USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
5.2 Government Notifications and Approvals The United States generally does not require govern - mental registrations, filings or approvals for routine cross‑border transfers of personal data or commercial business data. Federal law imposes no overarching data‑export authorisation regime, and state privacy laws (such as the CPRA and VCDPA) require only contractual safeguards – not government permission. Likewise, sector‑specific privacy laws (HIPAA, GLBA, FERPA) may restrict disclosure but do not impose approval requirements for international transfers. As a result, typical business and personal‑data transfers from the US may proceed without filing. However, three regulatory regimes – EAR, ITAR, and OFAC – do require licences for exports of certain technology, technical data and software. The Export Administration Regulations (EAR) regulate con - trolled software and technology and cover electronic, cloud‑based and deemed exports, with licensing dependent on ECCN classification, country destina - tion, end‑user and end‑use. The International Traffic in Arms Regulations (ITAR) require prior authorisation for all exports of defence articles and technical data on the US Munitions List, including deemed exports, and mandate registration with DDTC. The OFAC sanctions regime restricts transfers to sanctioned countries, entities and individuals, with licences required unless a general licence applies. Before any cross‑border transfer of data or technology, organisations should classify the item, screen the destination and recipi - ent, assess end‑use and determine whether a licence or exception applies; non‑controlled business or per - sonal data may be transferred without government involvement. 5.3 Data Localisation Requirements Data Localisation The United States has no general requirement that data be stored domestically. Most companies may store data abroad or use foreign cloud providers with - out seeking government approval. Exceptions primar - ily arise in government and defence contexts: federal contractors subject to FedRAMP or DFARS/CMMC often must store data on US servers and limit access to US persons, and ITAR-controlled defence techni - cal data cannot be stored overseas or accessed by
evaluating security risks, foreign government access risks and potential data subject impacts before trans - ferring, plus perform vendor due diligence assessing international service provider security controls and compliance capabilities. Contractual agreements must include flow-down provisions ensuring sub-pro - cessors receive identical protections. Exceptions exist for consent from individuals (though requirements vary by jurisdiction), necessity for legal proceedings or defending legal rights, law enforcement and national security purposes, and specific business carve-outs in the DOJ Bulk Data Rule. Cross-Border Transfer Compliance Checklist • Identify applicable frameworks – determine which federal sectoral laws (HIPAA, GLBA), export con - trols (ITAR), national security restrictions (CFIUS, DOJ Bulk Data Rule) and state privacy laws apply to transfers. • Define the transfer – document whether data is being physically moved internationally, allowing remote access from abroad, using foreign hosting, or granting access to foreign personnel. • Conduct risk assessments – evaluate security risks, foreign government access risks and data subject impacts before making cross-border trans - fers. • Perform vendor due diligence – assess internation - al service provider security controls, establish audit rights and verify compliance capabilities. • Implement contractual safeguards – execute writ - ten agreements with foreign processors contain - ing confidentiality provisions, purpose limitations, onward transfer restrictions and security require - ments. • Establish onward transfer controls – include flow- down provisions requiring foreign sub-processors to maintain equivalent protections and notification before engaging new international sub-processors. • Document legal basis – identify applicable excep - tions (consent, legal necessity, law enforcement or business carve-outs) and maintain supporting records. • Maintain compliance records – keep documenta - tion of risk assessments, international contracts, consent mechanisms and transfer authorisations for regulatory inquiries.
557 CHAMBERS.COM
Powered by FlippingBook