Reviews a data company sale can trigger
5 US and UK reviews a sale of a data company can trigger, read 28 October 2026.
Where it applies
What brings a deal under it
Whether a filing is required
The rule, in its words
Every answer from every review
Every row is a single review, and every answer expands to the wording it was taken from, the statute or regulator page it came from and when it was read. "Not stated" is used when the statute or regulator page says nothing on the point.
| Review | Where it applies | What brings a deal under it | Whether a filing is required | The rule, in its words |
|---|---|---|---|---|
| CFIUS: sensitive personal data, 31 CFR 800.241 | United States | sensitive personal data held by the business | not statedNot addressed in Code of Federal Regulations via LII | (a) The term sensitive personal data means, except as provided in paragraph (b) of this… |
| CFIUS: TID US business, 31 CFR 800.248 | United States | sensitive personal data held by the business | not statedNot addressed in Code of Federal Regulations via LII | Corporation A, a U.S. business, is a credit reporting agency and maintains consumer… |
| DOJ Data Security Program, 28 CFR Part 202 | United States | access to bulk sensitive data by a country of concern | the transaction is prohibited or restricted | The term data brokerage means the sale of data, licensing of access to data, or similar… |
| UK merger control, Enterprise Act 2002 section 23 | United Kingdom | turnover or share of supply | not statedNot addressed in Enterprise Act 2002 on legislation.gov.uk | For the purposes of this Part, a relevant merger situation has been created if |
| UK National Security and Investment Act: data infrastructure | United Kingdom | the business's sector | mandatory before closing | Data infrastructure is physical or virtualised infrastructure used for storing… |
Where each answer was read (20)
- CFIUS: sensitive personal data, 31 CFR 800.241, Code of Federal Regulations via LII, read 2026-10-28, Where it applies:
PART 800—REGULATIONS PERTAINING TO CERTAIN INVESTMENTS IN THE UNITED STATES BY FOREIGN PERSONS
- CFIUS: sensitive personal data, 31 CFR 800.241, Code of Federal Regulations via LII, read 2026-10-28, What brings a deal under it:
Has maintained or collected any identifiable data within one or more categories described in paragraph (a)(1)(ii) of this section on greater than one million individuals
- CFIUS: sensitive personal data, 31 CFR 800.241, Code of Federal Regulations via LII, read 2026-10-28, Whether a filing is required: Left open by the statute or regulator page (9,286 characters, read in full 2026-10-28).
- CFIUS: sensitive personal data, 31 CFR 800.241, Code of Federal Regulations via LII, read 2026-10-28, The rule, in its words:
(a) The term sensitive personal data means, except as provided in paragraph (b) of this section:
- CFIUS: TID US business, 31 CFR 800.248, Code of Federal Regulations via LII, read 2026-10-28, Where it applies:
The term TID U.S. business means any U.S. business that:
- CFIUS: TID US business, 31 CFR 800.248, Code of Federal Regulations via LII, read 2026-10-28, What brings a deal under it:
Maintains or collects, directly or indirectly, sensitive personal data of U.S. citizens.
- CFIUS: TID US business, 31 CFR 800.248, Code of Federal Regulations via LII, read 2026-10-28, Whether a filing is required: Left open by the statute or regulator page (9,176 characters, read in full 2026-10-28).
- CFIUS: TID US business, 31 CFR 800.248, Code of Federal Regulations via LII, read 2026-10-28, The rule, in its words:
Corporation A, a U.S. business, is a credit reporting agency and maintains consumer reports meeting the description under § 800.241(a)(1)(ii)(B) on greater than one million individuals, including U.S. citizens. Corporation A maintains sensitive personal data and is therefore a TID U.S. business.
- DOJ Data Security Program, 28 CFR Part 202, Electronic Code of Federal Regulations, read 2026-10-28, Where it applies:
ACCESS TO U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS
- DOJ Data Security Program, 28 CFR Part 202, Electronic Code of Federal Regulations, read 2026-10-28, What brings a deal under it:
Covered personal identifiers collected about or maintained on more than 100,000 U.S. persons; or
- DOJ Data Security Program, 28 CFR Part 202, Electronic Code of Federal Regulations, read 2026-10-28, Whether a filing is required:
no U.S. person, on or after the effective date, may knowingly engage in a covered data transaction involving data brokerage with a country of concern or covered person
- DOJ Data Security Program, 28 CFR Part 202, Electronic Code of Federal Regulations, read 2026-10-28, The rule, in its words:
The term data brokerage means the sale of data, licensing of access to data, or similar commercial transactions, excluding an employment agreement, investment agreement, or a vendor agreement
- UK merger control, Enterprise Act 2002 section 23, Enterprise Act 2002 on legislation.gov.uk, read 2026-10-28, Where it applies:
the value of the turnover in the United Kingdom of the enterprise being taken over exceeds
- UK merger control, Enterprise Act 2002 section 23, Enterprise Act 2002 on legislation.gov.uk, read 2026-10-28, What brings a deal under it:
the value of the turnover in the United Kingdom of the enterprise being taken over exceeds
- UK merger control, Enterprise Act 2002 section 23, Enterprise Act 2002 on legislation.gov.uk, read 2026-10-28, Whether a filing is required: Left open by the statute or regulator page (14,889 characters, read in full 2026-10-28).
