# Reviews a data company sale can trigger

> 5 US and UK reviews a sale of a data company can trigger, read 28 October 2026.

Sell My Data Company · https://sellmydatacompany.com/datasets/data-company-sale-review-law/ · computed 2026-10-28

**Reviews on the register:** 5 reviews (5 statute and regulator pages read; 8 named).

## The answers, question by question

- **Where it applies:** United States 3, United Kingdom 2
- **What brings a deal under it:** sensitive personal data held by the business 2, access to bulk sensitive data by a country of concern 1, turnover or share of supply 1, the business's sector 1
- **Whether a filing is required:** not stated 3, the transaction is prohibited or restricted 1, mandatory before closing 1
- **The rule, in its words:** stated 5

## Every review

| Review | Where it applies | What brings a deal under it | Whether a filing is required | The rule, in its words |
|---|---|---|---|---|
| CFIUS: sensitive personal data, 31 CFR 800.241 | United States | sensitive personal data held by the business | not stated | (a) The term sensitive personal data means, except as provided in paragraph (b) of this… |
| CFIUS: TID US business, 31 CFR 800.248 | United States | sensitive personal data held by the business | not stated | Corporation A, a U.S. business, is a credit reporting agency and maintains consumer… |
| DOJ Data Security Program, 28 CFR Part 202 | United States | access to bulk sensitive data by a country of concern | the transaction is prohibited or restricted | The term data brokerage means the sale of data, licensing of access to data, or similar… |
| UK merger control, Enterprise Act 2002 section 23 | United Kingdom | turnover or share of supply | not stated | For the purposes of this Part, a relevant merger situation has been created if |
| UK National Security and Investment Act: data infrastructure | United Kingdom | the business's sector | mandatory before closing | Data infrastructure is physical or virtualised infrastructure used for storing… |

## The sentence each answer rests on (20)

- CFIUS: sensitive personal data, 31 CFR 800.241, [Code of Federal Regulations via LII](https://www.law.cornell.edu/cfr/text/31/800.241), read 2026-10-28, Where it applies: "PART 800—REGULATIONS PERTAINING TO CERTAIN INVESTMENTS IN THE UNITED STATES BY FOREIGN PERSONS"
- CFIUS: sensitive personal data, 31 CFR 800.241, [Code of Federal Regulations via LII](https://www.law.cornell.edu/cfr/text/31/800.241), read 2026-10-28, What brings a deal under it: "Has maintained or collected any identifiable data within one or more categories described in paragraph (a)(1)(ii) of this section on greater than one million individuals"
- CFIUS: sensitive personal data, 31 CFR 800.241, [Code of Federal Regulations via LII](https://www.law.cornell.edu/cfr/text/31/800.241), read 2026-10-28, Whether a filing is required: Left open by the statute or regulator page (9,286 characters, read in full 2026-10-28).
- CFIUS: sensitive personal data, 31 CFR 800.241, [Code of Federal Regulations via LII](https://www.law.cornell.edu/cfr/text/31/800.241), read 2026-10-28, The rule, in its words: "(a) The term sensitive personal data means, except as provided in paragraph (b) of this section:"
- CFIUS: TID US business, 31 CFR 800.248, [Code of Federal Regulations via LII](https://www.law.cornell.edu/cfr/text/31/800.248), read 2026-10-28, Where it applies: "The term TID U.S. business means any U.S. business that:"
- CFIUS: TID US business, 31 CFR 800.248, [Code of Federal Regulations via LII](https://www.law.cornell.edu/cfr/text/31/800.248), read 2026-10-28, What brings a deal under it: "Maintains or collects, directly or indirectly, sensitive personal data of U.S. citizens."
- CFIUS: TID US business, 31 CFR 800.248, [Code of Federal Regulations via LII](https://www.law.cornell.edu/cfr/text/31/800.248), read 2026-10-28, Whether a filing is required: Left open by the statute or regulator page (9,176 characters, read in full 2026-10-28).
- CFIUS: TID US business, 31 CFR 800.248, [Code of Federal Regulations via LII](https://www.law.cornell.edu/cfr/text/31/800.248), read 2026-10-28, The rule, in its words: "Corporation A, a U.S. business, is a credit reporting agency and maintains consumer reports meeting the description under § 800.241(a)(1)(ii)(B) on greater than one million individuals, including U.S. citizens. Corporation A maintains sensitive personal data and is therefore a TID U.S. business."
- DOJ Data Security Program, 28 CFR Part 202, [Electronic Code of Federal Regulations](https://www.ecfr.gov/current/title-28/chapter-I/part-202), read 2026-10-28, Where it applies: "ACCESS TO U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS"
- DOJ Data Security Program, 28 CFR Part 202, [Electronic Code of Federal Regulations](https://www.ecfr.gov/current/title-28/chapter-I/part-202), read 2026-10-28, What brings a deal under it: "Covered personal identifiers collected about or maintained on more than 100,000 U.S. persons; or"
- DOJ Data Security Program, 28 CFR Part 202, [Electronic Code of Federal Regulations](https://www.ecfr.gov/current/title-28/chapter-I/part-202), read 2026-10-28, Whether a filing is required: "no U.S. person, on or after the effective date, may knowingly engage in a covered data transaction involving data brokerage with a country of concern or covered person"
- DOJ Data Security Program, 28 CFR Part 202, [Electronic Code of Federal Regulations](https://www.ecfr.gov/current/title-28/chapter-I/part-202), read 2026-10-28, The rule, in its words: "The term data brokerage means the sale of data, licensing of access to data, or similar commercial transactions, excluding an employment agreement, investment agreement, or a vendor agreement"
- UK merger control, Enterprise Act 2002 section 23, [Enterprise Act 2002 on legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2002/40/section/23), read 2026-10-28, Where it applies: "the value of the turnover in the United Kingdom of the enterprise being taken over exceeds"
- UK merger control, Enterprise Act 2002 section 23, [Enterprise Act 2002 on legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2002/40/section/23), read 2026-10-28, What brings a deal under it: "the value of the turnover in the United Kingdom of the enterprise being taken over exceeds"
- UK merger control, Enterprise Act 2002 section 23, [Enterprise Act 2002 on legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2002/40/section/23), read 2026-10-28, Whether a filing is required: Left open by the statute or regulator page (14,889 characters, read in full 2026-10-28).
- UK merger control, Enterprise Act 2002 section 23, [Enterprise Act 2002 on legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2002/40/section/23), read 2026-10-28, The rule, in its words: "For the purposes of this Part, a relevant merger situation has been created if"
- UK National Security and Investment Act: data infrastructure, [GOV.UK guidance on notifiable acquisitions](https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on-notifiable-acquisitions/national-security-and-investment-act-guidance-on-notifiable-acquisitions), read 2026-10-28, Where it applies: "you are legally required to tell the government about acquisitions of certain entities in 17 sensitive areas of the economy"
- UK National Security and Investment Act: data infrastructure, [GOV.UK guidance on notifiable acquisitions](https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on-notifiable-acquisitions/national-security-and-investment-act-guidance-on-notifiable-acquisitions), read 2026-10-28, What brings a deal under it: "Data infrastructure is physical or virtualised infrastructure used for storing, processing or transmitting data in digital form"
- UK National Security and Investment Act: data infrastructure, [GOV.UK guidance on notifiable acquisitions](https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on-notifiable-acquisitions/national-security-and-investment-act-guidance-on-notifiable-acquisitions), read 2026-10-28, Whether a filing is required: "you may be legally required to tell the government about it (known as a ‘mandatory notification’)"
- UK National Security and Investment Act: data infrastructure, [GOV.UK guidance on notifiable acquisitions](https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on-notifiable-acquisitions/national-security-and-investment-act-guidance-on-notifiable-acquisitions), read 2026-10-28, The rule, in its words: "Data infrastructure is physical or virtualised infrastructure used for storing, processing or transmitting data in digital form or infrastructure that is provided for peering, interconnection or exchange of digital data"

