--- title: 'GDPR adequacy: hosting in Canada with EU users' description: >- Canada's EU adequacy decision removes the transfer paperwork for data sent to PIPEDA-covered organizations. It does not make the GDPR stop applying to you. date: '2026-09-16' lastUpdated: '2026-09-16' keywords: - GDPR adequacy Canada - Canada EU adequacy decision - hosting Canadian data EU customers - PIPEDA GDPR adequacy - standard contractual clauses Canada - EU data transfers to Canada type: article author: Ross Hill locale: en_CA site_name: MapleDeploy slogan: Powerful hosting on Canadian soil organization_url: 'https://mapledeploy.ca/' logo: 'https://mapledeploy.ca//api/logo/lockup' creator: MapleDeploy publisher: MapleDeploy founding_date: '2026-01-13' email: hello@mapledeploy.ca geo_region: CA-ON geo_placename: Toronto address_country: CA area_served: Canada application_category: DeveloperApplication app_url: 'https://app.mapledeploy.ca' llms_txt: 'https://mapledeploy.ca/llms.txt' offers: >- Starter $45/mo, Pro $95/mo, Ultra $195/mo, Ultra 32 $395/mo, Ultra 64 $695/mo CAD in_language: en-CA canonical_url: 'https://mapledeploy.ca/blog/gdpr-adequacy-canada-hosting' --- If you run a Canadian company with users in Europe, Canada's **GDPR adequacy** status is a real advantage. It is also narrower than the shorthand suggests, and the thing people get wrong is not the law. It is which question the law answers. Adequacy answers one question: on what legal basis may personal data leave the EU and land with you. It says nothing about whether the GDPR applies to what you do with that data afterwards. Two separate questions, two separate answers. Conflating them is how a procurement conversation goes sideways, in both directions: some teams assume adequacy exempts them from the GDPR, and others assume they need standard contractual clauses when they do not. This is not legal advice. ## What the adequacy decision actually says The operative text is short. Article 1 of [Commission Decision 2002/2/EC](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002D0002), adopted 20 December 2001, reads: "For the purposes of Article 25(2) of Directive 95/46/EC, Canada is considered as providing an adequate level of protection for personal data transferred from the Community to recipients subject to the Personal Information Protection and Electronic Documents Act." Read the end of that sentence again. The decision does not cover Canada. It covers recipients subject to **PIPEDA**, Canada's federal private-sector privacy law, which applies to organizations handling personal information in the course of commercial activities. The European Commission's own [list of adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) labels the entry "Canada (commercial organisations)" for exactly this reason. Federal and provincial public bodies sit outside it. So do organizations that are not engaged in commercial activity. Private-sector organizations in Quebec, Alberta and British Columbia are the case to check. Those provinces have their own privacy statutes, [Quebec's Law 25](/blog/quebec-law-25-data-residency) and PIPA in Alberta and British Columbia, and those laws displace PIPEDA for activity that stays inside the province. PIPEDA continues to reach personal information that crosses a provincial or national border, which is the situation when data arrives from the EU. If you are provincially regulated, confirm which law applies to you rather than assuming. Our post on [PIPEDA and hosting](/blog/pipeda-compliant-hosting) covers the federal law's scope. The decision predates the GDPR by a long way. It survives because of [GDPR Article 45(9)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679), which provides that decisions adopted under the old Data Protection Directive "shall remain in force until amended, replaced or repealed by a Commission Decision." ## It was reviewed in 2024, and it held That grandfathering is not a loophole nobody has looked at. On 15 January 2024 the Commission published its [report on the first review of the eleven Directive-era adequacy decisions](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52024DC0007), COM(2024) 7 final, covering Canada alongside Andorra, Argentina, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay. Its conclusion was that each of the eleven continues to ensure an adequate level of protection for personal data transferred from the EU. This is a decision that gets re-examined, not a permanent property of being Canadian. Treat it as current status rather than a settled fact. ## What adequacy does for you [Article 45(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) is the payoff. A transfer to a country the Commission has found adequate "may take place," and "such a transfer shall not require any specific authorisation." In practice that means no Article 46 machinery. No standard contractual clauses to negotiate, no binding corporate rules, no derogation to argue for. If a German company wants to put customer data into your Canadian SaaS product, the transfer is covered by the adequacy decision, provided you are subject to PIPEDA. That is a genuine commercial advantage, and it is most visible in a vendor review. The EU-side team is looking for the transfer mechanism. You have one, at the country level, without paperwork either side has to draft. ## What adequacy does not do If you offer goods or services to people in the EU, or monitor their behaviour there, the GDPR applies to your processing directly. [Article 3(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) extends the Regulation to controllers and processors not established in the Union in exactly those two cases, and it catches free products too: the offering of goods or services counts "irrespective of whether a payment of the data subject is required." The European Data Protection Board's [Guidelines 05/2021 on the interplay between Article 3 and Chapter V](https://www.edpb.europa.eu/system/files/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf), version 2.0 adopted 14 February 2023, draw the line clearly. A processing operation is a transfer only if three cumulative criteria are met: an exporter