New U.S. Regulation Takes Effect to Restrict China's Access to Sensitive Data

The United States has officially enacted the "Preventing Access to Americans' Bulk Sensitive Personal Data and U.S. Government-Related Data by Countries of Concern" regulation (hereinafter referred to as the "Regulation"). Certain due diligence and audit requirements under the Regulation will be implemented in phases beginning October 6, 2025.

The Regulation serves as a detailed follow-up to Executive Order 14117, which was issued to prevent countries of concern from acquiring sensitive personal data of U.S. citizens and government-related information. It marks a significant escalation in the U.S. government's control over cross-border data flows, particularly involving strategic competitors.

The Regulation explicitly identifies China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela as "countries of concern." These jurisdictions are prohibited from accessing U.S. sensitive personal data and U.S. government-related data, and related transactions will be subject to strict scrutiny.

The Regulation specifies which countries and regions are subject to restrictions and outlines categories of transactions that are prohibited, restricted, or exempt.

Thresholds are defined for bulk processing of certain types of sensitive personal data, including:

Biometric identifiers

Precise geolocation data

Personal health and financial data

Specific categories of personally identifiable information (PII)

Several categories of transactions are excluded from prohibition or restriction, including:

Personal communications and certain financial services

Intra-group business transactions

Transactions authorized under U.S. federal law or international agreements

Transactions under the jurisdiction of the Committee on Foreign Investment in the United States (CFIUS)

Telecommunications and biologics-related services

Industry experts believe this new Regulation will have far-reaching implications, potentially intensifying the digital competition between the U.S. and China and reshaping the global data governance landscape. Multinational companies are advised to immediately assess their compliance exposure and establish robust data governance frameworks to navigate the evolving regulatory environment.

Particularly for sectors at the forefront of technological advancement - such as artificial intelligence, biotechnology, and digital health - proactive risk mitigation strategies will be essential in preparing for heightened scrutiny and new compliance obligations.