## Read and set aside

- [DOJ National Security Division: Data Security](https://www.justice.gov/nsd/data-security): the DOJ's own page for the Data Security Program, whose rule is recorded from 28 CFR Part 202 (source 4)
- [NSI Act (Notifiable Acquisition) Regulations 2021](https://www.legislation.gov.uk/uksi/2021/1264/schedule/8): schedule 8 of the regulations covers cryptographic authentication, not data infrastructure

## Methodology

Each review's own US and UK statutes, regulations and agency pages were read through estate-fetch and stored whole (sha256 on every row). For every statute or regulator page, four questions were answered from its own words: where it applies, what brings a deal under it, whether a filing is required, the rule, in its words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or regulator page read does not address the question. A review with several statute and regulator pages reads 'varies' where they disagree. 5 reviews, 5 statute and regulator pages.

## Sources

- [FTC: HSR current thresholds](https://www.ftc.gov/enforcement/premerger-notification-program/current-thresholds) (unread)
- [31 CFR 800.241 sensitive personal data (CFIUS)](https://www.law.cornell.edu/cfr/text/31/800.241) (read)
- [31 CFR 800.248 TID US business (CFIUS)](https://www.law.cornell.edu/cfr/text/31/800.248) (read)
- [28 CFR Part 202 (DOJ Data Security Program)](https://www.ecfr.gov/current/title-28/chapter-I/part-202) (read)
- [DOJ National Security Division: Data Security](https://www.justice.gov/nsd/data-security) (not-terms)
- [NSI Act: the 17 types of notifiable acquisitions](https://www.gov.uk/government/publications/national-security-and-investment-act-guidance-on-notifiable-acquisitions/national-security-and-investment-act-guidance-on-notifiable-acquisitions) (read)
- [NSI Act (Notifiable Acquisition) Regulations 2021](https://www.legislation.gov.uk/uksi/2021/1264/schedule/8) (not-terms)
- [Enterprise Act 2002 section 23](https://www.legislation.gov.uk/ukpga/2002/40/section/23) (read)

## Cite or embed

- 5 US and UK reviews a sale of a data company can trigger, read 28 October 2026.
- Where it applies, by review: United States 3 of 5, United Kingdom 2 of 5 (5 reviews, read 28 October 2026).
- What brings a deal under it, by review: sensitive personal data held by the business 2 of 5, access to bulk sensitive data by a country of concern 1 of 5, the business's sector 1 of 5, turnover or share of supply 1 of 5 (5 reviews, read 28 October 2026).
- Whether a filing is required, by review: not stated 3 of 5, mandatory before closing 1 of 5, the transaction is prohibited or restricted 1 of 5 (5 reviews, read 28 October 2026).
- The rule, in its words, by review: stated 5 of 5 (5 reviews, read 28 October 2026).

Cite as: "Reviews a data company sale can trigger", updated 2026-10-28, https://sellmydatacompany.com/datasets/data-company-sale-review-law/.

CSV: https://sellmydatacompany.com/datasets/data-company-sale-review-law.csv
JSON: https://sellmydatacompany.com/datasets/data-company-sale-review-law.json
Embed (plain HTML, static link back): see https://sellmydatacompany.com/datasets/data-company-sale-review-law/#lead