Tracker record · Federal · Statute
CFIUS review of sensitive-personal-data transactions
The Committee on Foreign Investment in the United States reviews transactions for national security risk under section 721 of the Defense Production Act (50 U.S.C. 4565), as amended by FIRRMA, with regulations at 31 CFR Part 800. Jurisdiction covers transactions that could result in foreign control of a U.S. business and certain noncontrolling investments in a 'TID U.S. business' (31 CFR 800.248): a U.S. business that (a) produces, designs, tests, manufactures, fabricates, or develops critical technologies, (b) performs covered critical-infrastructure functions (Appendix A to Part 800), or (c) maintains or collects, directly or indirectly, sensitive personal data of U.S. citizens. 'Sensitive personal data' (31 CFR 800.241) means identifiable data in specified categories, including financial, geolocation, and health data, maintained or collected by a U.S. business that targets or tailors products or services to U.S. national-security agencies or their personnel and contractors, or that has collected or maintained such data on more than one million individuals within twelve months, or has a demonstrated business objective to do so as an integrated part of its primary products or services. Covered noncontrolling investments include those affording a foreign person access to material nonpublic technical information, board or observer rights, or involvement in substantive decision-making regarding the TID functions. Filing is generally by voluntary notice; mandatory declarations apply to certain critical-technology transactions subject to U.S. export controls and transactions involving substantial foreign-government interest (31 CFR 800.401).
Status
- Legal status
- In effect; covers certain noncontrolling investments in TID U.S. businesses, including those holding sensitive personal data
- Allegation or finding
- Operative law
- Applicability
- Foreign persons acquiring control of a U.S. business or making covered noncontrolling investments in a TID U.S. business, including data-holding businesses meeting the 31 CFR 800.241 sensitive-personal-data trigger
- Enforceability
- Binding on parties within scope
- Law checked through
- October 12, 2026
- Citation
- Defense Production Act ยง721, 50 U.S.C. 4565; FIRRMA (2018); regulations at 31 C.F.R. chapter VIII
- Source
- 50 U.S.C. 4565; 31 C.F.R. chapter VIII
Related guides
- Foreign Access: the DOJ Data Program, PADFAA, and CFIUS
- Data Licenses, Transactions, and Data as an Asset