New Rules for Data Flows Take Effect: What You Need to Know

On April 8, 2025, the US Department of Justice’s National Security Division’s final rule regulating sensitive data about US persons came into effect. DOJ also announced a 90-day grace period on enforcement. At a moment of heightened geopolitical competition, the rule was designed to prevent foreign adversaries from exploiting data that could be used to enhance artificial intelligence capabilities, augment intelligence collection and foreign espionage, or enable malicious cyberattacks and malign foreign influence operations.

Broadly speaking, the rule regulates two kinds of transactions involving US government data and Americans’ bulk sensitive personal data. First, transactions involving “data brokerage,” broadly defined as the sale or licensing of access to data, are subject to strict prohibitions: US persons may not knowingly engage in such a transaction with a country of concern (China, along with Hong Kong and Macau; Cuba; Iran; North Korea; Russia; or Venezuela) or with a covered person (certain foreign companies and foreign individuals located in a country of concern). Second, vendor, employment, and investment agreements with covered persons are prohibited unless the US person complies with a robust set of data security requirements.

Because the rule targets specific kinds of transactions rather than a particular industry, it will affect US firms broadly, not just “data brokers.” The new framework is complex: DOJ released several resources, including a compliance guide, an implementation and enforcement policy, and a list of more than 100 frequently asked questions to assist companies with implementation. Many companies will benefit from the guidance of outside counsel, who can help implement a tailored compliance effort, including specific due diligence, audit, and record-keeping requirements. Firms should proactively assess their regulatory obligations and engage in good-faith compliance efforts, including by conducting internal data access reviews, adjusting employee locations or responsibilities, and/or implementing relevant security requirements.

This article is available in the Jenner & Block Japan Newsletter. / この記事はJenner & Blockニュースレターに掲載されています。

© 2026 Jenner & Block LLP. Attorney Advertising. Jenner & Block LLP is an Illinois Limited Liability Partnership including professional corporations. This publication, presentation, or event is not intended to provide legal advice but to provide information on legal matters and/or firm news of interest to our clients and colleagues. Readers or attendees should seek specific legal advice before taking any action with respect to matters mentioned in this publication or at this event. The attorney responsible for this communication is Brent E. Kidwell, Jenner & Block LLP, 353 N. Clark Street, Chicago, IL 60654-3456. Prior results do not guarantee a similar outcome. Jenner & Block London LLP, an affiliate of Jenner & Block LLP, is a limited liability partnership established under the laws of the State of Delaware, USA and is authorised and regulated by the Solicitors Regulation Authority with SRA number 615729. Information regarding the data we collect and the rights you have over your data can be found in our Privacy Notice. For further inquiries, please contact dataprotection@jenner.com.

New Rules for Data Flows Take Effect: What You Need to Know

On April 8, 2025, the US Department of Justice’s National Security Division’s final rule regulating sensitive data about US persons came into effect. DOJ also announced a 90-day grace period on enforcement. At a moment of heightened geopolitical competition, the rule was designed to prevent foreign adversaries from exploiting data that could be used to enhance artificial intelligence capabilities, augment intelligence collection and foreign espionage, or enable malicious cyberattacks and malign foreign influence operations.

Broadly speaking, the rule regulates two kinds of transactions involving US government data and Americans’ bulk sensitive personal data. First, transactions involving “data brokerage,” broadly defined as the sale or licensing of access to data, are subject to strict prohibitions: US persons may not knowingly engage in such a transaction with a country of concern (China, along with Hong Kong and Macau; Cuba; Iran; North Korea; Russia; or Venezuela) or with a covered person (certain foreign companies and foreign individuals located in a country of concern). Second, vendor, employment, and investment agreements with covered persons are prohibited unless the US person complies with a robust set of data security requirements.

Because the rule targets specific kinds of transactions rather than a particular industry, it will affect US firms broadly, not just “data brokers.” The new framework is complex: DOJ released several resources, including a compliance guide, an implementation and enforcement policy, and a list of more than 100 frequently asked questions to assist companies with implementation. Many companies will benefit from the guidance of outside counsel, who can help implement a tailored compliance effort, including specific due diligence, audit, and record-keeping requirements. Firms should proactively assess their regulatory obligations and engage in good-faith compliance efforts, including by conducting internal data access reviews, adjusting employee locations or responsibilities, and/or implementing relevant security requirements.

This article is available in the Jenner & Block Japan Newsletter. / この記事はJenner & Blockニュースレターに掲載されています。

© 2026 Jenner & Block LLP. Attorney Advertising. Jenner & Block LLP is an Illinois Limited Liability Partnership including professional corporations. This publication, presentation, or event is not intended to provide legal advice but to provide information on legal matters and/or firm news of interest to our clients and colleagues. Readers or attendees should seek specific legal advice before taking any action with respect to matters mentioned in this publication or at this event. The attorney responsible for this communication is Brent E. Kidwell, Jenner & Block LLP, 353 N. Clark Street, Chicago, IL 60654-3456. Prior results do not guarantee a similar outcome. Jenner & Block London LLP, an affiliate of Jenner & Block LLP, is a limited liability partnership established under the laws of the State of Delaware, USA and is authorised and regulated by the Solicitors Regulation Authority with SRA number 615729. Information regarding the data we collect and the rights you have over your data can be found in our Privacy Notice. For further inquiries, please contact dataprotection@jenner.com.

News and Insights

Recognition

Jenner & Block Rises in American Lawyer Rankings for Summer Associate Experience

Jenner & Block ranked 14th nationally in The American Lawyer’s 2026 Summer Associate Satisfaction Survey, jumping 10 spots from last year. The annual survey measures summer associate satisfaction at US law firms based on ratings provided directly by summer associates across key firm qualities.

October 2, 2026

Publications

Partner Ashley Callen Discusses Potential Congressional Investigations in Reuters

Partner Ashley Callen was quoted in a Reuters article examining how Democrats could ramp up congressional investigations into Trump family business dealings if they win control of the House or Senate in the 2026 midterm elections this November.

September 30, 2026

Publications

Jenner & Block Marks Equal Time’s 25th Anniversary of Celebrating Community 

Jenner & Block released the 25th edition of Equal Time, the firm’s annual inclusion and engagement report centered on “Celebrating Community.”

September 23, 2026