Shared Services Canada is responsible, of course, but in fact I thought the same did apply to federal data. Certainly when we're undertaking procurement for systems that will have data about Canadians on them, we specify that the servers need to be in Canada.
On October 25th, 2016. See this statement in context.