Canadian authorities have filed criminal charges against OVHcloud and its Canadian subsidiary, Hébergement OVH Inc., alleging the cloud provider failed to comply with a court order demanding subscriber data linked to servers located outside Canada. The company, Europe’s largest cloud infrastructure provider, has pledged to vigorously contest the charges, framing the dispute as a fundamental test of data sovereignty, corporate separateness, and the proper use of international legal mechanisms for cross-border evidence requests.
OVHcloud Charged Under Canada’s Criminal Code for Refusing Data Production Order
The charges, announced by OVH Groupe S.A. on July 25, 2026, stem from a production order issued on April 19, 2024, under Section 487.014 of the Canadian Criminal Code. Authorities sought subscriber and account information associated with specific IP addresses traced to servers hosted by OVH subsidiaries in jurisdictions outside Canada. When the company did not comply to the satisfaction of the requesting authorities, it was charged with two offenses: failure to comply with a production order under Section 487.0198 of the Criminal Code and obstruction of justice under Section 139(2).
OVHcloud has stated unequivocally that both the French parent company and its Canadian subsidiary acted in good faith while navigating the legal obligations applicable in their respective jurisdictions. The company maintains that its refusal to directly hand over the requested data was not an act of defiance but a principled stand rooted in the legal architecture it has built around customer data protection.
The Corporate Structure at the Center of the OVHcloud Legal Dispute
To understand why OVHcloud is facing criminal charges in Canada, one must first understand how the company is organized. Founded in 1999 and headquartered in Roubaix, France, OVHcloud operates over 46 data centers across the globe, including two in Canada. The company serves customers in more than 140 countries, offering public and private cloud services, dedicated servers, and web hosting. But its operational model is deliberately fragmented along national lines.
Each national subsidiary of OVHcloud operates as a separate legal entity, subject exclusively to the laws of the country in which customer data is physically stored. This structure is not an administrative convenience; it is a core design principle intended to ensure that customer information remains protected by the legal framework of the jurisdiction in which it resides. The company argues that this architecture prevents a situation where data stored in, say, France, could be directly accessed through a production order issued by a Canadian court without going through the proper international channels.
In this specific case, the production order sought data held by OVH subsidiaries in countries outside Canada. Because the Canadian subsidiary, Hébergement OVH Inc., does not control or directly access data stored by its sister entities abroad, the company argues it was legally and structurally unable to comply with the order as written.
Why OVHcloud Argues Canadian Authorities Used the Wrong Legal Process
A central pillar of OVHcloud’s defense is that Canadian authorities bypassed the established mechanism for obtaining evidence across international borders: the Mutual Legal Assistance Treaty (MLAT) process. MLATs are formal agreements between countries that allow for the request and exchange of information for law enforcement purposes. They are designed precisely for situations like this one, where evidence is held in one jurisdiction but needed in another.
According to OVHcloud, French authorities indicated that if Canadian law enforcement had initiated a formal MLAT request, it could have been processed on an expedited basis, with a response potentially available within a matter of weeks. The company contends that instead of using this established and cooperative pathway, Canadian authorities attempted to unilaterally compel a Canadian subsidiary to produce data that it does not control under the legal framework of its foreign host country.
The company’s position is that a domestic production order is not a valid tool for acquiring data stored abroad. To allow such a precedent would, in OVHcloud’s view, undermine the principle of territorial sovereignty upon which international law and cross-border data governance are built. It would effectively allow a court in one country to reach into another and compel action from a legal entity that has no operational or legal authority over the data in question.
Founder Octave Klaba Defends the Principles of Data Sovereignty
The public face of the company’s defense has been founder and CEO Octave Klaba. In a statement published on the company’s blog, Klaba framed the charges as a direct challenge to the values upon which OVHcloud was built. “OVHcloud was built on a promise of trust, transparency, and data sovereignty,” Klaba said. He added that the company believes it acted lawfully throughout the matter and will defend the principles of corporate separateness and respect for international law.
Klaba’s statement is significant not just for its content but for its tone. The company is not quietly negotiating a settlement; it is going public with a robust, principled defense that seeks to turn the legal case into a broader policy debate. By invoking “trust” and “transparency,” OVHcloud is signaling to its global customer base — many of whom choose the provider precisely for its European data protection standards — that it will resist legal pressure even when it comes with the threat of criminal penalties.
The Broader Implications for Cloud Providers Operating Internationally
The outcome of the OVHcloud case in Canada has the potential to send shockwaves through the global cloud computing industry. Every major cloud provider — from Amazon Web Services and Microsoft Azure to Google Cloud and regional players like OVHcloud — operates through a network of subsidiaries and data centers spread across multiple jurisdictions. The legal relationships between these entities, and the extent to which a parent company or a local subsidiary can be compelled to produce data held by a foreign affiliate, are questions that have not been definitively settled in many jurisdictions.
If Canadian authorities succeed in their prosecution of OVHcloud, it could set a precedent that encourages other governments to use domestic production orders to access data stored overseas, effectively bypassing MLAT procedures. This would fundamentally alter the risk profile for multinational cloud providers and the organizations that rely on them. A company that promises data sovereignty in France or Germany might find that promise undermined if a foreign court can compel its local subsidiary to hand over data stored in those jurisdictions.
