New DOJ Rule Restricting Cross-Border Data Transfers with China and Other Countries of Concern: Compliance Implications

On Jan. 8, 2025, the DOJ issued its groundbreaking new rule establishing a data security regime based on national security policy with the DOJ as the critical regulator of data transfers. Most provisions of the rule take effect Apr. 8, 2025, with certain due diligence, audit, and reporting obligations taking effect on Oct. 6, 2025.

The rule prohibits certain data brokerage transactions and certain transactions involving human 'omic data and includes significant civil and criminal penalties for violations. The rule also creates a set of restricted transactions involving vendor agreements, employment agreements, or investment agreements in which U.S. persons may engage only if they comply with a set of cybersecurity and compliance-related requirements. There are also specifically defined exempted transactions to which the prohibitions and restrictions do not apply.

PADFAA, effective June 23, 2024, prohibits data brokers from transferring personally identifiable sensitive data to certain named foreign adversary countries, and any entity controlled by certain foreign adversaries. The law includes broad definitions of the terms "data brokers," "personally identifiable sensitive data," and "controlled by a foreign adversary," which means the law applies to a wide range of companies and it also includes steep civil penalties for violations.

Listen as our expert panel from Ropes & Gray reviews these changes in the federal government's approach to cross-border data transfers. The panel will also provide guidance for assessing the applicability of these new rules to a client's business and how to navigate compliance under this new data transfer framework.