United States of America

United States of America

New prohibitions and security requirements for data-related transactions with countries of concern

08 Apr 2025

On 8 April 2025, the Department of Justice of the United States entered into force a final rule (28 CFR Part 202) to implement Executive Order 14117, Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.

The rule prohibits or restricts transactions that could give "countries of concern" or "covered persons" access to bulk sensitive personal data of the United States (including genomic, biometric, precise-geolocation, personal-health, or personal-financial data) or to United States Government-related data.

"Countries of concern" are: China, including Hong Kong, China and Macao, China; the Democratic People’s Republic of Korea; the Bolivarian Republic of Venezuela, the Islamic Republic of Iran; the Republic of Cuba and the Russian Federation. 

"Covered persons" include entities that are: 50 per cent or more owned, directly or indirectly, by a country of concern or another covered person; Organized or based in a country of concern; or certain associated individuals.

Prohibited transactions include specified data-brokerage arrangements and other deals whose main purpose is to give such parties access to the protected data.

Restricted transactions include vendor, employment, and investment agreements that could provide access to protected data. These may proceed only if required security controls are in place and obligations on due diligence, independent audits and record-keeping are met. These requirements take effect on 6 October 2025 for persons subject to the jurisdiction of the United States of America.

The Department announced that it would not prioritize civil enforcement before 8 July 2025; enforcement has been active since 9 July 2025. While the Committee on Foreign Investment in the United States (CFIUS) continues to assess foreign investments case by case, the new rule establishes categorical and forward-looking prohibitions.

Nature of measure:
  • Entry restriction
  • Treatment and operation
Type:
  • Entry and establishment (Approval and admission - screening)
  • Treatment and operation (Operational conditions)
Industry:
  • Not industry specific
  • Services (Telecommunications, Computer programming, consultancy and related activities, Financial and insurance activities, Legal and accounting activities, Scientific research and development, Other professional, scientific and technical activities, Administrative and support service activities, Public administration and defence; compulsory social security, Human health activities)
Inward FDI:
Yes
Outward FDI:
No
Sources: