Digital Sovereignty, Data Security, and the Case for Homegrown Public Safety Solutions
Canada is in the middle of a national reckoning about where its technology comes from, who controls it, and what happens when the geopolitical ground shifts beneath it.
The federal government’s Buy Canadian Policy, introduced in December 2025, now formally prioritizes Canadian suppliers across strategic sectors, including information and communications technology. The word “sovereignty” appeared more than 80 times in Budget 2025. Prime Minister Mark Carney has called digital sovereignty a national priority. The AI minister has called it the most pressing policy issue of our time.
For police agencies, municipal enforcement teams, and public safety organizations across the country, the implications are direct and urgent: the technology you use to capture evidence, manage equipment, and protect your officers’ data may be governed by another country’s laws.
This is not abstract. It is operational.
The Problem: Foreign Technology, Foreign Jurisdiction
When a Canadian police service uses software built and operated by a U.S. company, that company is subject to U.S. law, regardless of where the data is stored.
The U.S. CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) allows American law enforcement to compel U.S.-based companies to produce data in their possession, custody, or control, even if that data is physically stored in Canada.
A federal government white paper on data sovereignty concluded plainly that full sovereignty cannot be assured when service providers are subject to foreign law. This is not a hypothetical risk. It is a structural one built into the legal frameworks governing U.S. technology companies.
For police agencies, the stakes are especially high. The data flowing through your systems includes officer notes, equipment maintenance records, collision reports, witness statements, and investigation files. If any of this data is managed by a company subject to a foreign government’s legal authority, decisions about where Canadian operational data goes, and who has access to it, are no longer fully Canadian decisions.
If the technology your officers use every day is governed by another country’s laws, what does that mean for your operational independence?
The Scale of Foreign Dependence
The extent of Canada’s reliance on foreign-owned software is staggering.
According to the Canadian Technology Sovereignty Index, a research initiative that maps the jurisdictional ownership of over 760 technology tools used by Canadian organizations:
- Only 18% of SaaS tools used in Canada are actually Canadian-owned.
- 54% are U.S.-parented and exposed to the CLOUD Act.
- In categories like communications, 91% of tools fall under foreign jurisdiction.
- A Buy Canadian policy applied to SaaS procurement would disqualify roughly 82% of the tools Canadian organizations currently rely on.
These numbers should give any police chief or municipal director pause. When four out of five software tools in your technology stack are ultimately controlled by companies subject to foreign law, the question is not whether a sovereignty gap exists. The question is how wide it is.
What the Federal Government Is Doing About It
The policy environment is shifting rapidly.
The Buy Canadian Policy, implemented in December 2025, formally prioritizes Canadian suppliers and Canadian content in federal procurement across five strategic sectors, including Information and Communications Technology. For procurements over $25 million (dropping to $5 million in June 2026), Canadian suppliers receive evaluation advantages, and contracts are assessed based on the proportion of Canadian content, including intellectual property and R&D.
In March 2026, the Government of Canada extended its secure communications contract with BlackBerry, a Canadian company, citing the importance of a “made-in-Canada approach to federal technology” to strengthen digital sovereignty.
The National Police Federation, which represents approximately 20,000 RCMP members, called on the government just this week to create an expedited procurement stream for safety-critical equipment, specifically naming digital policing tools alongside firearms and body armour. They have called for lifecycle-managed procurement models that prioritize interoperability, lower costs, and timely replacement.
The direction is clear: Canada is building a policy infrastructure that rewards domestic technology providers who can deliver secure, sovereign, and operationally effective solutions.
Why This Matters for Policing
Police agencies are not like other government departments. The data they handle is uniquely sensitive, and the systems they depend on carry legal, operational, and accountability weight that most enterprise software never has to bear.
Consider the following:
Sensitive data deserves Canadian custody. Officer notes, witness statements, investigation files, intelligence-relevant metadata, and the operational patterns visible in system usage all flow through digital platforms every day. When the platforms holding that data answer to a foreign legal authority, Canadian agencies are making decisions about Canadian operational information under another country’s legal framework. That is a sovereignty concern, not a marketing one.
Equipment records are accountability. Weapons maintenance logs, body armour inspection histories, and accessory tracking data are not just operational records. They are audit trails. When an equipment failure is investigated, or when an agency faces a legal challenge about readiness, the reliability of those records matters enormously. They should not be stored on infrastructure controlled by a foreign jurisdiction.
Operational independence is non-negotiable. The idea that a foreign government could theoretically compel access to Canadian police data is no longer a fringe concern. Neither is the risk that a foreign company could be acquired, restructured, or subject to sanctions that disrupt service. In the current geopolitical climate, these are risks that responsible police leaders must weigh.
What “100% Canadian” Actually Means
Not every company that operates in Canada is Canadian in a meaningful sense.
Under the current Buy Canadian framework, a supplier qualifies as “Canadian” if it has a place of business in Canada. That means a U.S.-owned company with a satellite office in Toronto technically qualifies, even though its parent company, its data infrastructure, and its legal obligations remain firmly under American jurisdiction.
