Digital
Sovereignty

The Problem

America owns the entirety of your personal government data.

The Promise

The NCP will use the tools we already have available and build out a world-class flag in the digital ground for Saskatchewan and Indigenous communities.

The Plan

The NCP will introduce:

• The Saskatchewan Digital Services Act.
• The Saskatchewan Data Sovereignty Act.
• Amendments to The Saskatchewan Telecommunications Act.

This will allow Saskatchewan to enter the digital age and have a sovereign place within it.

The Saskatchewan Digital Services:

The Saskatchewan Digital Services (SDS) will be established as a Crown corporation reporting to the Minister responsible for SaskBuilds and Procurement. Its mandate will be to build out the sovereign digital state of Saskatchewan.

The SDS will act as the long-term product owner, operator, and maintainer of Saskatchewan's shared digital platforms, including identity, payments, service portals, data architecture, and core design systems. Ministries, agencies, and Crown corporations will use these shared platforms rather than duplicating them through separate vendor systems.

The SDS will recruit technical talent through competitive compensation, remote work flexibility, and partnership with Saskatchewan Polytechnic and the University of Saskatchewan's computer science programs.

A Saskatchewan Tech Stack (SaskStack) will be developed. It will allow the SDS to quickly and easily build custom web apps for every provincial ministry, agency, and Crown. This means a single login system, a unified data architecture, a shared UX/UI system, a single encryption module, and more, all running locally on secure SaskTel cloud servers. Some of the web apps will be:

• The SaskBonds purchasing portal.
• The Saskatchewan Library Authority online portal for borrowing and browsing.
• The Saskatchewan Transport Company's app and website for ticketing, bus tracking, and notifications.
• The CodeShare Civics online repository.
• Specific apps for specific departments, designed to fit specific needs.
• And more.

The SaskStack will include modernizing all Government of Saskatchewan services so they can be easily used online with a single account. New modernized websites will be designed to be intuitive and built with accessibility in mind from day one.

All SaskStack applications must meet WCAG 2.1 AA accessibility standards at minimum, with AAA compliance where feasible. Accessibility audits will be conducted before any application launch.

A unified login system called the Saskatchewan Account (SaskAccount) will allow residents to verify their identity once and access all provincial services. Identity verification will build on existing credentials such as health cards or driver's licences, with additional security layers. SaskAccount will not be mandatory for services that do not require identity verification.

Existing vendor contracts will be honoured through their terms. Contract renewals will be evaluated against SaskStack alternatives, with migration to provincial systems where functionality and cost are comparable. No new long-term contracts for services that SaskStack can provide will be signed after this Act comes into force.

Data security, privacy, and sovereignty will be of the utmost priority. Data must be stored and secured using zero-trust, ultra-secure privacy principles on local, SaskTel-owned servers as soon as possible. All employees must use strong password and multi-factor authentication protocols. Additionally, white-hat hackers will be contracted regularly to help secure the digital state.

SDS will establish a Saskatchewan Secure Desktop Standard for government computing, based wherever feasible on hardened, enterprise-grade, open-source operating systems and software. The goal is to reduce reliance on foreign proprietary platforms, improve security, and ensure long-term digital independence.

The transition will be phased over 15 years. Open-source desktop systems will become the default for government workloads where they are secure, functional, and cost-effective. Where specialized software still requires Windows or macOS, secure virtualization, isolated systems, or temporary exceptions may be used. The goal is to minimize dependence on proprietary operating systems, not to create disruption for its own sake.

SDS will maintain a 24/7 Security Operations Centre with incident response capabilities. All significant security incidents will be publicly disclosed within 72 hours, with affected residents notified directly. Annual security audits will be conducted by independent third parties with results published publicly within 60 days.

Software developed by or for SDS will be open source by default. Exceptions may be made where full public release would create legitimate security, privacy, or operational risks. Wherever possible, Saskatchewan will publish source code, standards, documentation, and reusable components so that other public institutions can adopt and improve them. This will be hosted on the CodeShare Civics Repository, a public platform where residents can view, audit, and propose improvements to government software and policy.

• See Policy 18 - Democratic Renewal for more.

In-person and telephone service options will be maintained for all government services. Digital services supplement but do not replace traditional access channels.

The Saskatchewan Digital Sovereignty Act:

Within 15 years: all Government of Saskatchewan data, including its personal information on residents, must be stored and located within local Saskatchewan data servers. This includes all needed cloud infrastructure for Government of Saskatchewan operations. The primary goal will be to close out all possible back doors or unauthorized access to resident data.

Indigenous data governance within provincial systems will be governed through agreements co-developed with the relevant Indigenous governing bodies, consistent with Ownership, Control, Access, and Possession (OCAP) principles, the Consent Protocol, and the Saskatchewan UNDRIP Implementation Act.

