Editor’s Note: Two governments rewrote the rules on cross-border data within the same week, and the rules point in opposing directions. China’s April 7 Regulations on Industrial and Supply Chain Security impose administrative countermeasures against the very supply chain restrictions that the U.S. Department of Justice’s Data Security Program demands, while the DOJ’s enforcement trajectory—now backed by class action litigation and bipartisan political support—shows no sign of softening. Six days later, Beijing published companion regulations targeting companies that comply with foreign extraterritorial measures, closing the last remaining gap in its counter-sanctions architecture.
For cybersecurity, information governance, and eDiscovery professionals, this is not an abstract geopolitical development. It is an operational compliance challenge that touches vendor contracts, data architectures, cross-border discovery workflows, threat intelligence sharing, and incident response protocols. Organizations that handle data across U.S. and Chinese jurisdictions—and AmCham China’s survey data suggests that the vast majority of American companies in China plan to stay—face a conflict of laws that in many scenarios cannot be resolved through compliance alone and instead requires risk-allocation and strategic choices.
Watch for the first enforcement actions under Decree 834, the DOJ’s next round of DSP penalties, and the growing market shift toward private deployment architectures designed to keep data within jurisdictional walls.
Content Assessment: The Data Sovereignty Vise: Two Governments, One Compliance Trap, No Safe Harbor
Information - 93%
Insight - 94%
Relevance - 91%
Objectivity - 91%
Authority - 90%
92%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "The Data Sovereignty Vise: Two Governments, One Compliance Trap, No Safe Harbor."
Industry News – Data Privacy and Protection Beat
The Data Sovereignty Vise: Two Governments, One Compliance Trap, No Safe Harbor
ComplexDiscovery Staff
On April 7, China’s State Council published the Regulations on Industrial and Supply Chain Security — 18 articles, effective immediately, with no grace period. The timing was not subtle. Almost exactly one year earlier, on April 8, 2025, the U.S. Department of Justice’s Data Security Program had gone live, restricting American companies from transferring bulk sensitive personal data to China and five other countries of concern. That program has been in full enforcement since October 2025, with multiple class action lawsuits already filed and DOJ enforcement expected to accelerate through 2026. China’s response, whether coordinated or coincidental, landed squarely on the anniversary — and moved in the opposite direction.
The result is a high-risk compliance environment in which many cross-border data transactions involving China could trigger conflicting obligations — and in some scenarios, full compliance with both regimes may be practically impossible. Moving data out of China now triggers scrutiny under Beijing’s new supply chain security framework. Restricting data flows to China — the response the DOJ’s program effectively demands — could constitute the kind of conduct that Chinese authorities view as discriminatory against Chinese counterparties, according to law firm and business chamber analyses of the new regulations.
The space for compliant middle-ground operations is narrowing fast. And six days after China’s supply chain rules took effect, Beijing published a second regulation that made the vise even tighter.
Two Regulations, One Week, Zero Transition
China’s Regulations on Industrial and Supply Chain Security (State Council Decree No. 834) landed with no advance draft, no public comment period, and no implementation runway. As Morgan Lewis noted in its April analysis, the regulations represent China’s first dedicated administrative regulation aimed at safeguarding industrial and supply chain security, consolidating authority across over 15 government agencies including the Ministry of Commerce, the Ministry of Industry and Information Technology, and the Cyberspace Administration of China.
The scope is deliberately broad. Article 13, in summary, restricts organizations and individuals from conducting investigations and other information collection activities related to industrial and supply chains within China in ways that violate Chinese law. Morgan Lewis and the German Chamber of Commerce in China both observed that this provision carries extraterritorial implications, warning that supply chain due diligence conducted within China under U.S. or EU legislation — such as the EU’s Corporate Sustainability Due Diligence Directive or the U.S. Uyghur Forced Labor Prevention Act — could face regulatory exposure in Beijing.
Article 15 is the enforcement trigger. In summary, it provides that where a foreign organization or individual interrupts normal transactions with Chinese counterparties or adopts discriminatory measures, and such conduct causes or threatens to cause substantial harm to China’s supply chain security, Chinese authorities may investigate and impose countermeasures. As Morgan Lewis and the German Chamber of Commerce in China noted, the language gives regulators broad discretion: the regulation does not require proof of intent to harm China, and the threshold of causing or potentially causing substantial harm extends, in the German Chamber’s assessment, to “commercial conduct that could be viewed as affecting supply chain stability.”