Digital sovereignty researchers have pointed out that this creates a blind spot in procurement policy. The framework does not require disclosure of parent-company jurisdiction or an assessment of how ownership structures affect legal risk.
When we say DMI is 100% Canadian, we mean something specific:
- Founded in Canada. Headquartered in Toronto.
- Canadian-owned with no foreign parent company.
- Data stored and managed in Canada, under Canadian law.
- SOC2 certified. Compliant with ISO 27001:2022, HIPAA, PHIPA, GDPR, PCI/DSS, and CJIS.
- Patented document security technology (Braidmark®), developed and patented in both the U.S. and Canada.
- Not subject to the CLOUD Act, the Patriot Act, or any foreign government’s data access authority.
This distinction matters. In the current environment, “Canadian” is not just a label. It is a jurisdictional shield.
Beyond Patriotism: The Operational Case
The case for Canadian-made public safety technology is not just about nationalism. It is about operational resilience.
Responsiveness. Canadian vendors operating in your time zone, with teams who understand Canadian policing culture, can respond to issues faster and adapt to regulatory changes in real time. A company whose product roadmap is shaped by the FBI’s requirements is not going to prioritize Canadian court standards.
Supply chain security. The last two years have demonstrated how quickly geopolitical disruption can affect technology supply chains. Tariffs, sanctions, and trade disputes can affect licensing, pricing, and even service availability. A Canadian vendor’s service continuity is not contingent on the state of the Canada-U.S. relationship.
Regulatory alignment. Canadian privacy law (PIPEDA, PHIPA, Quebec’s Law 25) is evolving rapidly. The proposed Consumer Privacy Protection Act (CPPA) would make jurisdictional impact assessments mandatory at the federal level. Canadian vendors are already building compliance into their products because they operate under the same framework their clients do.
Economic reinvestment. When a Canadian police service purchases technology from a Canadian company, that investment circulates within the Canadian economy, supporting Canadian jobs, Canadian R&D, and Canadian innovation. That is not sentimentality. It is economic strategy.
A Practical Starting Point
Agencies do not need to overhaul their entire technology stack overnight. But they should begin asking different questions during procurement:
- Where is the vendor’s parent company incorporated?
- Is the vendor subject to foreign data access legislation (e.g., CLOUD Act, Patriot Act)?
- Where is the data physically stored, and under whose legal jurisdiction?
- What happens to your data if the vendor is acquired by a foreign entity?
- Does the vendor hold Canadian security certifications (SOC2, ISO 27001)?
- Does the solution meet Canadian operational and privacy standards by design?
These are not difficult questions. But in most procurement processes today, they are rarely asked.
Conclusion
The conversation about buying Canadian technology is no longer just about preference. It is about policy, security, and operational independence.
Canada’s federal government is building the procurement infrastructure to prioritize Canadian suppliers. The National Police Federation is calling for smarter, faster procurement of digital policing tools. Privacy regulators are tightening the rules around foreign data access. And the geopolitical environment has made it clear that depending on foreign-controlled technology for mission-critical public safety operations carries real and growing risk.
DMI was built in Canada, for Canadian agencies, by a team that understands how Canadian policing works. Our technology, from IMP eNotes to TRACE to Braidmark, is designed to comply with Canadian privacy law, meet Canadian operational standards, and keep Canadian data under Canadian control.
That is not a marketing position. It is a structural advantage.
And in 2026, it matters more than ever.
Frequently asked questions
Does Canada’s Buy Canadian Policy apply to police technology procurement?
Yes. The federal policy implemented in December 2025 covers information and communications technology procurement and gives evaluation advantages to Canadian suppliers. Provincial and municipal agencies are not directly bound by federal procurement rules, but they increasingly use similar evaluation frameworks.
What is the U.S. CLOUD Act and how does it affect Canadian police data?
The CLOUD Act (2018) allows U.S. law enforcement to compel U.S.-based companies to produce data in their possession, custody, or control, including data stored in Canada. A Canadian police agency using a U.S.-owned platform exposes its data to that legal authority regardless of where the servers physically sit.
What does “100% Canadian” actually mean for a software vendor?
A meaningful definition requires four criteria: founded and headquartered in Canada, Canadian-owned with no foreign parent company, data stored and managed in Canada under Canadian law, and not subject to foreign data access legislation. Many vendors that operate in Canada do not meet all four.
What should procurement officers ask a vendor about jurisdiction?
Where the parent company is incorporated, whether the vendor is subject to foreign data access laws, where data is physically stored and under whose legal jurisdiction, what happens if the vendor is acquired by a foreign entity, and whether the solution holds Canadian security certifications such as SOC2 and ISO 27001.
Sources
- National Police Federation release: https://npf-fpn.com/news-item/national-police-federation-calls-for-urgent-reform-to-rcmp-procurement/
- Canadian Technology Sovereignty Index by Upper Harbour: https://upperharbour.ca