The Province will negotiate data-sharing agreements with federal agencies that specify exactly what data is shared, for what purposes, with what retention limits, and with what security requirements. No bulk data transfers will be permitted. All federal access will be logged, auditable, and reportable to the relevant oversight body on request.

Indigenous-governed data may only be shared with the express authorization of the relevant Indigenous governing body or bodies. The Government of Saskatchewan will have no unilateral authority to disclose, transfer, or grant access to such data.

Residents have the right to request a complete copy of all personal data held by the Government of Saskatchewan in a machine-readable format. Requests will be fulfilled within 30 days at no cost.

Automated Decision-Making and Artificial Intelligence:

Any automated decision system, including artificial intelligence, machine learning, large language models, rules engines, predictive analytics, scoring systems, or any similar future technology, can never be the sole decision-maker in any consequential decision affecting human life in Saskatchewan.

For the purpose of this Act, a consequential decision is any public decision that affects a resident's legal rights, privileges, or interests. These decisions will be treated in tiers, with stronger safeguards as the consequences become more serious.

Tier 1 - Decisions affecting interests:

These include decisions about service triage, prioritization, scheduling, routine eligibility screening, inspection targeting, administrative flags, or other decisions that may affect a person's practical interests but do not by themselves determine legal rights or statutory status.

Tier 1 systems may be used only with clear public notice, logging, auditability, and meaningful human supervision. A resident must be told when an automated system materially assisted a decision, and must have the right to request human reconsideration.

Tier 2 - Decisions affecting privileges or status:

These include decisions about licences, permits, certifications, professional status, public contracting eligibility, regulatory compliance findings, public-sector employment discipline, or the granting, suspension, reduction, or termination of significant statutory benefits or services.

Tier 2 decisions may not be made final without active human review by a properly delegated public official who has authority to depart from the system's recommendation, consider the resident's circumstances, and give written reasons. Residents must have a right to internal reconsideration and a right of independent review.

Tier 3 - Decisions affecting legal rights, liberty, bodily integrity, housing, family integrity, or other serious life consequences:

These include decisions relating to child intervention, involuntary treatment, detention or correctional classification, policing or public-safety risk scoring, housing eviction from public systems, emergency deprivation of benefits necessary for subsistence, or any other decision prescribed by regulation as high consequence.

Tier 3 systems may never act as the sole or primary decider. In these matters, automated systems may assist with information management, clerical support, or flagging, but the actual decision must be made by human beings exercising public judgment under law. Affected residents must receive written reasons, meaningful disclosure of the role the system played, urgent access to human review, and a right of independent appeal.

Human review and appeal rights must be real, not cosmetic.

Any human reviewer must be able to:

• Access the record relied upon by the system;
• Understand the system's role, inputs, and limits to the degree necessary to review the decision fairly;
• Receive and consider new information from the affected person;
• Depart from, override, or reject the automated recommendation;
• Give written reasons in plain language.

Any independent reviewer or appeal body must be institutionally separate from the original decision-maker and must not be a person who designed, procured, trained, deployed, or directly supervised the system being challenged. Independent review must be impartial, procedurally fair, and empowered to confirm, vary, reverse, or remit the matter for redetermination.

The following minimum timelines will apply:

• for Tier 1 decisions, a resident may request human reconsideration within 30 days, and a human decision must be provided within 15 business days;
• for Tier 2 decisions, a resident may request reconsideration within 30 days, and a human reconsideration decision with written reasons must be provided within 10 business days, with independent review available thereafter;
• for Tier 3 decisions, urgent human review must be available immediately or as soon as practicable, and in any event no later than 72 hours after request unless a shorter period is required by the nature of the decision.

If a review deadline is missed, the matter will automatically escalate to the next level of review. Where the decision affects subsistence, housing, family integrity, or bodily liberty, the status quo must be preserved pending review unless immediate action is required by law for reasons of safety or emergency.

Saskatchewan Digital Services must publish public standards governing automated decision systems used by the Province, including:

• The purpose of each system;
• The classes of decisions it may assist;
• The data sources it uses;
• The impact tier assigned to it;
• Testing, audit, and monitoring requirements;
• Bias, accessibility, and error-reporting requirements;
• The applicable review and appeal process.

No Government of Saskatchewan data, and no resident data held on behalf of the Government of Saskatchewan, may be used to train external private AI models.

The Province also acknowledges a broader federal gap. Canada still lacks a dedicated, generally applicable AI statute governing the use of artificial intelligence across the economy. While the federal government has adopted internal public-service rules for automated decision-making, those rules do not create a complete national baseline for residents, workers, or provincial public institutions. Saskatchewan therefore calls on Ottawa to enact strong, rights-protecting federal legislation governing high-impact AI systems, meaningful contestation rights, independent oversight, and clear limits on automated decision-making affecting human beings.