The countermeasures available under Article 14 include prohibiting or restricting imports and exports of goods and technologies, imposing special fees, and barring foreign organizations and individuals from engaging in China-related business activities. Individuals — including China-based managers and representatives of foreign companies — may face travel bans, visa restrictions, or data transfer prohibitions.
Six days later, on April 13, the State Council published Decree No. 835: the Regulations on Countering Foreign Improper Extraterritorial Jurisdiction. This companion regulation targets foreign organizations and individuals that “promote or participate in the implementation of a foreign state’s unlawful extraterritorial jurisdiction measures.” It establishes a malicious entity list and sets out criteria for exercising jurisdiction over conduct connected to China — what the Geopolitechs analysis described as an “appropriate connection” standard that represents a shift from defensive blocking to an active jurisdictional stance.
The practical effect of the two decrees operating in tandem is severe. A single corporate action — terminating a Chinese supplier to comply with U.S. export controls, for instance — can now simultaneously trigger a supply chain investigation under Decree 834, extraterritorial jurisdiction countermeasures under Decree 835, and potential listing on the malicious entity register. Morgan Lewis characterized the dual framework as a consolidation and expansion of China’s counter-sanctions architecture that has been developing since 2020.
The American Side of the Vise
The DOJ’s Data Security Program traces to Executive Order 14117, signed by President Biden on February 28, 2024, and notably not rescinded when President Trump took office in January 2025. The program’s final rule took effect on April 8, 2025, targeting six countries of concern: China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela. After a 90-day good-faith compliance window that ended on July 8, 2025, and full implementation of audit and reporting requirements on October 6, 2025, the program entered active enforcement.
The prohibited and restricted transactions cover bulk transfers of six categories of sensitive personal data — genomic, geolocation, biometric, health, financial, and personal identifiers — along with government-related data. The penalty structure reflects the national security framing: civil fines of the greater of $368,136 or twice the transaction value, and criminal penalties reaching $1 million and 20 years imprisonment.
As Proskauer Rose documented in its enforcement analysis, the DOJ cautioned that “individuals and entities should be in full compliance with the DSP and should expect the DOJ’s National Security Division to pursue appropriate enforcement with respect to any violations.” That warning carried weight. By February 2026, Google LLC faced multiple class action complaints — including McGrath v. Google LLC, Nadeu v. Google LLC, and Jenkins v. Google LLC, as documented by Reed Smith — alleging improper transfer of sensitive data to covered third-party persons, involving cookie data, IP addresses, and persistent advertising identifiers. The lawsuits arrived ahead of early-2026 annual reporting deadlines under the DSP, underscoring the program’s growing litigation exposure.
The bipartisan durability of the program is itself notable. As Government Contracts Law observed, the Trump administration has continued to prioritize the Data Security Program, with the publication noting alignment between the DSP’s objectives and broader administration priorities including the America First Investment Policy. A Biden-era executive order is being enforced with continuity across administrations — a signal that the program is not going away regardless of which party holds the White House.
The Impossible Middle
The scale of exposure is not theoretical. The American Chamber of Commerce in China’s 2026 Business Climate Survey, based on responses from over 360 companies across 20-plus industries and released in January 2026, found that about seven in ten responding companies reported no intention of relocating operations out of China and roughly half ranked China among their top three global investment destinations. AmCham China represents approximately 900 member companies. The vast majority of them now operate under two sets of data sovereignty rules that point in opposing directions.
For any organization that handles data across U.S. and Chinese jurisdictions — and the eDiscovery, information governance, and cybersecurity professions are full of them — the two regulatory frameworks create a direct conflict of laws.
The DOJ’s Data Security Program prohibits or restricts transferring bulk sensitive data to China. China’s new supply chain regulations prohibit “interrupting normal transactions” or adopting “discriminatory measures” against Chinese counterparties. A multinational that restricts data flows to its Chinese operations to comply with the DSP may be engaging in exactly the conduct that Article 15 targets. A multinational that maintains unrestricted data flows to stay on the right side of Beijing’s regulations may be violating the DSP.
The conflict extends to information collection itself. Article 13 of Decree 834 restricts supply chain information-gathering activities conducted within China under foreign legislative authority. The DSP’s audit and reporting requirements, which demand that companies track and document their data transactions involving countries of concern, could be characterized as precisely the kind of information collection activity that China now restricts.
Cross-border eDiscovery adds another layer. Protective orders in U.S. litigation increasingly restrict the use of AI tools and cloud platforms for discovery materials, as recent rulings in Morgan v. V2X and Jeffries v. Harcros Chemicals established. But processing discovery data in China now raises supply chain security questions under Decree 834, while transferring that data out of China must navigate the Cyberspace Administration’s three-pathway framework for cross-border personal information transfers — security assessment, standard contract, or certification — depending on data volume and type.
