Has China-U.S. “Data Decoupling” Arrived? How Chinese Data-Driven Companies Expanding into the U.S. Should Respond to the DOJ’s Data Security Program

By Vancci Wan (June 18, 2026)

INTRODUCTION:

As AI develops rapidly, data compliance is appearing more and more often in the U.S. market-entry agenda of Chinese companies. Recently, many Chinese technology companies have repeatedly asked us the same question: does the U.S. Department of Justice’s (DOJ) Data Security Program (DSP) apply to us? Should we start compliance work now? The fact that more companies are asking this question shows that a critical point has arrived: the DSP took effect on April 8, 2025, and the 90-day civil enforcement non-prioritization period ended on July 8, 2025; affirmative compliance obligations, including due diligence, audits, recordkeeping, and certain reporting obligations, have also been fully effective since October 6, 2025.

More realistically, if your U.S. customers, investors, auditors, counterparties, or even regulators now ask you - who has access to U.S. user data? Can the China headquarters, Hong Kong team, China-based R&D team, customer service team, operations and maintenance team, cloud service providers, or advertising SDKs access it? Have you conducted data mapping? Can you produce access-permission lists, vendor lists, contractual terms, and audit records? If the answer is no, the DSP risk is not merely that “compliance has not yet been completed.” It may become an obstacle in commercial cooperation, a red flag in financing or M&A due diligence, a risk factor in public company disclosure, and, in extreme cases, the starting point for regulatory enforcement and individual liability.

A company with a Chinese background has built a thriving U.S. business. Yet it may not realize that several perfectly normal operations have already fallen under the regulation of the DSP: accepting a round of financing from a Chinese-funded fund, allowing a China-based team to remotely access U.S. user data, engaging a cloud service provider in China or Hong Kong, or integrating advertising SDKs and data analytics tools into its app. The question is not only whether the data has crossed a border, but also who can access the data.

Although it regulates data, this is not a privacy law. The DSP has been placed within a national security and export-control-like framework: it does not focus on whether users clicked “consent,” but instead treats certain data as “data subject to export-control-like restrictions” and focuses more on whether countries of concern, such as China, or covered persons may have access to such data through covered data transactions. For Chinese companies expanding into the U.S. market, this may be one of the most underestimated U.S. rules in recent years, yet one that is capable of changing data architectures and commercial cooperation models.

THIS ARTICLE DISCUSSES:

• What is the DSP? Why should Chinese companies expanding to the U.S., especially data-driven companies, take it seriously?

• In practice, which compliance points are often misjudged?

• If your company is in data-driven industries such as life sciences, autonomous driving, AI/cloud, or gaming, what should you pay attention to?

• At a stage when enforcement has not yet been rolled out on a large scale, how should companies make use of the compliance window?

EXECUTIVE SUMMARY

Ø  What is the DSP? The United States has brought the risk of “countries of concern such as China, or covered persons, accessing bulk U.S. sensitive personal data or government-related data through covered data transactions involving data brokerage, vendor agreements, employment agreements, and investment agreements” into an export-control-like national security framework, and prohibits or restricts the relevant covered data transactions.

Ø  Why does the DSP matter? The per-violation civil penalty may appear limited (approximately USD 368,000, or twice the value of the transaction at issue, whichever is greater), but the greater risk lies in the chain reaction it may trigger, including privacy class actions, consumer protection matters, securities disclosure issues, M&A/financing due diligence issues, and customer contract breaches.

Ø  Individual risk for executives. The “knowingly directing” provision and IEEPA criminal provisions (up to 20 years’ imprisonment for natural persons) expose individuals who willfully evade, conspire, or knowingly proceed with violative transactions to substantial risk; meanwhile, certain restricted transactions also involve executive certifications, audits, and recordkeeping requirements, so compliance responsibility is not merely a matter for the legal department.

Ø  Obligated parties and boundaries. The directly regulated party is usually your U.S. subsidiary, U.S. customer, or other U.S. persons; the Chinese parent company, Hong Kong team, China-based R&D team, and investors may be analyzed as the “access side” involving a country of concern or covered person. Many business scenarios and data types fall near the edges of the DSP’s regulatory scope, and their characterization requires professional judgment.

Ø  Enforcement window. Public sources do not yet show large-scale DSP-specific enforcement cases, but that does not mean companies can wait and see. Resources and priorities may affect the pace of enforcement, but enforcement will eventually arrive.

