Is your email safe from US jurisdiction? What the CLOUD Act means for Canadians

Your inbox holds some of your most sensitive information – contracts, invoices, passport scans, and private conversations all sit in one account. Many people and businesses assume that if sensitive data is stored in European or Canadian data centers, then local privacy laws must fully protect it.

However, that’s not necessarily the case because where your data is stored is not the same as who has legal control over it. A US company running a data center in Toronto still has to follow valid US legal orders.

So, is your email safe from US jurisdiction? For Canadians, the answer depends on 2 things. What does Canada’s main email privacy law, PIPEDA, protect? And which secure email providers keep your data out of US reach? In this article, I explain how US jurisdiction works, how PIPEDA compares with US law, and how to keep your email out of reach.

What does “US jurisdiction” mean for your email?

Jurisdiction is about which government can force a provider to hand in your data.

If a provider is under US jurisdiction, US courts and authorities can require it to hand over information it holds.

A provider can full under US jurisdiction in several ways:

• Corporate control. The provider is owned or controlled by an American company
• Headquarters. The company is based in the US
• Legal presence. The company has offices, staff, or significant business operations in the US

As you can see, server location isn’t on this list. That’s why US jurisdiction email risks apply even to data stored locally.

So, if you use Gmail or Outlook, that means your email is handled by Google or Microsoft. These are both American companies that fall under US jurisdiction, no matter which country the servers are in.

What is the CLOUD Act?

The Clarifying Lawful Overseas Use of Data Act, or CLOUD Act, was passed in 2018. Essentially, it allows US authorities to require providers under US jurisdiction to disclose data in their possession, custody, or control, regardless of where that data is stored.

The CLOUD Act amended the Stored Communications Act – a US law that governs how authorities can access stored emails and other electronic records.

Before 2018, it wasn’t clear whether US warrants covered data stored abroad. Microsoft fought a warrant for emails stored in Ireland all the way to the US Supreme Courts. Congress then passed the CLOUD Act and made it clear that location doesn’t matter, only control does.

That said, the CLOUD Act doesn’t give US authorities free access to everyone’s inbox. They still need a valid legal order. For instance, getting the contents of stored emails in a regular criminal investigation generally requires a warrant.

Can the CLOUD Act affect Canadians?

Yes, the CLOUD Act can potentially affect Canadians. Canadians can be affected when their email provider is a US company or is otherwise subject to US legal order.

For example, a Vancouver accounting firm uses Microsoft 365 and chooses Canadian data centers. Its client files physically stay in Canada. However, since Microsoft is an American company, a valid US legal order can still require Microsoft to produce that data.

Also, keep in mind that US authorities sometimes stop a provider from telling customers about a request. So, the firm might never find out its data was disclosed.

When it comes to the CLOUD Act, Canada and the US have been negotiating an agreement since 2022, which would set the rules for how each country requests data from providers in the other. That said, at the time of writing this article, no agreement has been reached.

PIPEDA vs US law: what’s the difference?

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s main privacy law for private businesses. It sets the rules for how companies collect, use, and share personal information.

PIPEDA and US law works very differently. PIPEDA is built around accountability. It makes businesses responsible for protecting the personal information they collect – including when a third-party processes it, even abroad.

On the other hand, US law gives authorities the power to compel providers to hand over data through legal process.

Here’s how they compare:

	PIPEDA (Canada)	US (CLOUD Act and related laws)
Main purpose:	Protects personal information handled by businesses	Lets authorities request data through legal process
Applies to:	Private-sector businesses in Canada with commercial activities	Providers under US jurisdiction
Core model:	Accountability and consent	Compelled disclosure
Cross-border transfers:	Allowed, if the data stays protected	Data can be requested wherever it’s stored
Transparency:	Businesses must tell customers their data may be processed abroad	Providers can be barred from notifying customers
Government access:	Doesn’t block foreign government access	Required disclosure under valid orders

The key takeaway – PIPEDA doesn’t ban cross-border data transfers from Canada, and it doesn’t override foreign government powers. A Canadian business can legally store customer emails with an American provider. Once it does, that data can fall under US law too.

