Anonymised, illustrative composite. A national security review had reached no conclusion when the Minister ordered the target to change how it handled client data — a live operating constraint under a 2024 power that binds the business while everyone still waits for a decision on the deal.
At a glance
A foreign strategic acquirer agreed to buy a Vancouver data-analytics company whose client base included several critical-infrastructure operators. The Minister issued a s.25.2 notice shortly after signing and, within the prescribed period, ordered a full national security review under s.25.3(1). The parties expected the review to run its ordinary course — a delayed closing, then an eventual outcome one way or the other.
Six weeks into the review, and with no decision yet made on the investment itself, the target received an order requiring it to segregate a defined category of client data relating to critical-infrastructure customers and host it exclusively on Canadian-located infrastructure, effective immediately, pending completion of the review. Nobody had told the target this power existed separately from the outcome of the review — the parties had been tracking only the eventual go/no-go decision, not the possibility of a binding order arriving in the middle.
The affected client contracts represented approximately $6,400,000 of the target's $19,000,000 in annual recurring revenue. Migrating that data to Canadian-hosted infrastructure on the timeline the order required cost roughly $340,000 in unbudgeted vendor and engineering spend, independent of anything in the deal itself.
Read the unit. This power sits in its own subsection, added to the Act in 2024, and it is not a variant of the review timeline addressed by the s.25.3(6)/(7) mechanics that decide when the review itself concludes. Section 25.3(1.1) provides that the Minister “shall, by order, impose interim conditions in respect of the investment that are applicable until no later than when consideration of the investment is complete, or amend such conditions… if the Minister… is satisfied that it is necessary for the purpose of preventing injury to national security that could arise during that review”, and “shall also delete a condition if the Minister… is satisfied that it is no longer necessary for that purpose”. The power to impose, amend and delete runs on its own trigger — necessity to prevent injury during the review — independent of whatever the review's eventual outcome turns out to be.
The order also does not surface the way an ordinary regulatory instrument does. Section 25.3(1.2) states plainly: “The Statutory Instruments Act does not apply in respect of an order made under this section.” No Gazette publication, none of that Act's registration or examination requirements — the target learned of the order only because it was the addressee, not because it appeared anywhere public.
The target complied within the window the order specified. The review itself concluded four months after it began with a s.25.3(6)(c) notice that consideration was complete, on the strength of undertakings given to the Crown, and the deal closed. The data-segregation condition was not lifted at closing — it remained a live obligation on the business, now under the buyer's ownership, until a subsequent Ministerial deletion order some months later.
Non-compliance with an interim order carries its own enforcement track, independent of the underlying deal: a Ministerial demand can issue for failing to comply with an order made under s.25.3, and the demand process does not wait for the review to finish before it can be used. Treating the order as advisory pending a final review outcome would have been a mistake with its own timeline and its own consequences.
The tell was in how the buyer's integration plan was built: entirely around the day the deal would close, with nothing built for the possibility that the target's operations could be constrained by government order before that day, on a timeline the buyer did not control and could not have predicted from the outside.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