- UK merger control, Enterprise Act 2002 section 23, Enterprise Act 2002 on legislation.gov.uk, read 2026-10-28, The rule, in its words:
For the purposes of this Part, a relevant merger situation has been created if
- UK National Security and Investment Act: data infrastructure, GOV.UK guidance on notifiable acquisitions, read 2026-10-28, Where it applies:
you are legally required to tell the government about acquisitions of certain entities in 17 sensitive areas of the economy
- UK National Security and Investment Act: data infrastructure, GOV.UK guidance on notifiable acquisitions, read 2026-10-28, What brings a deal under it:
Data infrastructure is physical or virtualised infrastructure used for storing, processing or transmitting data in digital form
- UK National Security and Investment Act: data infrastructure, GOV.UK guidance on notifiable acquisitions, read 2026-10-28, Whether a filing is required:
you may be legally required to tell the government about it (known as a ‘mandatory notification’)
- UK National Security and Investment Act: data infrastructure, GOV.UK guidance on notifiable acquisitions, read 2026-10-28, The rule, in its words:
Data infrastructure is physical or virtualised infrastructure used for storing, processing or transmitting data in digital form or infrastructure that is provided for peering, interconnection or exchange of digital data
Documents we read but did not count
2 named documents were read but are not the kind of document this board answers from; see why below. They are counted and never answered.
- DOJ National Security Division: Data Security: the DOJ's own page for the Data Security Program, whose rule is recorded from 28 CFR Part 202 (source 4)
- NSI Act (Notifiable Acquisition) Regulations 2021: schedule 8 of the regulations covers cryptographic authentication, not data infrastructure
How the figures are worked out
Each review's own US and UK statutes, regulations and agency pages were read through estate-fetch and stored whole (sha256 on every row).
For every statute or regulator page, four questions were answered from its own words: where it applies, what brings a deal under it, whether a filing is required, the rule, in its words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or regulator page read does not address the question.
A review with several statute and regulator pages reads 'varies' where they disagree.
5 reviews, 5 statute and regulator pages.
Not read yet, so not counted: 1 named document.
All 8 sources
- FTC: HSR current thresholds (not yet read)
- 31 CFR 800.241 sensitive personal data (CFIUS) (quoted for comment from the publisher's own US and UK statutes, regulations and agency pages)
- 31 CFR 800.248 TID US business (CFIUS) (quoted for comment from the publisher's own US and UK statutes, regulations and agency pages)
- 28 CFR Part 202 (DOJ Data Security Program) (quoted for comment from the publisher's own US and UK statutes, regulations and agency pages)
- DOJ National Security Division: Data Security (read, set aside)
- NSI Act: the 17 types of notifiable acquisitions (quoted for comment from the publisher's own US and UK statutes, regulations and agency pages)
- NSI Act (Notifiable Acquisition) Regulations 2021 (read, set aside)
- Enterprise Act 2002 section 23 (quoted for comment from the publisher's own US and UK statutes, regulations and agency pages)
Take this figure with you
5 US and UK reviews a sale of a data company can trigger, read 28 October 2026.
Where it applies, by review: United States 3 of 5, United Kingdom 2 of 5 (5 reviews, read 28 October 2026).
What brings a deal under it, by review: sensitive personal data held by the business 2 of 5, access to bulk sensitive data by a country of concern 1 of 5, the business's sector 1 of 5, turnover or share of supply 1 of 5 (5 reviews, read 28 October 2026).
Whether a filing is required, by review: not stated 3 of 5, mandatory before closing 1 of 5, the transaction is prohibited or restricted 1 of 5 (5 reviews, read 28 October 2026).
The rule, in its words, by review: stated 5 of 5 (5 reviews, read 28 October 2026).
Reference: "Reviews a data company sale can trigger", updated 2026-10-28, https://sellmydatacompany.com/datasets/data-company-sale-review-law/.
CSV download (20 answers as of 2026-10-28)