subject to the GDPR, a disclosure to another controller or processor, and an importer in a third country. Where the criteria are not met, the guidelines say, there is no transfer and Chapter V does not apply, but the controller "must nevertheless comply with the other provisions of the GDPR and remains fully accountable for its processing activities, regardless of where they take place." Their first worked example is the case most Canadian SaaS companies are actually in. A woman in Rome fills in a form on a website run by a company with no EU presence that targets the EU market. That is not a transfer, because the data was collected directly from the data subject rather than passed on by an exporter. Chapter V does not apply at all. The company is still bound by the GDPR under Article 3(2). So if your EU users sign up on your site, adequacy is often not even the operative rule. Your lawful basis, your privacy notice, your handling of access and deletion requests, your breach notification: none of that is touched by where your servers are. [Article 27](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) may also require you to designate a representative in the Union in writing, subject to an exemption for processing that is occasional and unlikely to result in a risk to individuals. Adequacy travels with the recipient organization, not with the data center. Canadian hosting does not by itself place you inside the decision, and being subject to PIPEDA does not require Canadian hosting. ## Compared with hosting in the US The Commission's list includes the United States too, scoped to "commercial organisations participating in the EU-US Data Privacy Framework." That [adequacy decision was adopted on 10 July 2023](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en) and is a working transfer mechanism for certified companies. If your US vendor is on the list, the transfer has a basis. The Commission has reviewed it since. Its [first periodic review](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52024DC0451), COM(2024) 451 final of 9 October 2024, concluded that the US authorities had put in place the necessary structures and procedures for the framework to function effectively. The assessment in this section is current as of the Commission's October 2024 review. The two decisions are built differently. Canada's attaches to a law: any recipient subject to PIPEDA is covered. The US decision attaches to participation in a program, company by company, so a given vendor either is certified or is not, and certification can lapse. There is also a different litigation history. The two arrangements that preceded the Data Privacy Framework were declared invalid by the Court of Justice in the Schrems I and Schrems II judgments. The current one was challenged and survived at first instance: on 3 September 2025 the General Court [dismissed the action for annulment in Case T-553/23, Latombe v Commission](https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250106en.pdf), confirming that the United States ensured an adequate level of protection as at the date the decision was adopted. An [appeal was lodged on 31 October 2025](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62025CN0703) and registered as Case C-703/25 P. We are not predicting an outcome. One of these two decisions has an open appeal against it and the other does not, and if you are the person writing a data protection impact assessment, that asymmetry is the sort of thing you have to note. It cuts both ways. Canada's decision has never been challenged, which also means it has never been tested against the standard the Court set in Schrems II. | | Canada | United States | | --- | --- | --- | | Who is covered | Recipients subject to PIPEDA | Companies participating in the Data Privacy Framework | | Legal basis | Decision 2002/2/EC (2001), in force under Article 45(9) | Adequacy decision of 10 July 2023 | | Commission review | Reaffirmed in COM(2024) 7 final, January 2024 | Reaffirmed in COM(2024) 451 final, October 2024 | | Judicial history | Not challenged, and never tested against the Schrems II standard | Upheld at first instance in T-553/23, appeal C-703/25 P pending | Jurisdiction is the other axis, and it is a separate argument from transfers. A US-incorporated host with a Canadian region is reachable by US legal process wherever the servers sit, which is the subject of our post on [the CLOUD Act and Canadian businesses](/blog/us-cloud-act-canadian-businesses). If the distinction between where data sits and whose law reaches it is new to you, start with [data residency vs data sovereignty](/blog/data-residency-vs-data-sovereignty). ## Where MapleDeploy fits MapleDeploy is a Canadian business running managed Coolify on a dedicated VM per customer at LunaNode in Toronto. Your application data, databases and server configuration stay on [Canadian infrastructure](/canadian-hosting), and MapleDeploy is subject to PIPEDA as a commercial organization operating from Ontario. You are the controller. MapleDeploy is your hosting provider. Our PIPEDA status is a fact about us, and it does not determine yours. In an EU vendor review, that is one clean, documented answer about where the data lives and who runs the machine. We publish a [data residency attestation](/legal/data-residency) and a [sub-processor list](/legal/subprocessors) you can hand to a counterparty. Payment processing runs through Stripe, a US company, and we are explicit about that boundary in [why we use Stripe](/blog/why-we-use-stripe). Article 28 requires a controller to have a written contract with anyone processing personal data on its behalf. MapleDeploy does not currently offer a data processing agreement. If your EU counterparty requires one, settle that before you build on us. None of that is GDPR compliance. That is yours as the controller, whatever the hosting looks like. Adequacy removes a category of transfer paperwork. Everything else in Article 3(2) still lands on your desk. {% cta-section title="Canadian hosting, European customers" %} Dedicated VMs in Toronto, run by a Canadian business. Try Starter or Pro free for 30 days. {% /cta-section %}