Published October 26, 2026Event Planning

Where Does Your Attendee Data Live? A Canadian Guide

By Sarah Jonson14 min read

"All attendee data must be hosted in Canada." It appears in event RFPs constantly, usually written by someone who believes Canadian privacy law requires it.

It does not. Under PIPEDA, the federal private-sector privacy law, there is no data residency requirement at all. What the law requires is accountability: you stay responsible for personal information after you hand it to a processor, wherever that processor is. Quebec is the real exception, and it is stricter than most organizers realise, but it still does not mandate residency either.

This matters because a residency clause that is not legally required but is enforced anyway will narrow your vendor list, raise your price, and still leave the actual risk unaddressed. Here is what the law says, where attendee data really goes, and what to ask instead.

This article is general guidance for event and procurement teams, not legal advice. Privacy obligations turn on your specific facts and your province. Ask a privacy lawyer before relying on any requirement in a contract or RFP.

TL;DR

PIPEDA does not require personal information to stay in Canada, and it does not distinguish domestic from international transfers.
Sending data to a processor is a transfer, not a disclosure, so it does not require fresh consent, but you remain accountable for it.
PIPEDA requires contractual or other means to provide a comparable level of protection while a third party processes the data.
Quebec Law 25 is different: before personal information goes outside Québec you must complete a privacy impact assessment and put a written agreement in place.
Ask about encryption, access control, breach notification and sub-processors. Those address the risk; a map pin usually does not.

What PIPEDA actually requires

The Office of the Privacy Commissioner of Canada published guidelines on exactly this, and the summary is blunter than most RFP language suggests.

A transfer is not a disclosure

Handing personal information to a service provider to process on your behalf is a transfer, a use of the information rather than a disclosure to a new party. Because it is a use, it does not require separate consent, as long as the information is used for the purpose it was collected for. Selling your attendee list to a sponsor is a disclosure. Letting your ticketing platform store it is not.

PIPEDA does not distinguish domestic from international

The OPC's guidelines state this directly: PIPEDA does not distinguish between domestic and international transfers of data. A processor in Ohio and a processor in Ottawa are treated the same way by the statute. The OPC has also stated that, in the cases it reviewed, the transfers did not violate PIPEDA.

Accountability travels with the data

What does apply is Principle 4.1.3 in Schedule 1 of PIPEDA: an organization "shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party." You remain accountable for the information in the hands of the organization you transferred it to. If your ticketing vendor leaks your attendee list, that is your accountability problem as well as theirs.

So the legally meaningful question is not *where is the server*. It is *what does your contract with the processor say, and can they actually deliver it*.

What Quebec's Law 25 adds

If any of your attendees are in Québec, the calculus changes. Under the *Act respecting the protection of personal information in the private sector*, as amended by Law 25, section 17 sets a real procedural gate.

The privacy impact assessment

Before communicating personal information outside Québec, an enterprise must conduct a privacy impact assessment. The statute names four things it must weigh:

1. The sensitivity of the information.

2. The purposes for which it is to be used.

3. The protection measures, including contractual ones, that would apply to it.

4. The legal framework in the state where the information would go, including that state's personal information protection principles.

The information may be communicated only if the assessment establishes that it would receive adequate protection, judged against generally recognized principles of personal information protection.

The written agreement

The communication must also be the subject of a written agreement that takes the assessment's results into account, along with any terms agreed to mitigate risks the assessment identified. A standard vendor terms-of-service page is unlikely to satisfy this on its own.

Critically, section 17 applies the same rule where an enterprise entrusts a person or body outside Québec with collecting, using, communicating or keeping the information on its behalf. That is precisely what using a foreign-hosted ticketing platform is. A cloud vendor storing data outside the province triggers it.

Telling people when you collect

Law 25 also requires that, when collecting personal information, the person be informed of the possibility that their information could be communicated outside Québec, in clear and simple language. For an event, that means your registration form and privacy notice, not a buried clause.

Note what Law 25 still does *not* say: it does not forbid the transfer. It requires you to assess it, document it, contract for it, and disclose it.

Where event data actually goes

Most organizers underestimate how many parties touch an attendee record. A typical ticketed event spreads personal information across at least five systems, and a residency clause aimed only at the ticketing platform misses most of them.

The ticketing platform: names, emails, phone numbers, registration answers, order history.
The payment processor: cardholder data and billing details, under its own agreement with you.
Email and SMS delivery: every address and number you send to.
Analytics and advertising pixels: behavioural data, often flowing to servers you never contracted with directly.
On-site tooling: scanners, badge printing, lead retrieval for exhibitors.

An attendee record spreads across ticketing, payments, messaging, analytics and on-site tooling, each with its own location and contract

Payment processing is the clearest example of why residency clauses often miss. If your platform routes payments through your own Stripe or Square account, cardholder data goes to that processor under the agreement *you* signed with them, not your ticketing vendor's. That is usually better for you, because you hold the relationship and the money settles to your bank directly. But it means the question "where is attendee data hosted" has at least two answers, and probably five.