---

I. WHAT KIND OF RULE IS THIS?

In essence, the DSP is not a privacy law, but a national security-oriented data access control regime: under four categories of covered data transactions (data brokerage, vendor agreements, employment agreements, and investment agreements), it prohibits or restricts U.S. persons from allowing countries of concern such as China, or covered persons, to access “bulk U.S. sensitive personal data” or “government-related data.”

1.  A Matter of National Security, Not Personal Privacy.

In February 2024, the Biden Administration signed Executive Order 14117, recognizing that foreign adversaries may obtain large volumes of Americans’ sensitive data through commercial channels and use such data for surveillance, coercion, targeting government and military-related personnel, and developing AI, among other purposes, which constitutes a national security-level threat. The DOJ’s National Security Division subsequently issued the final rule and codified it in 28 CFR Part 202 (i.e., the DSP). Notably, after Trump took office, he did not revoke the executive order, and the rule had already been issued before the change in administration and therefore remained in place. The direction of this rule is bipartisan, and it is unlikely to loosen in the short term.

Precisely because its starting point is national security rather than personal privacy, it differs at a fundamental level from the privacy laws with which companies are familiar. Privacy laws typically focus on notice, consent, individual rights, and controller/processor obligations, while the DSP focuses on whether data may fall into the hands of countries of concern and be used to harm U.S. national security. As a result, risk mitigation measures commonly used under privacy laws, such as user consent, anonymization, and de-identification, do not automatically constitute exemptions under the DSP; they are more properly understood as part of security controls or factual analysis, rather than a safe harbor outside the rule.

This is not a privacy law, but a national security rule - once this point is understood, many of the DSP’s seemingly counterintuitive designs become easier to understand.

II. THE CONSEQUENCES: THE PENALTY MAY NOT LOOK HIGH, BUT THE RISK CAN BE MAGNIFIED

Before discussing how to make the relevant judgments, it is worth first asking why the DSP matters. The greater and potential force of the DSP does not lie in the per-violation penalty figure itself, but in the way it may interact with other legal risks and place responsibility on specific decision-makers.

1.  Its own penalties may be limited, but it may ignite other laws.

The maximum civil penalty for DSP violations is approximately USD 368,000 per violation (as adjusted annually for inflation under IEEPA), or twice the value of the transaction at issue, whichever is greater. Viewed in isolation, this figure is not striking. But once data compliance goes wrong, it is often not a matter of a single penalty. It may trigger a series of consequences.

If a company is challenged for failing to properly identify, restrict, or disclose access by China-related parties to U.S. sensitive data, it may subsequently face privacy class actions, consumer protection investigations, securities disclosure disputes, customer contract breaches, and M&A or financing due diligence red flags, among other chain reactions.

TikTok once settled a U.S. privacy class action for USD 92 million, and one of the plaintiffs’ allegations involved the unlawful collection and sharing of U.S. user data, including data access involving China-related parties. That case itself was not a DSP case, but it illustrates that once access by China-related parties to U.S. user data becomes a point of dispute, the risk can easily expand from a single regulatory issue into a combination of litigation, transaction, and reputational risks.

2.  The penalties do not fall only on the company; executives may also be exposed.

DSP liability can reach individuals. Its “knowingly directing” provision is aimed directly at persons with decision-making authority who approve or bring about relevant transactions or arrangements; IEEPA (the legal basis for the DSP) provides that a natural person who willfully violates the law may face up to 20 years’ imprisonment and/or a USD 1 million fine. This standard certainly will not apply to every ordinary compliance mistake, but in cases involving willful evasion, conspiracy, or knowingly continuing to proceed with a violative transaction, individual liability is not merely theoretical; it is substantive. For founders and executives, the DSP risk is not only a penalty on the company’s books, but may also fall on their own signatures, their own decisions, and the scope of their own knowledge.

III. FIVE ISSUES MOST EASILY MISJUDGED

These issues actually form a chain of analysis: first determine who you are (identity), then look at whether the most frequent activities (data transfers back to China and external provision of data) are regulated, and finally determine who bears responsibility. Put together, this chain is an executable self-check sequence.

1.  Who is regulated, and who is restricted?

Many Chinese companies’ first reaction is: “I am a Chinese company and a covered person, so does that mean I cannot do data business with the United States?” This understanding is partly right and partly wrong.

What is right is that a company headquartered in China is indeed a “covered person.” What is wrong is that this overlooks a critical identity switch: a subsidiary established in the United States by a Chinese company under U.S. law may itself be a “U.S. person.” In the world of the DSP, a U.S. person is not the party with whom dealings are prohibited, but rather the party that bears compliance obligations under the rule.

