Databricks in Canada: data residency, OSFI and Québec Law 25

More Canadian organizations are moving analytics and AI to Databricks. The platform questions are familiar, but Canadian teams also need clear answers on where data lives, which rules apply and how outside delivery teams fit in. This guide covers the points we plan for with every Canadian client.

Can Databricks keep our data in Canada?

Yes. Databricks is available in Canadian cloud regions:

• AWS Canada (Central), ca-central-1, in Montréal.
• Azure Canada Central, in Toronto.
• Azure Canada East, in Québec City, often used as a disaster recovery region.

Data residency is a design decision, not a default. We keep storage accounts and buckets, workspaces, model serving endpoints and backups in Canadian regions, and we check that external services (for example, model providers called by AI features) also meet your residency policy.

Are all Databricks features available in Canadian regions?

Not always at the same time. Some serverless and AI capabilities reach Canadian regions later than US regions. Before design, we confirm which features are available for your workspace region and plan around any gaps, so there are no surprises late in the project.

What do OSFI guidelines mean for a Databricks program?

Federally regulated financial institutions follow guidance from the Office of the Superintendent of Financial Institutions (OSFI). Two guidelines matter most:

• B-10, third-party risk management: due diligence, contracts, ongoing oversight and exit planning for outsourced services, including delivery partners.
• B-13, technology and cyber risk management: expectations for technology governance, security, change control and resilience.

In practice, this means clear access boundaries for delivery teams, separated environments, logged changes, documented data flows and an exit plan. Unity Catalog permissions, audit logs and lineage provide much of the evidence. Your risk and compliance teams own the assessment; a good delivery partner makes it easy for them.

How do PIPEDA and Québec Law 25 affect analytics?

PIPEDA sets federal rules for personal information in the private sector. Québec Law 25 goes further for Québec residents, including privacy impact assessments before personal information is communicated outside Québec, and stronger transparency obligations.

For a lakehouse, we apply a few simple patterns:

• Collect and keep only the personal data each use case needs.
• Mask or tokenize sensitive columns, and expose de-identified views to most users.
• Tag personal data in Unity Catalog so access policies and lineage follow it.
• Document where data flows, including any transfers outside Québec or Canada.

How does an offshore delivery team fit these rules?

With the right controls, a delivery team does not need to move or copy your data. Our engineers work inside your cloud and Databricks workspaces with least-privilege access, through your identity provider, with every action logged. Contracts and governance sit with DLytica in Canada, and onshore leadership in Ontario handles workshops, steering and escalations.

Where should a Canadian team start?

Start with one governed domain, such as customer, risk or finance, in a Canadian region. Set up Unity Catalog, tagging and audit from day one, then add Genie and AI use cases on top. It is faster to build governance in at the start than to retrofit it later.