forms locations above belong in your PIA even if your mailboxes never leave the country.

Two practical implications:

• Microsoft 365 data in the Canada geo replicates between Quebec City and Toronto for resilience. Your assessment should assume interprovincial movement even when a Quebec City datacentre holds a copy.
• Your Microsoft tenant is only one supplier. Backup, archiving and line-of-business tools each have their own storage story. When we compared Microsoft 365 Backup and Dropsuite, data location was a deciding criterion for Law 25 shops.

If none of this is formalized at your company yet, our Law 25 and Microsoft 365 guide walks through the full obligation list, from designating a privacy officer to keeping incident registers.

What to Verify in Your Tenant Before 2027

A checklist you can run this month:

1. Confirm your data location. Microsoft 365 admin centre, Settings, Org settings, Organization profile, Data location. Save a screenshot.
2. Map every workload. Microsoft publishes per-service data location tables. Anything resolving to the United States or a macro region goes into your PIA.
3. Decide whether Multi-Geo applies. Multi-Geo pins specific users' data to satellite geographies via a preferred data location. It needs an Enterprise or CSP agreement plus units for over 5 per cent of eligible licences; most SMBs can skip it.
4. Evaluate Advanced Data Residency. The ADR add-on extends residency commitments to more workloads for local geographies like Canada. It requires licences for every user and matters most when a tenant provisioned in a macro region needs its data moved.
5. Watch the Copilot processing rollout. When in-country processing for Copilot interactions goes live, update your PIA to reflect it.
6. Review your other suppliers. Your backup vendor, your remote management tool, your line-of-business SaaS: each deserves the same residency question.

This is the kind of review we fold into our cloud solutions engagements, usually alongside a licensing and Conditional Access pass, because the same hour in the tenant answers all three questions.

FAQ

Is Microsoft 365 data stored in Canada?

Mostly yes, for tenants created with a Canadian address. Exchange Online mailboxes, SharePoint and OneDrive files, Teams messages and Copilot interaction content are stored at rest in Microsoft's Toronto and Quebec City datacentres. Notable exceptions exist: Entra ID, Intune and Forms data for Canadian tenants is stored in the United States.

Does storing data in Canada satisfy Law 25?

Not by itself. Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec, and that includes other Canadian provinces. Canadian storage usually makes the assessment straightforward, but you still need to perform it, document it and cover the transfer with a written agreement.

Where is Microsoft 365 Copilot data stored for Canadian tenants?

The content of Copilot interactions, meaning prompts, responses and citations, plus the semantic index, is stored at rest in the Canada geography for eligible Canadian tenants. Request processing has not been limited to Canada so far. Microsoft committed to in-country processing for Copilot interactions as part of its 2026 buildout.

What is Advanced Data Residency in Microsoft 365?

ADR is a paid add-on that extends data residency commitments to additional services, including Exchange Online, SharePoint, OneDrive, Teams, Copilot, Defender for Office Plan 1 and several Purview features. It requires a subscription for all users in the tenant. It's mainly valuable when tenant data currently sits in a macro region and you want it migrated to your local geography.

Sources

• Microsoft Deepens Its Commitment to Canada with Landmark $19B AI Investment, Microsoft On the Issues
• Microsoft 365 data locations, Microsoft Learn
• Data Residency for Microsoft 365 Copilot and Copilot Chat, Microsoft Learn
• Microsoft Entra ID and data residency, Microsoft Learn
• Intune data storage and processing, Microsoft Learn
• New CIRA Internet Trends Report reveals Canadians are putting trust before convenience, GlobeNewswire

Microsoft's buildout gives Quebec businesses a stronger residency story than they've ever had, but the story only holds if your tenant settings and your PIA back it up. If you'd like a clear map of where your data actually lives, book a free IT assessment and we'll build it with you, or contact us with your questions.