This distinction determines where compliance resources should be deployed. The real question has never been “can we do this business?” but rather: between the Chinese parent company and the U.S. subsidiary, and between the U.S. subsidiary and Chinese-funded shareholders or Chinese-national employees, is each data flow prohibited, restricted, or exempt? Only after clarifying this layer can a company know who should build the compliance program and which data chains should be monitored.

Another easily overlooked detail is that the form of structure can change identity. If a company has only established a branch in the United States, that branch will be treated as part of the parent company and remain a “foreign person”; a subsidiary, by contrast, is an independent “U.S. person.”

2.  Can intra-group transfers back to China be exempt?

Transferring data generated by U.S. operations back to a Chinese parent company or affiliate is one of the most frequent activities for Chinese companies expanding overseas. Two particularly common and dangerous misunderstandings are hidden here.

The first misunderstanding to dispel is: “It is all within the group, so it is not a transaction, right?” - No. The exemption is narrow, and R&D is expressly excluded.

The rule does contain a “corporate group transactions” exemption, which sounds like a green light for intra-group sharing. But it is narrow and covers only administrative or ancillary matters, such as human resources, payroll, reimbursements, and tax payments; it does not include R&D. This means that bringing U.S. user data back to China for product development or model training is likely to fall outside the exemption. In the rulemaking process, DOJ specifically rejected an “R&D and product improvement exemption” because taking data back for training and improvement is precisely one of the uses of data that concerns it most.

The second, and most impactful, misunderstanding is: “We encrypted the data, so we should be fine, right?” - Also no.

The rule states plainly that whether data is anonymized, pseudonymized, de-identified, or encrypted does not take it outside the regulatory scope if the data otherwise meets the applicable threshold. Why is it so strict? DOJ’s logic is that technologies such as encryption and de-identification are not effective in all circumstances and may sometimes be reversed or undermined, so it does not treat encryption as a route to exemption, but rather places it within the CISA security requirements that must be satisfied for restricted transactions. This is a critical shift in understanding: under the DSP, encryption is not a get-out-of-jail-free card that takes you outside the rule, but one of the pieces of equipment you must have in place when conducting a restricted transaction. Similarly, DOJ also rejected technical exemptions such as anonymization and aggregation.

One important reminder: do not deliberately restructure or repackage data flows in order to avoid the rule, as the rule contains anti-evasion provisions. Determining line by line which transfers back to China can proceed and which cannot is unavoidable work.

3.  Data brokerage is a type of transaction, not a type of company.

When people hear “data brokerage,” they may easily assume it refers to data brokers and has nothing to do with companies that build products or platforms. But in the world of the DSP, “data brokerage” refers to a type of transaction, not a type of company. Any commercial arrangement that “sells data to, or licenses access to data to, a recipient that did not directly collect that data itself” may constitute data brokerage. Data brokerage with a country of concern or covered person is a prohibited transaction (not a restricted transaction).

The mobile app and advertising scenarios are the easiest to trigger. DOJ specifically provided advertising-related examples in the rule: when selling advertising space in an app, the company also provides data such as location, IP addresses, and advertising identifiers; or it discloses such data for targeted advertising. If the other end of the recipient chain connects to a country of concern or covered person, then the daily operation of merely integrating an advertising SDK may be characterized as prohibited data brokerage. DOJ specifically provided examples relating to AI and advertising in the rule, which the industry widely reads as a signal of areas of focus.

4.  Due diligence rests with the company itself; companies cannot rely on a list.

Many companies are waiting for an official “Covered Persons List,” thinking that if they check the list and the counterparty is not on it, they can relax.

The rule does provide for a list mechanism, but the list is not the entirety of a company’s due diligence. More importantly, many covered persons arise automatically upon meeting the criteria and do not require DOJ to designate or name them one by one.

As a result, companies cannot rely on “checking the list” to absolve a transaction. The due diligence obligation has been on the company from day one. You must make your own judgment of counterparty status under the rule. The practical implication for companies is that, even if the counterparty is not on any list, as long as it is 50% or more owned by a country of concern or covered person, it is a covered person, and related data transactions with it are regulated.

5.  Executives may also bear personal liability.

The final link in the chain of analysis is where responsibility lands. In addition to the company’s own due diligence obligations, the DSP can also reach individual executives. The “knowingly directing” provision, IEEPA criminal liability, and executive certifications all create direct personal exposure. This means DSP compliance is not merely a matter for the legal department; it is also a matter for founders and management themselves.

IV. WHICH INDUSTRIES ARE MOST EXPOSED?

For the four industries below, the rule provides the hardest and most specific “data hooks.” If your company is in one of them, this section should be treated as the starting point for a self-check.