What to ask a ticketing vendor instead

Questions that surface real risk, roughly in order of how much they tell you:

Who are your sub-processors, and where are they? A vendor hosted in Canada that sends email through a US provider has data leaving the country regardless. Ask for the list.
What is encrypted, at rest and in transit? "Encryption at rest" is a specific claim about stored data, and it is a common RFP requirement that vendors answer vaguely.
Who on your staff can access attendee records, and is that logged? Access control and an audit trail matter more day to day than geography.
What is your breach notification commitment, in hours? Both PIPEDA and Law 25 impose breach obligations on *you*. If the vendor tells you late, you are late.
Can we export everything, and what happens on termination? Data you cannot get out is a risk no residency clause fixes.
Will you sign a written data processing agreement? Required in substance for Québec transfers, and good practice everywhere.
If you are Québec-facing: will you support our PIA? You need details about their protection measures and the legal framework where the data sits. A vendor who cannot answer makes your assessment impossible.

Writing a requirement that works

If you are drafting the RFP rather than answering it:

Separate "must" from "nice to have." A hard Canadian-residency gate is a legitimate policy choice, but make it a deliberate one, not a copied line. It will exclude capable vendors.
Ask for the sub-processor list as a deliverable, not a yes/no answer.
Specify the breach notification window in hours and make it contractual.
Require a signed DPA rather than acceptance of standard terms.
For Québec, ask what they will provide for your PIA, and score the answer.

Our perspective

Our honest view is that residency has become a proxy. It is easy to write, easy to check, and feels protective, which is why it spread through RFP templates faster than the law it is supposed to implement. Meanwhile the questions that would actually have caught most real incidents — who can access the record, is it encrypted at rest, how fast will you tell us, who else touches it — go unasked or get a one-word answer nobody scores.

We would rather be asked the harder questions. A vendor who can name their sub-processors and commit to a notification window in writing is demonstrably safer than one who can only point at a map, and the difference shows up when something goes wrong rather than during procurement.

Where Eventist fits

On the parts we can state plainly: payments run through your own Stripe or Square account, so cardholder data goes to the processor under the agreement you signed, and funds settle to your bank rather than sitting in a platform balance. Every attendee's name, email, answers and order history belongs to your organization and is exportable at any time, including after your event ends. Access to event records is scoped by staff role rather than shared logins, and account owners can review an audit log of privileged actions.

If you are completing a Québec privacy impact assessment or answering a procurement questionnaire, ask us for the specifics you need — sub-processors, encryption, retention and notification — and we will put them in writing rather than pointing you at a terms page. The events platform page covers the general feature set, and pricing shows the flat per-ticket fee.

Frequently Asked Questions

Does Canadian law require attendee data to be stored in Canada?

No. PIPEDA, the federal private-sector privacy law, contains no data residency requirement and does not distinguish between domestic and international transfers of personal information for processing. What it requires is that the organization transferring the data remains accountable for it and uses contractual or other means to provide a comparable level of protection while a third party processes it. Some organizations adopt a Canadian-residency policy by choice, and public-sector rules in certain provinces differ, but it is a policy decision rather than a general legal requirement.

What is the difference between a transfer and a disclosure under PIPEDA?

A transfer is handing personal information to a service provider to process on your behalf, which PIPEDA treats as a use of the information rather than a disclosure to a new party. Because it is a use, it does not require fresh consent so long as the information is still being used for the purpose it was collected for. A disclosure gives the information to someone for their own purposes, such as sharing an attendee list with a sponsor, and that does require consent.

What does Quebec's Law 25 require before data leaves the province?

Section 17 of the *Act respecting the protection of personal information in the private sector* requires a privacy impact assessment before personal information is communicated outside Québec. The assessment must weigh the sensitivity of the information, the purposes it will be used for, the protection measures including contractual ones, and the legal framework in the destination state. The information may only be communicated if the assessment finds it would receive adequate protection, and the communication must be covered by a written agreement reflecting the assessment. The same applies when an enterprise entrusts an organization outside Québec with keeping the information on its behalf.

Do we need a privacy impact assessment for a ticketing platform?

If you are an enterprise carrying on business in Québec and the platform will hold personal information outside the province, yes. Law 25 also requires a PIA for any project to acquire, develop or overhaul an information system involving the collection, use, communication, keeping or destruction of personal information, so adopting a new ticketing system can trigger it independently of where the data sits. Ask the vendor early for the details you will need, because a PIA cannot be completed without them.

What should we ask a ticketing vendor about data protection?

Ask for the sub-processor list with locations, what is encrypted at rest and in transit, who on their staff can access attendee records and whether that access is logged, their breach notification commitment stated in hours, whether you can export everything and what happens on termination, and whether they will sign a data processing agreement. These address the risks that actually materialise. Where the server sits is one input among several, not the answer by itself.

Does using our own Stripe or Square account change where data goes?

Yes, in a useful way. When payments run through your own processor account, cardholder data goes to that processor under the agreement you signed with them directly, and funds settle to your bank rather than through a platform's balance. It means your privacy analysis has to cover the processor as well as the ticketing platform, but you hold that relationship and can read its terms yourself rather than inheriting whatever your vendor negotiated.

Sources

Ready to simplify your events?

Join hundreds of organizers, studios, and festival directors who trust Eventist to run their events.

Book a Free Demo inquiries@eventist.ca