Digital Sovereignty: A Framework to improve digital readiness of the Government of Canada

On this page

• Executive Summary
• Purpose of the paper
• Outside of this paper’s scope
• What is digital sovereignty?
• Challenges and risks associated with digital sovereignty
• Addressing challenges and risks
• Next steps

Executive Summary

The Government of Canada (GC) must be able to manage and protect its data, systems and infrastructure to operate securely and independently in a globally connected environment. This paper explains what digital sovereignty means for the GC and how it informs the management of government digital operations. Broader issues such as Canada’s economic, industrial, or national security interests are out of scope of this paper.

Digital sovereignty refers to the GC’s capacity to exercise autonomy over its digital assets and services, ensuring the GC can manage and protect its digital systems, data and information regardless of where technologies are developed, hosted, or supported. It builds on earlier work on data sovereignty, extending the focus beyond data storage and jurisdiction to include operational resilience, system integrity and institutional control.

The paper examines the legal, security, privacy, workforce, and supply chain factors that influence the GC’s ability to maintain digital sovereignty. It highlights challenges related to jurisdictional complexity, reliance on global suppliers, evolving cyber security risks, and internal capacity, while underscoring the need for interoperability across the GC and with trusted international partners.

To address these challenges, the GC applies legal, supply chain and technical controls that reinforce its authority over government systems. Future work will strengthen contractual and policy mechanisms, improve supply assurance, and enhance technical safeguards, to maintain the security and reliability of government information and systems

Purpose of the paper

The purpose of this paper is to describe what digital sovereignty means for the GC and how it informs the management of the GC’s digital operations. It provides a common understanding of how the GC exercises autonomy over its data, systems, and infrastructure while operating in a globally connected digital context.

This paper builds on earlier work related to data sovereignty, which examined the management and jurisdiction of government information in cloud environments. While that work focused primarily on where data is stored and under whose laws it resides, this paper takes a broader view. It considers the GC’s ability to govern and sustain its digital operations, consistent with the legislative and policy frameworks that guide GC activities.

The intent is not to introduce new requirements or direct specific actions. Rather, it is to provide a clear and consistent frame of reference that supports informed decision-making today and guides consideration of future work across the GC.

Outside of this paper’s scope

This paper is not intended to provide a comprehensive overview of the GC’s digital strategies or modernization initiatives. Other key documents, such as the Government of Canada Digital Ambition, the Artificial Intelligence Strategy for the Federal Public Service, and the Data Strategy for the Federal Public Service, outline the GC’s enterprise direction and priorities for digital service delivery, technology adoption and data use. Related departmental strategies, including Shared Services Canada’s Delivering Digital Solutions Together for Canada and the Canadian Digital Service’s Strategic Vision 2025-27, further articulate how these priorities are being advanced across the GC.

This paper focuses specifically on the internal operations of the GC as an institution. Broader issues related to Canada’s participation in the digital economy, including industry growth, innovation, and competitiveness, fall outside the scope of this paper. This paper also does not address Indigenous data sovereignty considerations, which is distinct from the GC’s institutional approach and led by Indigenous partners through separate processes.

Digital sovereignty is also distinct from procurement policies that encourage domestic sourcing or supplier development. While such policies aim to advance Canada’s economic objectives, this paper focuses on how the GC manages and safeguards its own digital sovereignty.

This analysis addresses information and risks at the Protected B level and below, focusing on lawful and operational considerations relevant to unclassified and departmental environments. Matters that require higher security designations, specialized assessment, or engagement with the GC’s national security community are governed through separate frameworks and processes, though they remain part of the GC’s broader digital security planning.

What is digital sovereignty?

For the GC, digital sovereignty is defined as the ability of the GC to exercise autonomy over its digital infrastructure, data and intellectual property. It is the capacity to operate effectively and make independent decisions about digital assets, regardless of where technologies are developed, hosted, or supported.

Digital sovereignty relies on the GC’s shared ability to govern, access, and secure its digital systems so that programs and services can continue without interruption. It is a collective responsibility across government to keep those systems reliable, resilient, and available. It is impossible for the GC to obtain a state of complete digital sovereignty, known as digital autonomy, due to the absolute interconnected nature of the digital world.

Challenges and risks associated with digital sovereignty

Maintaining digital sovereignty within the GC requires managing a range of legal, supply chain, technical, and strategic considerations. The GC operates in a complex and globally integrated technology environment, where systems and services depend on a combination of government-managed infrastructure, shared enterprise platforms, and commercial technologies. This environment provides flexibility, scalability, and access to innovation, but also creates interdependencies that must be understood and governed carefully. Using a combination of globally supplied technologies allows the GC to access the best possible solutions to protect the security and privacy of the data it manages.

Data: The Government of Canada (GC) operates in a digital environment where many different laws can apply at the same time. Government systems and data often cross borders, which means a single service or dataset may be subject to more than one country’s rules. Most countries, including Canada and the United States,^{Footnote 1} have laws that allow their authorities to request access to information held by organizations within their borders. When a commercial service provider supports GC operations and operates in other countries, it must follow the laws of each jurisdiction. In some cases, those laws can differ or even conflict, creating overlapping or competing obligations. Using a Canadian supplier or storing data in Canada does not guarantee data will be outside the jurisdiction of foreign courts. The GC can fully maintain legal control only when it delivers services itself or works with providers that operate entirely under Canadian jurisdiction.