Conversely, if OVHcloud prevails, it would reinforce the principle that MLATs are the required channel for cross-border data requests. This would provide greater legal certainty for cloud providers and their customers, confirming that data stored in one country cannot be unilaterally accessed by law enforcement from another without going through the proper diplomatic and legal procedures.
What Is a Production Order Under Section 487.014 of Canada’s Criminal Code?
A production order is a legal tool available to Canadian law enforcement that compels a person or organization to produce documents or data relevant to an investigation. Section 487.014 of the Criminal Code allows a justice or judge to issue such an order if there are reasonable grounds to suspect that an offense has been committed and that the documents or data in question will provide evidence of the offense. The order can be directed at a wide range of entities, including financial institutions, telecommunications companies, and internet service providers. Failure to comply with a production order is itself a criminal offense under Section 487.0198, carrying potential penalties including fines and imprisonment.
The charges against OVHcloud under this section are serious. A conviction for obstruction of justice under Section 139(2) is even more significant, as it suggests that authorities believe the company’s non-compliance was not merely a technical oversight but a deliberate act intended to hinder the investigation.
How the OVHcloud Case Differs From Previous Cross-Border Data Disputes
This is not the first time a technology company has resisted a government demand for data stored abroad. The high-profile battle between Microsoft and the U.S. Department of Justice over emails stored in Ireland, which ultimately led to the passage of the Clarifying Lawful Overseas Use of Data (CLOUD) Act in the United States, is a clear predecessor. However, the OVHcloud case has some distinct features that make it particularly noteworthy.
First, the charges in Canada are criminal in nature, not merely civil. OVHcloud is not just facing a fine or a court order to comply; it is facing a criminal prosecution that could result in penalties against both the company and potentially its officers. This raises the stakes considerably. Second, OVHcloud is not a U.S. company. It is a French company with a deep European identity and a business model explicitly premised on European data protection standards. The clash between a European company’s data sovereignty commitments and a non-European government’s law enforcement needs adds a geopolitical dimension that was less prominent in the Microsoft case.
Third, the argument that corporate separateness prevents a subsidiary from accessing data held by a foreign affiliate is a more structural and technical defense than the arguments typically made by U.S. tech giants. OVHcloud is not arguing that it has the data but should not have to hand it over; it is arguing that it literally cannot hand it over because the Canadian subsidiary does not have access to it. This legal and operational firewall is central to its defense.
What This Means for Organizations That Rely on Jurisdiction-Specific Data Protections
For enterprises, particularly those in regulated industries like finance, healthcare, and government, the OVHcloud case carries direct and practical consequences. Many organizations choose to store data with a specific cloud provider in a specific country precisely to benefit from that country’s data protection laws. A European company might store its customer data on OVHcloud servers in France to ensure it is covered by the General Data Protection Regulation (GDPR). A Canadian company might store sensitive data within Canada to comply with provincial privacy laws.
The legal certainty that these decisions rely upon is now called into question. If a court in one country can compel a cloud provider’s local subsidiary to produce data stored in another country, the jurisdictional safe harbor that organizations thought they had secured may prove illusory. This uncertainty could slow down cloud adoption for sensitive workloads or push organizations toward providers that can offer stronger legal guarantees of jurisdictional isolation.
On the other hand, a decisive victory for OVHcloud could strengthen the legal foundation for these arrangements, confirming that the physical location of data has real and enforceable legal consequences. It would provide ammunition for cloud providers to resist foreign government demands and for customers to demand that their cloud provider maintain strict data isolation practices.
The Role of Mutual Legal Assistance Treaties in Modern Cloud Governance
MLATs have existed for decades, but they were designed for a world in which physical evidence was the norm. In an era where digital data can be stored on servers halfway around the world and accessed from anywhere, the MLAT process has come under strain. Requests can take months or years to process, and the bureaucracy involved can be daunting for law enforcement agencies operating on tight investigation timelines.
OVHcloud’s argument that French authorities could have processed an expedited MLAT request within weeks suggests that the system may be capable of working faster than critics claim, at least in some cases. But the broader issue remains: the existing legal infrastructure for cross-border data requests is struggling to keep pace with the speed and scale of modern cloud computing. The OVHcloud case is likely to accelerate calls for reform, whether through new bilateral agreements, updated MLAT procedures, or entirely new legal frameworks for international data governance.
The fundamental question the court will have to answer is whether a domestic production order can reach beyond national borders to compel action from a corporate entity that has no legal or practical control over the data in question. The answer will have far-reaching consequences for the balance between law enforcement needs and the principle of data sovereignty.
As the case moves through the Canadian legal system, cloud providers, enterprise customers, and data privacy advocates around the world will be watching closely. The charges against OVHcloud are not merely a legal dispute between a company and a government. They are a referendum on the architecture of the global internet and the rules that govern where data lives, who can access it, and how. The verdict, whenever it comes, will shape the cloud computing landscape for years to come.
