Four things Canadian law does to a US-drafted SaaS agreement

1. Data residency is a myth, with two real exceptions

The Office of the Privacy Commissioner has said the same thing since 2009: PIPEDA does not prohibit organizations in Canada from transferring personal information to another jurisdiction for processing. What it requires is that the organization use “contractual or other means to provide a comparable level of protection” — comparable meaning generally equivalent, not identical — and that it be transparent. You have to make plain that information may be processed abroad and may be accessible to foreign law enforcement.

The OPC did consult in 2019 on treating transfers as disclosures requiring consent, and then dropped it. It said it would maintain the status quo until the law changes. So the position is settled: no consent required for a transfer for processing, but real transparency obligations.

Where residency genuinely bites:

Nova Scotia is the surviving true residency statute. PIIDPA section 5 requires personal information in the custody of a public body to be stored and accessed only in Canada, subject to three narrow exceptions. It binds service providers directly, and the penalties are aimed at them: individuals up to $25,000, corporations up to $500,000. If you sell to Nova Scotia public bodies, this is not a contract term, it is an offence provision.

British Columbia is not what your compliance checklist says. FIPPA’s data residency requirement was removed by the 2021 amendments. What replaced it is a risk-based assessment: a public body disclosing sensitive personal information outside Canada must complete a supplementary assessment within its privacy impact assessment, weigh service provider location, storage method, likelihood of unauthorised access and impact, and record a decision by the head of the public body. Vendors are still writing “BC requires Canadian residency” into their compliance matrices five years after it stopped being true.

Ontario is more nuanced. The IPC is explicit that for FIPPA and MFIPPA institutions there is no legal prohibition on offshore cloud; the test is whether reasonable steps were taken. That guidance expressly excludes health information custodians, and PHIPA section 50 governs disclosure outside Ontario. Whether that amounts to a residency rule is contested — the strongest version of the claim comes from cloud vendors, not from the IPC — and in practice Ontario health customers contract for Canadian hosting for procurement reasons as much as statutory ones.

Federally, Bill C-36 received first reading on 15 June 2026. It would repeal Part 1 of PIPEDA, replace it with the Protecting Privacy and Consumer Data Act, create a new commission, and fold automated decision systems in directly rather than in a separate AI statute. Its predecessor, Bill C-27, died on prorogation in January 2025. Watch it, but do not build to it yet.

2. Quebec is where the actual obligations are

If you have Quebec customers, section 17 of the private-sector privacy Act is the provision that reaches you. Before communicating personal information outside Quebec, the enterprise must assess the sensitivity of the information, the purposes, the protection measures and the legal framework of the destination state, and may proceed only if the assessment establishes adequate protection. The communication must then be the subject of a written agreement reflecting that assessment. The same applies to entrusting processing to a service provider outside Quebec.

The practical consequence for a vendor: your Quebec customer cannot complete its assessment without you. Sub-processor lists, hosting locations, government access exposure, security measures. That is why Quebec customers push a specific transfer addendum rather than accepting a generic data processing agreement.

Section 27 gives a portability right, and it is narrower than most vendors build for: computerised personal information collected from the applicant, and not created or inferred, must be provided in a structured, commonly used technological format. Derived analytics and inferred profiles fall outside it.

The penalties are the reason people pay attention: administrative monetary penalties to $10 million or 2% of worldwide turnover, and penal fines to $25 million or 4%.

3. The clause gets formed. Then it gets struck.

Canadian courts have enforced clickwrap since Rudder v. Microsoft in 1999, and browsewrap with sufficient notice since Century 21 v. Rogers in 2011. Contract formation online is not the problem. What Canadian courts strike is the content — specifically, dispute resolution clauses that are theoretically available and practically unusable.

Lochan v. Binance Holdings Limited, 2024 ONCA 784, is the current high-water mark. Roughly 50 pages of terms accepted in under 30 seconds; a unilateral right to amend any provision including the arbitration clause; an arbitral forum that moved four times and landed in Hong Kong; costs of about US$30,000 before travel and counsel. The Court of Appeal held the arbitration agreement void as contrary to public policy and unconscionable. The trial judge’s characterisation, upheld, was that the complexity and expense of the arbitration were not disclosed anywhere.

Against consumers, a US forum clause faces Douez v. Facebook, 2017 SCC 33, where the Supreme Court declined to enforce a California forum selection clause in a contract of adhesion involving quasi-constitutional privacy rights. And Uber v. Heller, 2020 SCC 16, supplies the unconscionability engine behind all of it.

4. Auto-renewal: the rules changed twice this year

British Columbia, in force 1 August 2026. The BPCPA amendments void an automatic renewal clause for a term exceeding 60 days unless the consumer gets both a right to cancel at any time without penalty, with a refund where cancellation follows renewal within 15 days, and clear advance notice between 30 and 60 days before renewal. For renewals of 60 days or less, the consumer must be able to cancel before or after the renewal date without charge. Suppliers also cannot unilaterally amend terms about cancellations, returns or refunds.

Two features make this more than a consumer problem. New section 14.4 makes dispute resolution and class-waiver clauses inoperative for claims below a prescribed amount in non-consumer contracts — so it reaches business-to-business SaaS terms. And the restrictions apply retrospectively to contracts entered into before enactment.

Quebec, in force 12 September 2026. New rules under the Consumer Protection Act require, among other things, a clearly labelled online cancellation button for any ongoing subscription the consumer can terminate.

Ontario: nothing yet. The Consumer Protection Act, 2023 received Royal Assent in December 2023 but has not been proclaimed in force, pending regulations. The Consumer Protection Act, 2002 still governs, including section 7, which invalidates an arbitration term insofar as it prevents a consumer from suing in the Superior Court, and section 8, which preserves the right to join a class proceeding. If your compliance calendar has Ontario down as a January 2026 change, it was wrong.

And the clause that usually holds

Canadian courts do enforce broad exclusions and liability caps between sophisticated commercial parties. The test comes from Tercon Contractors Ltd. v. British Columbia, 2010 SCC 4, and it has three steps: does the clause, properly interpreted, apply to the circumstances; if so, was it unconscionable when the contract was made; and if not, should the court refuse to enforce it on an overriding public policy ground. Tercon also buried the doctrine of fundamental breach.

Steps two and three are high bars between commercial equals. The risk in a negotiated B2B SaaS contract sits almost entirely at step one — whether the clause actually covers the loss being claimed. In Tercon itself, the majority never got past it.

Which makes this a drafting problem rather than a doctrine problem, and drafting problems are the fixable kind. If your cap excludes “damages arising from breach of this Agreement” and the claim is framed in negligence, or in breach of a confidentiality obligation that sits in a separate schedule, you may discover that the number you negotiated was never the number that applied.