## Cross-Border Data: What Flows Where The regulatory layers are now mapped. This chapter applies them to the question advisors encounter most: what happens when an AI tool's data crosses borders. ### 5.1 The Distinction That Changes Everything

Data residency: Where data is physically stored at rest.

Data sovereignty: Which country's laws have legal jurisdiction over data.

Data localisation: A legal requirement to keep data within national borders. Canada does not mandate this under PIPEDA for the private sector.

Canadian data residency does not mean Canadian data processing.

A vendor says "Canadian data residency." Your data is stored in Montreal. The AI processes it in Virginia. Both statements are true simultaneously. This distinction is not theoretical. Major cloud providers offer Canadian storage regions, but AI inference processing may occur in US regions depending on the deployment configuration. Some cloud providers offer cross-region inference services that explicitly route processing requests to US or global regions while keeping data at rest in Canada. Others require specific deployment types (regional rather than global) to guarantee in-region processing. The question is not just where data sits at rest but where it goes when the AI tool actually uses it. ### 5.2 What Canadian Law Actually Requires For advisors with Quebec clients, transferring client data to an AI processor in another province, not just another country, triggers the full suite of Law 25 protections. ### 5.3 What to Ask Any AI Vendor Five questions expose the gap between marketing claims and actual data flows: 1. Where is client data stored at rest? 2. **Where does AI inference and processing occur?** (This is the critical question.) 3. Is the processing infrastructure subject to the US CLOUD Act? 4. Is there a contractual guarantee against cross-border processing? 5. Who are the sub-processors, and where are they located? A tool that cannot answer these questions clearly is probably not ready for use with client information. ### 5.4 How Architecture Can Address This Some tools address cross-border concerns through architectural design, removing personally identifiable information on the advisor's device before any data is transmitted. Meeting Notes Pro uses this local PII removal approach. The principle matters more than the specific tool: the question is whether sensitive client data crosses borders, or whether what crosses borders has already been stripped of identifying information.