Evaluating the Global Business Impact of U.S. Restrictions on Cross-Border Data Access
Overview
As of 2025, the United States of America has introduced sweeping restrictions on cross-border access to sensitive personal data under 28 CFR Part 202, affecting global clinical research, biotech, and digital health operations. The regulation targets data sharing and access involving six countries of concern: China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela, and applies even when access is indirect or data is anonymized.
This article outlines the scope of regulated data, highlights prohibited and restricted transactions, and explores the real-world impact on clinical trials, data storage, outsourcing, and international partnerships. It also reviews key exemptions, such as those for FDA-regulated studies, and provides actionable recommendations for companies to remain compliant in a shifting global data governance landscape.Regulation28 CFR Part 202Issued byU.S. Department of Justice (DOJ)Based onExecutive Order 14117 (Feb 28, 2024)ScopeLimits foreign access to U.S. sensitive personal and government-related data by certain foreign governments or associated personsApplies toLegally binding restrictions on U.S. persons interacting with foreign entities or individualsPublishedJanuary 8, 2025EffectiveApril 8, 2025 (90 days after publication)[Note: Entities must comply with the Rule’s due diligence, audit and reporting requirements by October 5, 2025. The Rule does not apply to transactions completed before its effective date, but it does apply to ongoing activity, even if that activity is required by prior contracts.]
Geographic and Individual Impact
Companies engaging with Contract Research Organizations (CROs), labs, IT vendors, or collaborators from the following six countries must reassess data access and control. Any involvement, even indirectly could trigger restrictions under this rule:
China (including Hong Kong and Macau)
Russia
Iran
North Korea
Cuba
Venezuela
Entities that are:
50% or more owned (directly or indirectly) by one or more countries of concern, or
Organised under the laws of, or principally operating from, a country of concern.
50% or more owned (directly or indirectly) by other covered persons, including those described below.
Individuals who are:
Employees or contractors of either a country of concern or of any of the entities described above.
Are primarily residents within the territorial jurisdiction of a country of concern.
Any person, regardless of location, who is determined by the U.S. Attorney General to:
Be owned or controlled by, or subject to the jurisdiction or direction of, a country of concern or covered person,
Be acting or likely to act on behalf of a country of concern or covered person, or
Have knowingly caused or directed a violation of this regulation or be likely to do so.
Types of Regulated Data
The regulation covers “bulk U.S. sensitive personal data” as defined in §202.206—referring to large volumes of personal information about U.S. individuals, regardless of format or whether it has been anonymized, pseudonymized, de-identified, or encrypted. Coverage applies when volume thresholds in §202.205 are met or exceeded. This includes:
Genomic and ‘omic’ data: Including genomic, epigenomic, proteomic, or transcriptomic information
Biometric Identifiers: Including facial images, voice patterns, retina scans, and similar features
Personal Health Data: This includes physical measurements (e.g., height, weight, vital signs), symptoms, psychological or behavioural information, medical diagnoses, treatments, and test results
Personal Financial Data: This covers credit or debit card details, bank account information, financial liabilities, and payment history
Precise Geolocation Data: This refers to past or present location data that can identify the physical location of a person or device within about 1,000 meters (roughly two-thirds of a mile)
Multiple Identifying Elements: This includes two or more means of identification such as IMEI numbers, MAC addresses, SIM card numbers, Social Security numbers, driver’s licenses, or other government-issued IDs
Government-related data is separately defined under §202.222 and includes any data that could reveal information about federal personnel or sensitive government locations.
Restricted or Prohibited Data
Prohibited transactions
U.S. persons/entities (i.e. any U.S. citizen, national, lawful permanent resident, refugee, or asylee; any person located in the U.S.; or any entity organized under U.S. law (including foreign branches)) must avoid the following:
Selling or sharing sensitive data with entities or individuals linked to the six restricted countries
Sending human biospecimens or genomic data to partners in those countries
Setting up vendor or employment deals that give foreign actors access to sensitive U.S. data
For example, if a U.S.-based genomics company develops an AI tool trained on a large volume of sensitive U.S. genomic data, and later licenses that tool to its parent company in China, this could be considered a prohibited transaction. Even if the tool itself does not directly share raw data, the potential to reveal sensitive training data, combined with the U.S. company’s awareness of this risk, constitutes indirect access by a covered foreign person, which is restricted under the regulation.
Restricted Transactions
Some activities with vendors, employees, or investors from the six restricted countries can proceed only if specific security requirements are met. These include agreements where sensitive data may be accessed directly or indirectly.
Applies to:
Vendor contracts (e.g. cloud hosting, data processing)
Employment agreements (e.g. IT support, data handling)
Investment relationships with data access components
These are not allowed unless the U.S. company fully implements the required data safeguards. Simply using “equivalent” controls is not enough.
Take for instance a U.S.-based life sciences company that needs help maintaining its clinical data platform. To cut costs or find specific skills, it hires a remote IT contractor who happens to be based in a restricted country. Even if the contractor is only working on the back end, there is still a risk; they could potentially access sensitive U.S. personal health or financial data. In a situation like this, the company is required to have a full set of security measures in place. If it does not, the arrangement would violate 28 CFR Part 202. It does not matter that the contractor is not supposed to see the data, what matters is that the access risk exists.
Exemptions Relevant to Clinical Research
Allowed (with conditions)Not AllowedFDA-regulated clinical investigations, including clinical trialsNon-FDA/non-federally funded studies unless specifically licensedOther clinical investigations and post-marketing surveillance with de-identified dataStudies where data can be re-identified or accessed by covered entities
Current impact: As of April 2025, the National Institutes of Health (NIH) has barred researchers affiliated with the six countries of concern accessing 21 major U.S. biomedical datasets, enforcing provisions of 28 CFR Part 202. (Science, 2025)
Potential Impact
The regulation has direct implications for:
Clinical trials and R&D: Collaborating on cross-border studies with labs, CROs, or cloud providers in restricted countries risks regulatory violations. Even if the data is encrypted, access by these parties may still be subject to restrictions.
Data storage and processing: Clients using foreign infrastructure or outsourced IT in these regions must reassess vendor arrangements and consider relocating or segmenting data.
Hiring and partnerships: Employment involving sensitive data access by personnel in these countries may need restrictions or licensing.
Recommendations
Assess Exposure: Identify clinical trials, data transfers, or collaborations involving restricted countries, including CROs, labs, cloud vendors, and academics.
Verify Exemptions and Seek Licensing: Confirm if activities qualify for exemptions (e.g., FDA-regulated or de-identified studies) and maintain compliance documentation. For non-exempt activities, consult legal counsel to apply for DOJ licenses.
Control Data Access: Implement technical and legal controls to prevent unauthorized access; audit data systems regularly.
Adapt and Monitor: Favor exempt collaborations, minimize data sharing, and stay updated on DOJ guidance and enforcement.
Conclusion
In conclusion, the U.S. restrictions on foreign access to sensitive data signal a pivotal shift in global data governance, including for industries involved in clinical research, biotechnology, and digital health. As enforcement intensifies, organizations must take a proactive, risk-based approach, assessing exposure, verifying exemptions, securing data access, and documenting compliance efforts. By adapting operations and strengthening internal controls, businesses can protect sensitive U.S. data, uphold regulatory obligations, and maintain the integrity of their global collaborations.
Original Source: U.S. Data Access Restrictions & Their Global Business Impact
