USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
5. International Considerations 5.1 Restrictions on International Data Transfers
4.4 Data Protection in M&A Given the absence of comprehensive US data pri - vacy requirements, M&A deals require deal-by-deal determinations of applicable data privacy obligations across the transaction lifecycle. Due Diligence Buyers should conduct privacy-focused due diligence to assess the target’s compliance with applicable state and federal privacy laws, evaluate existing pri - vacy policies and practices, review data processing agreements with third parties, and identify potential Asset purchase agreements and equity purchase agreements typically include standard representations and warranties stating that the seller is in compliance with all applicable privacy laws. The onus is on the parties to determine which laws apply to the particular transaction. Change-of-Control Notifications Notification requirements for changes of control depend on: liabilities or ongoing investigations. Representations and Warranties • contractual obligations – many data processing agreements and vendor contracts require notice to customers or data subjects before a change of ownership; • state privacy laws – some state laws (such as the CCPA) may require updated privacy notices if data practices will materially change post-transaction; and • sector-specific laws – certain regulated industries (such as healthcare under HIPAA) have specific change-of-control notification requirements. Post-Closing Integration Post-closing obligations are determined on a deal- by-deal basis, focusing on which privacy laws apply (state or federal) and what actions the buyer must take under those laws, including updating privacy policies, integrating data governance programmes, harmonis - ing consent mechanisms, and ensuring ongoing com - pliance with all representations and warranties made during the transaction.
The United States regulates cross-border data trans - fers through a fragmented framework of federal secto - ral laws, export controls, national security restrictions and state privacy laws rather than a single comprehen - sive statute. A “transfer” is defined broadly to include physical movement of data across borders, remote access from abroad, hosting data on foreign servers, disclosure to foreign affiliates or vendors, and granting administrative access to foreign personnel – mean - ing even allowing an overseas employee to access a US-based database constitutes a transfer. The regulatory landscape encompasses sector-specific federal laws like HIPAA (healthcare data) and GLBA (financial data), which require the same contractual safeguards for international service providers as for domestic ones. Export controls under ITAR prohibit transferring defence-related technical data abroad or to foreign persons within the US without licences. National security frameworks include CFIUS oversight of foreign investments involving sensitive US data and the DOJ Bulk Data Rule effective April 2025, which prohibits data brokers from transferring bulk sensitive personal data to countries of concern (China, Russia, Iran, North Korea, Cuba and Venezuela). State priva - cy laws in California, Virginia, Colorado, Connecticut, Utah and Texas impose contractual requirements on international processors regardless of data location. For lawful cross-border transfers, organisations must implement multiple compliance mechanisms depend - ing on applicable laws. Under HIPAA, covered entities must enter into Business Associate Agreements with international third parties handling protected health information, requiring contractual safeguards and application of the “minimum necessary” standard limiting cross-border access. GLBA requires financial institutions to provide privacy notices and opt-out rights before disclosing non-public personal informa - tion internationally. State comprehensive privacy laws require written agreements with international proces - sors containing confidentiality obligations, purpose limitations, restrictions on onward transfers without authorisation and compliance assistance require - ments. Organisations must conduct risk assessments
556 CHAMBERS.COM
Powered by FlippingBook