Data Security Business Advisory

This Advisory describes the data-related risks American businesses face as a result of the actions of the People’s Republic of China (PRC) and outlines steps that businesses can take to mitigate these risks. Businesses expose themselves and their customers to heightened risk when they share sensitive data with firms located in the PRC, or use equipment and software developed by firms with an ownership nexus in the PRC, as well as with firms that have PRC citizens in key leadership and security-focused roles (together, “PRC firms”). Due to PRC legal regimes and known PRC data collection practices, this is particularly true for data service providers and data infrastructure.