New Rules for Data Flows Take Effect: What You Need to Know

On April 8, 2025, the US Department of Justice’s National Security Division’s final rule regulating sensitive data about US persons came into effect. DOJ also announced a 90-day grace period on enforcement. At a moment of heightened geopolitical competition, the rule was designed to prevent foreign adversaries from exploiting data that could be used to enhance artificial intelligence capabilities, augment intelligence collection and foreign espionage, or enable malicious cyberattacks and malign foreign influence operations.

Broadly speaking, the rule regulates two kinds of transactions involving US government data and Americans’ bulk sensitive personal data. First, transactions involving “data brokerage,” broadly defined as the sale or licensing of access to data, are subject to strict prohibitions: US persons may not knowingly engage in such a transaction with a country of concern (China, along with Hong Kong and Macau; Cuba; Iran; North Korea; Russia; or Venezuela) or with a covered person (certain foreign companies and foreign individuals located in a country of concern). Second, vendor, employment, and investment agreements with covered persons are prohibited unless the US person complies with a robust set of data security requirements.

Because the rule targets specific kinds of transactions rather than a particular industry, it will affect US firms broadly, not just “data brokers.” The new framework is complex: DOJ released several resources, including a compliance guide, an implementation and enforcement policy, and a list of more than 100 frequently asked questions to assist companies with implementation. Many companies will benefit from the guidance of outside counsel, who can help implement a tailored compliance effort, including specific due diligence, audit, and record-keeping requirements. Firms should proactively assess their regulatory obligations and engage in good-faith compliance efforts, including by conducting internal data access reviews, adjusting employee locations or responsibilities, and/or implementing relevant security requirements.

This article is available in the Jenner & Block Japan Newsletter. / この記事はJenner & Blockニュースレターに掲載されています。

© 2026 Jenner & Block LLP. Attorney Advertising. Jenner & Block LLP is an Illinois Limited Liability Partnership including professional corporations. This publication, presentation, or event is not intended to provide legal advice but to provide information on legal matters and/or firm news of interest to our clients and colleagues. Readers or attendees should seek specific legal advice before taking any action with respect to matters mentioned in this publication or at this event. The attorney responsible for this communication is Brent E. Kidwell, Jenner & Block LLP, 353 N. Clark Street, Chicago, IL 60654-3456. Prior results do not guarantee a similar outcome. Jenner & Block London LLP, an affiliate of Jenner & Block LLP, is a limited liability partnership established under the laws of the State of Delaware, USA and is authorised and regulated by the Solicitors Regulation Authority with SRA number 615729. Information regarding the data we collect and the rights you have over your data can be found in our Privacy Notice. For further inquiries, please contact dataprotection@jenner.com.

New Rules for Data Flows Take Effect: What You Need to Know

On April 8, 2025, the US Department of Justice’s National Security Division’s final rule regulating sensitive data about US persons came into effect. DOJ also announced a 90-day grace period on enforcement. At a moment of heightened geopolitical competition, the rule was designed to prevent foreign adversaries from exploiting data that could be used to enhance artificial intelligence capabilities, augment intelligence collection and foreign espionage, or enable malicious cyberattacks and malign foreign influence operations.

Broadly speaking, the rule regulates two kinds of transactions involving US government data and Americans’ bulk sensitive personal data. First, transactions involving “data brokerage,” broadly defined as the sale or licensing of access to data, are subject to strict prohibitions: US persons may not knowingly engage in such a transaction with a country of concern (China, along with Hong Kong and Macau; Cuba; Iran; North Korea; Russia; or Venezuela) or with a covered person (certain foreign companies and foreign individuals located in a country of concern). Second, vendor, employment, and investment agreements with covered persons are prohibited unless the US person complies with a robust set of data security requirements.

Because the rule targets specific kinds of transactions rather than a particular industry, it will affect US firms broadly, not just “data brokers.” The new framework is complex: DOJ released several resources, including a compliance guide, an implementation and enforcement policy, and a list of more than 100 frequently asked questions to assist companies with implementation. Many companies will benefit from the guidance of outside counsel, who can help implement a tailored compliance effort, including specific due diligence, audit, and record-keeping requirements. Firms should proactively assess their regulatory obligations and engage in good-faith compliance efforts, including by conducting internal data access reviews, adjusting employee locations or responsibilities, and/or implementing relevant security requirements.