This is not a light or easy subject and the NCP will not treat it as such. The people of Saskatchewan are not data points to be optimized. They are human beings to be served.

SaskTel:

SaskTel will be given a new mandate to ensure Saskatchewan Digital Sovereignty. They will procure and operate local sovereign data server centres in the province.

These sovereign data servers are dedicated to secure data storage and government operations, not commercial AI training. Government use of AI tools will be governed by a separate AI policy ensuring transparency, human oversight, and prohibition on using resident data to train external AI models.

For safety and security reasons, the centres will be operated in a geographically redundant way. This includes dedicated infrastructure for:

• Primary and backup server centres exclusively to be used for Indigenous Data, with total access and control handed off to Indigenous governing bodies.
• Primary and backup server centres for all Government of Saskatchewan personal and private data.
• Primary and backup server centres for its encrypted, enterprise-grade email services.

These data servers will be ultra secure, encrypted, and private. No one but SaskTel and the relevant Indigenous governing body will have access to the Saskatchewan peoples' data or the Indigenous Peoples of Saskatchewan data respectively. Neither government nor Indigenous data will be shared with external parties except pursuant to a valid court order issued by a Canadian court.

SaskTel will then use these servers to run and operate SaskCloud. SaskCloud will be a sovereign cloud platform operated by SaskTel to host Government of Saskatchewan data, SaskStack applications, and approved public-sector workloads. It may also be offered to municipalities, school divisions, post-secondary institutions, health entities, and other public bodies on a shared-services basis.

SaskTel will also be given the mandate to remake its email service into a modern, above-enterprise-grade email provider for the Government of Saskatchewan. This will allow the Government of Saskatchewan to securely and privately send emails internally via end-to-end encryption, as well as externally through single-point encryption. No one but the Government of Saskatchewan will ever be able to read or access them.

SaskTel will also be mandated to remain net-neutral. It is to treat the internet as a utility, no different than electricity.

The Funding

The upfront funding for SDS, SaskStack modernization, identity infrastructure, security operations, and data localization will come from a combination of General Revenue Fund support, Crown capital investment, and SaskBond-financed infrastructure where appropriate. SaskTel's sovereign hosting and data-centre infrastructure will be financed through its own capital program, with provincial support where required. Over time, savings from reduced vendor dependence, shared infrastructure, and standardized platforms will be reinvested into Saskatchewan's public digital capacity.

What It Means For You

It means a modern, digital-friendly government that meets you where you are.

It means your data isn't used to train an AI model that makes the internet worse.

It means the dignity of your data being your own, private, and protected.

FAQ

• What is SaskStack?
• SaskStack is Saskatchewan's shared public digital platform. It allows Saskatchewan Digital Services to build and maintain modern web applications, identity services, payment systems, and service portals for ministries, agencies, Crown corporations, and other approved public bodies without relying on foreign vendor lock-in.


• What is the Saskatchewan Secure Desktop Standard?
• It is the government's long-term plan to move appropriate public-sector computing onto hardened, enterprise-grade, open-source operating systems and software wherever feasible. The goal is to reduce dependence on foreign proprietary platforms while maintaining security, usability, and operational continuity.


• Will government services still be available in person?
• Yes. In-person and telephone service options will remain available for all government services. Digital modernization is meant to improve access, not eliminate traditional service channels.


• What is the Saskatchewan Data Sovereignty Act?
• It is the law that will require Government of Saskatchewan data to be stored on Saskatchewan-based servers within 15 years, tighten provincial control over data sharing, and ensure that resident data is governed under clear security, privacy, and sovereignty rules.


• What are OCAP principles?
• OCAP stands for Ownership, Control, Access, and Possession. Indigenous data governance within provincial systems will be governed through agreements co-developed with the relevant Indigenous governing bodies, consistent with OCAP principles, the Consent Protocol, and the Saskatchewan UNDRIP Implementation Act.


• What is SaskCloud?
• SaskCloud is a sovereign cloud platform operated by SaskTel to host Government of Saskatchewan data, SaskStack applications, and approved public-sector workloads. It may also be offered on a shared-services basis to municipalities, school divisions, post-secondary institutions, health entities, and other public bodies.


• Will SaskTel offer secure email?
• Yes. SaskTel will build a secure, enterprise-grade email and collaboration platform for government and approved public-sector institutions, ensuring that sensitive communications can be handled within a Saskatchewan-controlled digital environment.


• Will all government software be open source?
• Software developed by or for Saskatchewan Digital Services will be open source by default. Exceptions may be made where full public release would create legitimate security, privacy, or operational risks.