The compliance burden compounds. Separate from Decree 834, China’s existing cross-border data transfer regime — administered by the Cyberspace Administration of China under the Personal Information Protection Law — imposes its own tiered obligations: mandatory security assessments for transfers involving over one million individuals’ personal information or 10,000 individuals’ sensitive personal information, and a certification pathway (effective January 1, 2026) for mid-tier transfers between 100,000 and one million individuals. The DOJ requires covered U.S. persons to report specified known or suspected violations within 14 days. An organization conducting eDiscovery across both jurisdictions must simultaneously satisfy Chinese data localization mandates, U.S. bulk data transfer restrictions, and the protective order requirements of whichever court is supervising the litigation — three regulatory regimes that may be mutually exclusive in practice.
The EU Dimension
The compliance picture does not stop at two jurisdictions. On March 16, the EU Council imposed sanctions on two Chinese firms — Integrity Technology Group and Anxun Information Technology (known as iSoon) — along with one Iranian company, for cyberattacks targeting EU member states’ critical infrastructure. The sanctions freeze EU assets of the designated entities and bar their co-founders from traveling to any EU member state.
The iSoon sanctions carry data governance implications that extend beyond cybersecurity. Organizations conducting vendor risk assessments must now screen for sanctioned Chinese technology firms in their supply chains — a due diligence activity that could, in principle, be viewed as restricted information collection under Article 13 of Decree 834 if conducted within China, given the broad language that law firm and chamber analyses have flagged. The EU’s action also reinforces the converging trend: Western governments are building separate but directionally aligned frameworks for restricting technology and data relationships with Chinese entities, while China is simultaneously building legal infrastructure that may have the effect of deterring compliance with those very restrictions.
GDPR adds its own layer. The Morgan v. V2X ruling in U.S. courts established what practitioners have characterized as a three-part framework for AI vendor contracts — no training on inputs, no third-party disclosure, and the right to delete — a structure that some commentators note aligns closely with GDPR data processing requirements. But cross-border transfers between the EU and China must also navigate standard contractual clauses and adequacy assessments under European data protection law, creating a third compliance rail alongside the American and Chinese requirements.
The Cybersecurity Overlay
CISA published security requirements for restricted transactions under EO 14117 that took effect alongside the DOJ’s final rule on April 8, 2025. Those requirements mandate that organizations engaging in restricted transactions — data transfers to countries of concern that are permitted but subject to conditions — designate a responsible individual such as a Chief Information Security Officer, maintain updated asset inventories with at least monthly refreshes, enforce multi-factor authentication, and implement data-level protections including encryption, data minimization, masking, and privacy-enhancing technologies such as homomorphic encryption or differential privacy.
For cybersecurity teams, the CISA requirements impose a compliance layer that sits on top of the DSP’s transaction-level restrictions. An organization that routes any restricted data transaction through Chinese infrastructure must demonstrate that its security controls satisfy CISA’s organizational and data-level requirements — controls that could potentially be characterized as conflicting with Article 13’s restrictions, depending on how Chinese authorities interpret “information collection activities related to industrial and supply chains.” Maintaining the audit trails and asset inventories that CISA demands might, under a broad reading of Article 13, fall within the scope of restricted supply chain information-gathering.
Threat intelligence sharing compounds the tension. Cybersecurity professionals routinely share indicators of compromise and threat data about Chinese advanced persistent threat groups through ISACs, CISA’s Joint Cyber Defense Collaborative, and private threat-sharing platforms. Under Decree 835, China can now characterize participation in threat intelligence ecosystems that attribute attacks to Chinese state-sponsored actors as “promoting the implementation of a foreign state’s unlawful extraterritorial jurisdiction measures.” Organizations with personnel in China face a direct conflict: participate in Western threat-sharing frameworks and risk Decree 835 exposure, or withdraw from those frameworks and degrade their security posture.
Incident response raises a parallel problem. When a breach involves data subject to both the DSP and Chinese data localization mandates, the DSP’s 14-day violation reporting requirement and China’s own breach notification obligations may conflict on what can be disclosed to which government, and when.
The Vendor Response
The market is already adjusting. Reveal, the eDiscovery platform provider, has expanded its private deployment investment by 50 percent as enterprise demand surges for infrastructure that keeps data within jurisdictional boundaries. The Consilio-Reveal partnership, formalized in October 2025, integrates private cloud deployment into Consilio’s Aurora platform. Reveal markets EU-hosted options for its Logikcull platform to support data sovereignty and GDPR compliance, according to the company’s product announcements.