This article is available in the Jenner & Block Japan Newsletter. / この記事はJenner & Blockニュースレターに掲載されています。

© 2026 Jenner & Block LLP. Attorney Advertising. Jenner & Block LLP is an Illinois Limited Liability Partnership including professional corporations. This publication, presentation, or event is not intended to provide legal advice but to provide information on legal matters and/or firm news of interest to our clients and colleagues. Readers or attendees should seek specific legal advice before taking any action with respect to matters mentioned in this publication or at this event. The attorney responsible for this communication is Brent E. Kidwell, Jenner & Block LLP, 353 N. Clark Street, Chicago, IL 60654-3456. Prior results do not guarantee a similar outcome. Jenner & Block London LLP, an affiliate of Jenner & Block LLP, is a limited liability partnership established under the laws of the State of Delaware, USA and is authorised and regulated by the Solicitors Regulation Authority with SRA number 615729. Information regarding the data we collect and the rights you have over your data can be found in our Privacy Notice. For further inquiries, please contact dataprotection@jenner.com.

News and Insights

Amanda Shafer Berman to Speak on Energy and Administrative Law at WEN-DC Webinar

As the Supreme Court's new Term begins, Jenner & Block Partner Amanda Shafer Berman will join a Women's Energy Network of Washington, DC (WEN-DC) webinar on how the Court's decisions are shaping the energy sector.

October 14, 2026

Publications

Partner Amanda Shafer Berman Quoted in Bloomberg Law on Senate Permitting Overhaul Bill

Partner Amanda Shafer Berman was quoted in an October 5 Bloomberg Law article, "Permitting Deal Gives Projects Defense Against Litigation Delays," on the Senate's new permitting overhaul package and its expected impact on litigation over federal permitting reversals.

October 2026

Event

Partner John Storino to Speak at Sandpiper Partners' “AI and Outside Counsel Guidelines Roundtable”

On October 8, Partner John Storino will serve as a panelist at the “AI and Outside Counsel Guidelines Roundtable,” hosted by Sandpiper Partners in Chicago.

October 8, 2026

Event

Partner Meghan Greenfield to Speak on Supreme Court Climate Case at Edison Electric Institute's Fall Legal Conference

On Wednesday, October 7, Partner Meghan Greenfield will speak on a panel titled "Boulder County v. Suncor Energy: What the Supreme Court's Climate Case Means for the Energy Industry" at the Edison Electric Institute's Fall Legal Conference in Salt Lake City, Utah.

October 7, 2026

Publications

The Form Rules Everything: A Seventh Circuit Ruling on ERISA's Substantial Compliance Doctrine

Partner Joseph Torres and Special Counsel Jennifer Beach authored an article for Employee Relations Law Journal examining the Seventh Circuit's decision in Packaging Corp. of America Thrift Plan for Hourly Employees v. Langdon, a ruling that addresses both the standard of review in ERISA interpleader actions and the continued viability of the substantial compliance doctrine for changing plan beneficiaries.

October 5, 2026

Recognition

Jenner & Block Rises in American Lawyer Rankings for Summer Associate Experience

Jenner & Block ranked 14th nationally in The American Lawyer’s 2026 Summer Associate Satisfaction Survey, jumping 10 spots from last year. The annual survey measures summer associate satisfaction at US law firms based on ratings provided directly by summer associates across key firm qualities.

October 2, 2026

Publications

Partner Ashley Callen Discusses Potential Congressional Investigations in Reuters

Partner Ashley Callen was quoted in a Reuters article examining how Democrats could ramp up congressional investigations into Trump family business dealings if they win control of the House or Senate in the 2026 midterm elections this November.

September 30, 2026

Event

Associate Steven Arango Addresses North Korean IT Worker Threat in Talks to Business Executives for National Security Members in Texas

On September 29 and 30, Associate Steven Arango led luncheon discussions titled "North Korea's IT Worker Threat: Corporate Risk and Response" for Business Executives for National Security (BENS) members in Dallas and Austin, Texas, speaking to an audience of CEOs, CISOs, and other senior leaders from the national security, finance, and healthcare sectors.

September 2026