Reviews
Selling a data company to a foreign buyer: US and UK reviews
Updated
A data company is the kind of business governments review, because of the personal data it holds or the infrastructure it runs.
CFIUS and sensitive personal data
CFIUS treats a US business that maintains or collects sensitive personal data of US citizens as a TID US business. Its rules give the example of a credit reporting agency holding consumer reports on more than one million individuals.
The Justice Department's bulk data rule
Under 28 CFR Part 202 no US person may knowingly engage in a covered data transaction involving data brokerage with a country of concern or a covered person, and the rule counts covered personal identifiers on more than 100,000 US persons as bulk.
The UK's mandatory notification
The National Security and Investment Act requires a notification for acquisitions in 17 sensitive areas, data infrastructure among them: physical or virtualised infrastructure used for storing, processing or transmitting data in digital form.