The shift toward private deployment architectures reflects a recognition that multi-tenant cloud platforms create jurisdictional exposure that single-tenant and on-premises deployments avoid. When data never leaves a jurisdiction, the cross-border transfer rules do not apply — a brute-force solution that sacrifices the cost efficiencies of cloud computing for the certainty of jurisdictional containment.
Analyses from Andreessen Horowitz have suggested that certain large enterprises have realized 30 to 50 percent savings on steady, predictable workloads after cloud repatriation. But those figures assume stable processing volumes; the variable, high-volume workloads that characterize eDiscovery may not yield the same economics. The economic calculus is shifting nonetheless: the cost of a DSP violation — civil penalties starting at $368,136 per transaction, with criminal exposure up to 20 years — may make private deployment the cheaper option regardless of infrastructure economics.
What Comes Next
China’s two April regulations took effect immediately with no transition period. The DOJ’s enforcement trajectory is accelerating. The EU’s iSoon sanctions add a third regulatory pole. And the compliance challenge is not static — it is compounding.
For information governance professionals, the immediate task is conducting a data flow audit that maps every China-touching transaction against both the DSP’s six categories of restricted sensitive data and Decree 834’s supply chain security triggers. For eDiscovery teams, any cross-border matter involving China now requires a jurisdictional analysis before data is collected, processed, or reviewed — and that analysis must account for whether the chosen platform’s hosting architecture keeps data within a single jurisdiction or routes it across borders. For cybersecurity professionals, the EU sanctions on Chinese technology firms demand updated vendor screening protocols that must themselves be conducted in ways that do not violate China’s information collection restrictions under Article 13.
Three steps are actionable now. First, audit existing AI vendor and cloud provider contracts to determine whether they satisfy both DSP compliance requirements (including CISA’s security requirements for restricted transactions) and Decree 834’s prohibition on information collection that violates Chinese law — recognizing that some contracts may need jurisdiction-specific versions. Second, establish a conflict-of-laws escalation protocol that identifies in advance which matters cannot be resolved through compliance alone and require legal counsel with cross-border regulatory expertise. Third, evaluate whether current data architecture — cloud, private deployment, or hybrid — creates jurisdictional exposure that a different hosting model could eliminate.
The deeper question is structural. The dual-jurisdiction vise is not an anomaly — it is the emerging architecture of data governance in a bifurcating global economy. China’s April 7 regulations did not arrive in a vacuum; they landed on the anniversary of a U.S. enforcement program that Beijing has publicly opposed. Both governments are building legal walls around their data, and the walls are going up simultaneously.
When full legal compliance with both regimes may be impossible in certain scenarios, what risk-allocation and strategic choices are organizations prepared to make — and how are they documenting those decisions?
News Sources
- China Enacts First Comprehensive Regulations on Industrial and Supply Chain Security (Morgan Lewis)
- China Issues New Regulations on Countering Foreign Extraterritorial Jurisdiction (Morgan Lewis)
- China issues regulations on industrial, supply chain security (gov.cn)
- China Moves to Shield Supply Chains and Formalize Retaliation Powers (Geopolitechs)
- DOJ Begins Enforcement of New Data Security Program (Proskauer Rose)
- DOJ Data Security Program Update: Active Enforcement Begins This Week (Crowell & Moring)
- DOJ Launches New Data Security Program—What Your Company Needs to Know (Government Contracts Law)
- Multiple class actions filed against Google alleging violations of DOJ’s Bulk Rule (Reed Smith)
- Security Requirements for Restricted Transactions (CISA)
- Cyber-attacks against the EU: Council sanctions three entities and two individuals (EU Council)
- Reveal Expands Private Deployment Investment by 50% as Enterprise Demand Surges (BusinessWire)
- Consilio and Reveal Announce Strategic Partnership (BusinessWire)
- Advocacy Alert: China Increases Attention on Supply Chain Security (German Chamber of Commerce in China)
- 2026 China Business Climate Survey Report (AmCham China)
- China Releases Cross-Border Data Transfer Certification Measures (China Briefing)
Assisted by GAI and LLM Technologies
Additional Reading
- The EU’s E-Evidence Framework Goes Live in August and Most of Europe Isn’t Ready
- We Wanted Smarter Legal Tech, but Instead Got an Expensive Dependency
- The AI Sanction Wave: $145K in Q1 Penalties Signals Courts Have Lost Patience with GenAI Filing Failures
- FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
- White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
- The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.


