🧬 Life Sciences: Omics Data Is One of the Hardest Red Lines

Most protected data follows the logic of “regulated only when it reaches the bulk threshold, and restricted transactions may proceed.” Human 'omic data (genomic, epigenomic, proteomic, and transcriptomic data) and human biospecimens from which such data could be derived are exceptions: transactions with countries of concern or covered persons involving such data are, in principle, directly prohibited, rather than transactions that can proceed once the security requirements are satisfied. Moreover, the threshold is unusually low: human genomic data reaches the bulk threshold once it involves 100 U.S. persons.

Why is it so strict with this category alone? The legislative rationale is that these types of data have the strongest clinical and predictive capabilities and the closest relationship to the genome, and once acquired by countries of concern, they pose the greatest long-term risk. For companies involved in China-U.S. clinical work, genetic sequencing, CRO/CDMO services, pharmaceutical data cooperation, or biobanks, this means that many cross-border sample and data collaborations previously taken for granted may now directly cross a red line. The rule provides several exemptions for certain drug, biological product, and medical device authorizations, clinical investigations, and post-marketing surveillance, but each has strict conditions, and the boundaries must be checked case by case; they cannot be assumed.

The real question is not whether to build a compliance program, but whether certain cross-border collaborations have already stepped onto the red line. This is a question of whether to stop, not merely how to proceed.

🚗 Autonomous Driving: Geolocation Data Has a Very Low Threshold

Smart vehicles are naturally mobile data collectors. Fleet trajectories, high-definition maps, and user travel patterns may all involve precise geolocation data. The DSP sets a very low threshold for this type of data: data concerning 1,000 U.S. devices reaches the bulk threshold. More strictly, precise geolocation data for locations on the Government-Related Location Data List is government-related data regardless of volume.

This is a high-risk area for Chinese-funded automakers, autonomous driving companies, connected vehicle companies, and high-definition mapping companies. Road testing, fleet operation, and map collection in the United States will naturally generate large volumes of geolocation data; if that data is then transferred back to China for algorithm training, the company will hit both the “very low geolocation threshold” and the “R&D transfers back to China are not exempt” points.

Companies should promptly review which areas their fleets have passed through, whether those areas are near sensitive facilities, and whether the relevant trajectory data has been transferred back to China.

🤖 AI and Cloud: Training Data and Models

There are three layers of exposure for the AI industry.

First, training data: selling or licensing a dataset containing bulk U.S. sensitive personal data to a covered person for model training, or allowing a covered person to access such data to develop AI services, may fall within the scope of the DSP.

Second, model regurgitation: for example, if a U.S. company trains an AI chatbot using bulk U.S. sensitive personal data, and the chatbot can reproduce or disclose training data in response to specific prompts; and the company then licenses access to that chatbot to its Chinese parent company or another covered person, this may constitute prohibited data brokerage. Licensing the use of the model itself does not necessarily equal access to the underlying data. The key question is whether the model or algorithm can allow the covered person to actually obtain the underlying bulk U.S. sensitive personal data.

Third, using Chinese cloud or AI service providers to process U.S. user data may also constitute a restricted transaction if it involves a vendor agreement with a country of concern or covered person and access to government-related data or bulk U.S. sensitive personal data; it requires item-by-item analysis of vendor identity, access permissions, data type, and the CISA security requirements.

The risk lies not only in where the data is stored, but also in whether the data enters a model and whether the model may become a channel for accessing the underlying data. This is a blind spot that many AI teams have not yet brought into their compliance field of view.

🎮 Gaming: Massive User Data Combined with High-Frequency Transfers Back to China

The gaming industry is often overlooked, but it brings together many of the elements the DSP cares about: massive volumes of device data, advertising identifiers and account authentication data, player behavior and profiling, payment data generated by in-app purchases, geolocation data from location-based gameplay, and biometrics that may be involved in voice or AR features. Chinese-background gaming companies often have large user bases in the United States and high-frequency transfers of data back to China for operations and risk control, algorithmic recommendation, or advertising monetization; all of these arrangements require item-by-item analysis to determine whether they are restricted, prohibited, or exempt. In addition, mobile games commonly integrate advertising SDKs and monetization platforms, making the data brokerage issue discussed above particularly common in this industry.

The larger the user base, the easier it is to cross the bulk threshold without realizing it; the more frequent the transfers back to China, the more important it is to clarify data flows early.