What PIPEDA does protect and what it does not

A common misunderstanding is that Canadian email privacy law keeps your data away from foreign governments. It doesn’t. Below, I break down what it covers.

Why server location is not enough

Is email data safe in Canada just because it’s stored there? Not necessarily. The assumption that if your data is stored in Canada, then it’s safe from US access is one of the most common privacy myths.

To see why it falls short, it helps to understand 3 terms:

Term	What it means	Does it protect you from US orders?
Data residency:	Where your data is physically stored	No, if the provider is under US jurisdiction
Data sovereignty:	The data is subject to the laws of the country where it’s stored	Partly, since other countries’ laws can still apply to the provider
Jurisdiction:	Which government can force the provider to hand over data	Yes, if the provider is outside US jurisdiction

Here are a few practical examples:

• A US provider with Canadian servers. Your data is physically stored in Canada, but the provider must follow valid US orders.
• A Canadian provider with Canadian servers. US authorities generally have to through Canadian legal channels. However, Canadian police can still get court orders.
• A Swiss provider with zero-access encryption, like Proton Mail. US authorities need to go through Swiss legal channels, and even then, the provider can’t read your stored emails.

How encryption changes the risk

Encryption doesn’t stop legal requests. A provider can still receive an order and may have to comply. However, strong encryption limits what the provider can hand over in readable form.

The key question is: who holds the encryption keys?

	Standard encryption	End-to-end and zero-access encryption
Who holds the keys:	The provider	Only you
Can the provider read your emails:	Yes	No
What a legal order can reveal:	Readable email content	Encrypted data that can’t be read
Examples:	Gmail, Outlook	Proton Mail

Most mainstream email services use standard encryption. Your emails are encrypted in transit and on the server, but the provider holds the keys. So, if it received a valid order, it could decrypt and hand over your messages.

With end-to-end encryption, a message is encrypted on the sender’s device and can only be decrypted by the recipient. Zero-access encryption protects emails stored on the server with keys only you control.

Together, they mean the provider can’t read your stored emails, even if it’s legally forced to share them.

What Canadians should look for in a secure email provider

If you’re choosing an email provider with US jurisdiction in mind, here’s what to check:

• Jurisdiction. A provider based and controlled outside the US, in a country with strong privacy laws
• Encryption model. End-to-end and zero-access encryption, so only you should the keys
• Metadata handling. Minimal logging and a clear policy on what data is stored
• Transparency reports. Regular public reports on government requests and how the provider responded
• Open-source apps. Code that anyone can review for weaknesses or hidden access
• Access to stored content. A clear statement that the provider can’t read your emails

Why Proton is a strong option for Canadians concerned about US jurisdiction

Proton Mail is based in Switzerland and operates under Swiss law. So, it isn’t subject to US legal orders through American ownership.

To get data from Proton, foreign authorities, including the US, generally have to go through Swiss legal channels, and Swiss courts review each request before Proton is required to comply.

What makes Proton stand out is that jurisdiction is backed by encryption. Emails between Proton users are end-to-end encrypted, and all stored emails are protected with zero-access encryption. This means Proton can’t read your emails, so it can’t hand them over in a readable form, even under a valid legal order.

Proton is also transparent about legal requests. It publishes a transparency report that lists how many requests it receives and how many it contests. On top of this, its apps are open source and independently audited.

For Canadians comparing Proton with US-based providers like Gmail or Outlook, the difference is clear. With Proton, your email content stays unreadable to the providers, and US authorities can’t compel it directly.

Get Proton Mail

Final verdict: is your email safe?

Generally, no provider is beyond all legal process. Every email service must follow the laws of the country it operates in, and that includes privacy-focused ones.

That said, if you use a US-controlled provider, your email can be exposed to US legal orders even when it’s stored in Canada, and PIPEDA can’t stop that. Canadians can significantly reduce this exposure by choosing a provider outside US jurisdiction with end-to-end and zero-access encryption.

In my opinion, Proton Mail is the strongest option for Canadians who want to keep their email out of US reach. Swiss jurisdiction, encryption that keeps Proton from reading your emails, and transparent reporting make it a privacy first alternative to Gmail or Outlook.

FAQ