Lawful access requests can require specific steps to be taken, such as obtaining judicial authorization based on reasonable grounds related to a specific criminal investigation. Such requests must be limited in scope and directed to identified individuals or entities. Service providers may have recourse to challenge or clarify the order. The GC could find no documented cases of foreign governments seeking access to the data of Canadian enterprises held by suppliers.

Security: The GC’s digital operations depend on a combination of government-managed systems, common enterprise platforms, and commercial technologies. This interconnected environment increases both the likelihood and consequences of cyber incidents, making security assurance more complex. Dependencies across global supply chains can introduce vulnerabilities when software, hardware, or services originate from different jurisdictions and operate under varied standards and controls. Security risks are also shaped by the speed of technological change and the integration of automated or artificial intelligence systems, which can introduce new ways for systems to be compromised or misconfigured. The scale and diversity of GC systems increase the difficulty of maintaining consistent protection and resilience across departments and external service providers.

Privacy: The GC manages significant volumes of personal and institutional information across its programs and operations. As digital services become more interoperable and data-driven, the potential impact of unauthorized access, misuse, or disclosure could increase. Service delivery arrangements involving multiple providers, including cloud platforms or shared environments, can increase the risk to accountability for data stewardship. Privacy risks may arise when information is shared across systems or jurisdictions without consistent application of privacy requirements, such as those under the Privacy Act. Differences in how data is classified or stored can further contribute to risk. There remain ongoing challenges with ensuring that privacy protections stay relevant and respond to evolving technologies while also addressing the increased need for interdepartmental data sharing.

Workforce and Skills: A key challenge to maintaining digital sovereignty is the GC’s limited internal capacity to design, manage, and secure complex digital systems. The demand for skills in areas such as cloud computing, cyber security, and artificial intelligence continues to grow across all sectors, making it difficult for the GC to attract and retain the expertise required. This can increase reliance on external providers, reducing organizational control and eroding institutional knowledge over time, which undermines efforts to build and maintain internal digital capability.

Global Technology Market Dependencies: Most of the digital products and services used by the GC are provided by a small number of major global technology companies. This reliance creates concentration risk and can limit flexibility in choosing or replacing services. Even when engaging Canadian suppliers, many rely on components, platforms, or infrastructure sourced through global supply chains that are subject to foreign jurisdictions and market dynamics, which can include lawful interruption of the flow of goods and services. These global conditions, including export controls, sanction regimes, and other regulatory measures, can also affect access to software, updates, or technical support. Managing these dependencies requires sustained attention to assurance, diversification, and long-term business continuity planning across government systems and services.

System Criticality and External Dependencies: Not all digital capabilities, technologies, or services carry the same level of criticality to GC operations. The level of risk varies depending on each system’s function, sensitivity, and role in delivering programs and services. Where technologies are developed and maintained outside direct GC control, risks can arise related to origin, integrity, maintenance and assurance. These risks must be managed in proportion to operational importance and the potential impact on service continuity and security.

Alignment with Broader Government Priorities: Balancing digital sovereignty objectives with broader GC priorities, including operational efficiency, service delivery, domestic procurement, and interoperability across the GC and with trusted international partners, presents an ongoing challenge. Addressing it requires coordinated planning, sustained investment, and careful alignment of fiscal and operational priorities.

Addressing challenges and risks

The GC uses a range of measures to manage the legal, supply, and technical factors that affect its digital sovereignty. These measures help maintain secure and reliable operations, while ensuring that information and systems remain under appropriate federal authority. As technologies and delivery models continue to evolve, work across the GC focuses on maintaining consistency and adapting existing practices. The following sections outline current approaches and areas for future consideration in each domain. These approaches have the potential to maximize the digital sovereignty of the GC’s operations but must be applied proportionally to operational needs and existing security, and trade partnerships.

Next steps

Digital sovereignty is an ongoing consideration for the GC, influencing how digital infrastructure and services are designed, delivered, and governed. Ensuring appropriate control, assurance, and resilience across an interconnected environment requires balancing flexibility and innovation.

The GC has already put in place many of the foundations needed to support increased sovereign digital operations through its legal, supply, and technical controls. Ongoing efforts aim to build a shared understanding of where more sovereignty is most critical, how it can be achieved in proportion to operational needs, and how it can support service continuity and operational resilience.

Future work should include:

• Reviewing and refining contractual clauses related to data control, disclosure, and continuity to reflect emerging technologies and delivery models.
• Assessing current disaster recovery and business continuity practices, including an inventory of sovereignty requirements for the GC’s systems and services.
• Informing decision-making practices by incorporating digital sovereignty considerations alongside assurance, innovation, and operational needs.
• Ensuring transparency about operational control with all vendors, domestic and foreign, so the GC can manage and protect its information and digital infrastructure, regardless of supplier location.
• Aligning procurement and digital policy to coordinate supplier diversification, sourcing strategies, and economic initiatives with digital sovereignty goals.
• Exploring funding and governance mechanisms that enable more iterative and adaptive approaches to digital infrastructure, service delivery and transformation.