Other Industries That Should Pay Attention

Mobile apps, social media, and advertising: these are high-risk areas for triggering data brokerage issues, and transfers of advertising SDK data, Ad IDs, location, and IP addresses are particularly prone to problems.

Smart home and IoT: devices collect geolocation data and may involve biometrics, and the thresholds are similarly low.

Fintech and payments: the threshold for personal financial data is 10,000 U.S. persons. Although there is a “financial services exemption,” it is determined by activity rather than institutional status. It is not the case that financial institutions are exempt as a whole; instead, companies must analyze item by item which transactions may be viewed as “ordinarily incident to and part of” financial services and therefore exempt.

V. RISKS AND RESPONSES

First, the current enforcement landscape.

•         The rule took effect on April 8, 2025, the 90-day period during which NSD stated it would not prioritize civil enforcement actions for good-faith compliance efforts ended on July 8, 2025, and the affirmative due diligence and audit requirements for restricted transactions, certain annual reporting obligations, and reports on rejected prohibited transactions became effective on October 6, 2025. As of this writing, we have not seen publicly disclosed DSP-specific enforcement cases against companies. But the absence of cases so far does not mean that “it is safe now.” First, investigations may look back to conduct after the effective date; second, the 10-year recordkeeping obligation is already running, and today’s omissions may be visible in future reviews; third, the rule’s “knowingly” standard and anti-evasion provisions give DOJ considerable room for retrospective accountability.

•         Why has enforcement not yet been rolled out on a large scale? One possible reason is that the DSP is still in the early stage of implementation of a new regime, and DOJ first needs to use FAQs, compliance guidance, licensing, and advisory opinion mechanisms to promote market understanding. In addition, enforcement resource pressures may affect the pace of enforcement. The Foreign Investment Review Section, the DOJ office internally responsible for DSP enforcement, has long been lightly staffed and does not have an independent litigation function; DOJ has also acknowledged enforcement resource constraints in its budget documents.

•         It is dangerous to treat slow enforcement as a reason to wait and see. Once enforcement resources become sufficient or a test case is needed, there will be no shortage of ready-made leads: customer questionnaires, vendor contracts, data mapping, advertising SDK chains, cloud service access logs, and financing and M&A due diligence materials. China-linked companies are often the most convenient targets.

The practical value of proactive compliance: the window remains, but it is not a grace period.

•         Precisely for this reason, proactive compliance now has significant practical value. It should first be clarified that the civil enforcement non-prioritization period from April to July 2025 has already ended, but proactive compliance may still affect whether the company had actual knowledge or reasonably should have known, whether there was an intent to evade, whether cooperation credit is available, and subsequent penalty discretion. The DSP uses a “knowingly” standard rather than strict liability. A company with a genuine compliance program, data mapping, and a remediation record will be in a very different position when assessing whether it reasonably should have known. In other words, at a time when enforcement has not yet been rolled out comprehensively, but retrospective accountability and the 10-year recordkeeping obligation are already in operation, taking action now can both close historical exposure and accumulate evidence of “good faith.”

In practical terms:

1.       Start with data mapping: identify cross-border data flows and determine which entity is the “U.S. person” bearing the obligation.

2.       Characterize each flow: for each data flow involving a country of concern or covered person, determine whether it is prohibited, restricted, or exempt.

3.       Equip restricted transactions with the necessary “gear”: implement the CISA security requirements (organizational-level, system-level, and data-level).

4.       Put records first: the 10-year recordkeeping obligation is already running, so start creating a record today.

5.       If uncertain, ask; where necessary, seek professional advice.

One final point for Chinese companies expanding into the U.S. market: the DSP is not ordinary privacy compliance, but a national security-level, export-control-like regime. To understand its “strangeness” and its “soul,” remember its starting point - it is a national security rule designed to prevent data from flowing to countries of concern. Therefore, any design that allows data to be “routed around,” remotely viewed, reproduced by a model, or retrieved within a corporate group must first be mapped clearly and then legally characterized.Treat data mapping as step zero; it always comes first.

---

Author: Vancci Wan, Esq., Partner

vancci.wan@silkenpath.com

Vancci is a seasoned attorney who specializes in data compliance and corporate transactions, with a particular focus on emerging and highly regulated sectors, including AI, frontier technologies, digital platforms, autonomous vehicles, biotechnology, and new energy.

Vancci is licensed in the state of New York and holds the PRC Legal Professional Qualification.

---

This article is general legal information and does not constitute legal advice for any specific circumstances. The DSP and related guidance and enforcement remain evolving; please refer to current official releases. For specific matters, professional legal counsel is recommended.