Evaluating the Global Business Impact of U.S. Restrictions on Cross-Border Data Access

Overview

As of 2025, the United States of America has introduced sweeping restrictions on cross-border access to sensitive personal data under 28 CFR Part 202, affecting global clinical research, biotech, and digital health operations. The regulation targets data sharing and access involving six countries of concern: China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela, and applies even when access is indirect or data is anonymized.

This article outlines the scope of regulated data, highlights prohibited and restricted transactions, and explores the real-world impact on clinical trials, data storage, outsourcing, and international partnerships. It also reviews key exemptions, such as those for FDA-regulated studies, and provides actionable recommendations for companies to remain compliant in a shifting global data governance landscape.

Regulation	28 CFR Part 202
Issued by	U.S. Department of Justice (DOJ)
Based on	Executive Order 14117 (Feb 28, 2024)
Scope	Limits foreign access to U.S. sensitive personal and government-related data by certain foreign governments or associated persons
Applies to	Legally binding restrictions on U.S. persons interacting with foreign entities or individuals
Published	January 8, 2025
Effective	April 8, 2025 (90 days after publication)[Note: Entities must comply with the Rule’s due diligence, audit and reporting requirements by October 5, 2025. The Rule does not apply to transactions completed before its effective date, but it does apply to ongoing activity, even if that activity is required by prior contracts.]

Geographic and Individual Impact

Companies engaging with Contract Research Organizations (CROs), labs, IT vendors, or collaborators from the following six countries must reassess data access and control. Any involvement, even indirectly could trigger restrictions under this rule:

• China (including Hong Kong and Macau)
• Russia
• Iran
• North Korea
• Cuba
• Venezuela

Entities that are:

• 50% or more owned (directly or indirectly) by one or more countries of concern, or
• Organised under the laws of, or principally operating from, a country of concern.
• 50% or more owned (directly or indirectly) by other covered persons, including those described below.

Individuals who are:

• Employees or contractors of either a country of concern or of any of the entities described above.
• Are primarily residents within the territorial jurisdiction of a country of concern.

Any person, regardless of location, who is determined by the U.S. Attorney General to:

• Be owned or controlled by, or subject to the jurisdiction or direction of, a country of concern or covered person,
• Be acting or likely to act on behalf of a country of concern or covered person, or
• Have knowingly caused or directed a violation of this regulation or be likely to do so.

Types of Regulated Data

The regulation covers “bulk U.S. sensitive personal data” as defined in §202.206—referring to large volumes of personal information about U.S. individuals, regardless of format or whether it has been anonymized, pseudonymized, de-identified, or encrypted. Coverage applies when volume thresholds in §202.205 are met or exceeded. This includes:

• Genomic and ‘omic’ data: Including genomic, epigenomic, proteomic, or transcriptomic information
• Biometric Identifiers: Including facial images, voice patterns, retina scans, and similar features
• Personal Health Data: This includes physical measurements (e.g., height, weight, vital signs), symptoms, psychological or behavioural information, medical diagnoses, treatments, and test results
• Personal Financial Data: This covers credit or debit card details, bank account information, financial liabilities, and payment history
• Precise Geolocation Data: This refers to past or present location data that can identify the physical location of a person or device within about 1,000 meters (roughly two-thirds of a mile)
• Multiple Identifying Elements: This includes two or more means of identification such as IMEI numbers, MAC addresses, SIM card numbers, Social Security numbers, driver’s licenses, or other government-issued IDs

Government-related data is separately defined under §202.222 and includes any data that could reveal information about federal personnel or sensitive government locations.

Restricted or Prohibited Data

Prohibited transactions

U.S. persons/entities (i.e. any U.S. citizen, national, lawful permanent resident, refugee, or asylee; any person located in the U.S.; or any entity organized under U.S. law (including foreign branches)) must avoid the following:

• Selling or sharing sensitive data with entities or individuals linked to the six restricted countries
• Sending human biospecimens or genomic data to partners in those countries
• Setting up vendor or employment deals that give foreign actors access to sensitive U.S. data

For example, if a U.S.-based genomics company develops an AI tool trained on a large volume of sensitive U.S. genomic data, and later licenses that tool to its parent company in China, this could be considered a prohibited transaction. Even if the tool itself does not directly share raw data, the potential to reveal sensitive training data, combined with the U.S. company's awareness of this risk, constitutes indirect access by a covered foreign person, which is restricted under the regulation.

Restricted Transactions

Some activities with vendors, employees, or investors from the six restricted countries can proceed only if specific security requirements are met. These include agreements where sensitive data may be accessed directly or indirectly.

Applies to:

• Vendor contracts (e.g. cloud hosting, data processing)
• Employment agreements (e.g. IT support, data handling)
• Investment relationships with data access components

These are not allowed unless the U.S. company fully implements the required data safeguards. Simply using “equivalent” controls is not enough.

Take for instance a U.S.-based life sciences company that needs help maintaining its clinical data platform. To cut costs or find specific skills, it hires a remote IT contractor who happens to be based in a restricted country. Even if the contractor is only working on the back end, there is still a risk; they could potentially access sensitive U.S. personal health or financial data. In a situation like this, the company is required to have a full set of security measures in place. If it does not, the arrangement would violate 28 CFR Part 202. It does not matter that the contractor is not supposed to see the data, what matters is that the access risk exists.

Exemptions Relevant to Clinical Research

Allowed (with conditions)	Not Allowed
FDA-regulated clinical investigations, including clinical trials	Non-FDA/non-federally funded studies unless specifically licensed
Other clinical investigations and post-marketing surveillance with de-identified data	Studies where data can be re-identified or accessed by covered entities

Current impact: As of April 2025, the National Institutes of Health (NIH) has barred researchers affiliated with the six countries of concern accessing 21 major U.S. biomedical datasets, enforcing provisions of 28 CFR Part 202. (Science, 2025)

Potential Impact

The regulation has direct implications for:

• Clinical trials and R&D: Collaborating on cross-border studies with labs, CROs, or cloud providers in restricted countries risks regulatory violations. Even if the data is encrypted, access by these parties may still be subject to restrictions.
• Data storage and processing: Clients using foreign infrastructure or outsourced IT in these regions must reassess vendor arrangements and consider relocating or segmenting data.
• Hiring and partnerships: Employment involving sensitive data access by personnel in these countries may need restrictions or licensing.

Recommendations

• Assess Exposure: Identify clinical trials, data transfers, or collaborations involving restricted countries, including CROs, labs, cloud vendors, and academics.
• Verify Exemptions and Seek Licensing: Confirm if activities qualify for exemptions (e.g., FDA-regulated or de-identified studies) and maintain compliance documentation. For non-exempt activities, consult legal counsel to apply for DOJ licenses.
• Control Data Access: Implement technical and legal controls to prevent unauthorized access; audit data systems regularly.
• Adapt and Monitor: Favor exempt collaborations, minimize data sharing, and stay updated on DOJ guidance and enforcement.

Conclusion

In conclusion, the U.S. restrictions on foreign access to sensitive data signal a pivotal shift in global data governance, including for industries involved in clinical research, biotechnology, and digital health. As enforcement intensifies, organizations must take a proactive, risk-based approach, assessing exposure, verifying exemptions, securing data access, and documenting compliance efforts. By adapting operations and strengthening internal controls, businesses can protect sensitive U.S. data, uphold regulatory obligations, and maintain the integrity of their global collaborations.