U.S. Data Localization Law Coming Soon: What Life Science Companies Need to Know

The DOJ has finalized a set of prohibitions and restrictions on cross-border transfers of certain U.S. data to China and other “Countries of Concern” (for now, Cuba, Iran, North Korea, Russia, and Venezuela), as well as to certain persons associated with those countries (so-called “Covered Persons”).

The rule creates an expansive new regulatory regime that prohibits or restricts certain transactions involving bulk U.S. sensitive personal data and U.S. government-related data.

Life science companies should take note – biometric identifiers, human ‘omic data and personal health data are all defined as sensitive personal data that could be subject to the prohibitions and restrictions. The rule defines these terms and sets thresholds at which sensitive data types are considered “bulk.”

Brief Summary of the Rule: When the rule takes effect on April 8, 2025, it will prohibit certain data brokerage transactions with Countries of Concern or Covered Persons. It also will prohibit other transactions that provide a Country of Concern or Covered Person with access to bulk human ‘omic data or human biospecimens from which that data can be derived. Additionally, it will:

• Prohibit such data brokerage transactions with any foreign person without a contractual prohibition against making the data available to a Country of Concern or Covered Person.
• Restrict (instead of prohibits) certain vendor, employment and investor agreements with Countries of Concern or Covered Persons involving access to bulk U.S. sensitive personal data and U.S. government-related data. These types of agreements must meet CISA security requirements.
• Require companies engaging in restricted transactions to develop and implement risk-based compliance programs modeled on guidance issued by OFAC. This requirement takes effect October 6, 2025.

Important Exceptions for Life Science Companies:  The rule contains two key exemptions for life science companies to help ensure that sensitive data transfer limitations do not impede therapeutic innovation. The rule:

• Permits life science companies to rely on U.S.-generated data that is “reasonably necessary” to support a regulatory marketing submission in a Country of Concern. That recognizes the importance of allowing pharma, biologic and medical device companies to transfer data for clinical research or marketing authorization support (i.e., regulatory approval data).
• Allows the transfer of sensitive clinical data that is “ordinarily incident” to, and part of, the collection or processing of clinical care data indicating real-world performance or product safety. This exemption also covers the collection or processing of post-marketing surveillance data, including pharmacovigilance and post-marketing studies for already approved therapies. Importantly, though, the clinical data must be de-identified or pseudonymized pursuant to applicable FDA regulations to be exempt.

Our Life Sciences & HealthTech team can help life science companies understand how to navigate these various important exemptions and stay compliant with DOJ and FDA recordkeeping and de-identification requirements. If you have questions please reach out to the authors (Thora Johnson, Georgia Ravitz, or Cosmas Robless).