The state of play on US and global digital policy

The Trump administration’s economic and technology strategy — and its aim for a “golden age of American innovation” — depends in no small part on a US global data policy that leads to open and trusted data governance and market access. Dominance in global technology, however, will not be a solo effort. It's only possible as a shared endeavor alongside trusted allies. In the face of a closed US approach to global tech leadership, partners and allies are more likely to limit US firms’ market access and focus on pursuing their own “sovereign” AI initiatives. This is critically important as global market access provides the revenue to drive domestic research and development in the US.

If the Trump administration does not take a leading role in shaping global data policy, other interests will suffer. China is leading a growing trend of data localization, which raises the cost and complexity for US firms to enter and compete in foreign markets, giving local firms an advantage as they are more likely to use local IT services. Similarly, countries that allow governments broad, discretionary access to data held by private firms undermine the trust that other governments and their consumers have in allowing data flows to these countries. Chinese tech firms see their comfort with both data localization and broad government access to data as a competitive advantage in their competition with US firms in third-country markets. This is especially relevant when policymakers consider these policies as part of public procurement requirements.

Building robust global data governance and flows between the United States and its friends depends on trust. But US allies in Europe and elsewhere are increasingly concerned that they could be arbitrarily cut off from accessing cutting-edge AI chips and US digital services. Adopting the US tech stack is increasingly being viewed as a critical dependency. The Trump administration should not simply look to allay these concerns. The salience of global data policy to the US’ and its allies’ interests means it should be compartmentalized from other disputes.

Despite the rapid expansion of comprehensive domestic privacy laws around the world, there are only a few initiatives to create a clear, trusted, and interoperable approach to data governance, including the G-7 trusted data agenda, the European Union’s adequacy framework, the Global Cross-Border Privacy Rules (CBPR) Forum, and data governance provisions in trade and digital economy agreements such as the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP). Looming to one side is China’s restrictive and state-controlled approach to data governance. Ironically, while China has taken half-hearted steps to allow data flows, the United States and others have adopted elements of China’s restrictive approach in reaction to China-related national security and cyber threats. This points to the challenge of balancing openness, trade, privacy, and cyber and national security interests.

The Trump administration’s data policy thus far

Well into the first year of the Trump second term, the White House has not announced any major global technology strategy (beyond AI) or data policy. The administration has, however, made several specific public statements and policy decisions that indicate its general approach to global data policy. In line with the new AI action plan, it is clear that the Trump administration prioritizes the deregulation of digital and tech policy and support for innovation rather than the creation of new data privacy and security laws and frameworks.

To date, the Trump administration has not changed the United States’ role in existing global data agreements and initiatives. It participated in the launch of Global CBPR, which successive US administrations had worked for years to establish. The Trump administration has also not rescinded the executive order that backs the US commitments made in the US-EU Data Privacy Framework, although it fired some key personnel involved in the project.

The first instance of definitive policy action on data and digital trade undertaken by the second Trump administration was the Department of Justice’s issuance of implementation and enforcement guidance in April 2025 for its Data Security Program (DSP) protecting bulk sensitive data. The DSP establishes rules for US persons and entities engaging in specific data transactions considered by the US government as posing an unacceptable risk of giving “countries of concern” or “covered persons” access to government related data or bulk US sensitive personal data. All the additional requirements, including due diligence and auditing related to the DSP are set to become effective on October 6, 2025. The DSP is being equated by many to “an official export control program for certain sensitive personal data.”

In another, more targeted instance of controlling the movement of US citizens’ personal data, the Food and Drug Administration announced a halt and immediate review of new clinical trials in June 2025. This includes trials where American patients’ cells were sent to China or other “hostile countries” for genetic engineering with the expectation that the cells would be reinfused into US patients. The announcement apparently came in the face of “mounting evidence” that some researchers had failed to obtain informed consent from trial participants on the international transfer and manipulation of biological material. There is continued ambiguity regarding the finer details of the policy.

How the Trump administration can build fair and trusted data governance that supports US tech leadership

The Trump administration should consider developing a data policy to induce partners to treat both US tech firms and US data fairly and to build data flows between trusted partners.

Prioritize addressing barriers to digital trade in its negotiations with trading partners, such as India, Indonesia, Mexico, and Vietnam. The administration has made several statements that show it recognizes the importance of removing barriers to data flows and digital free trade. This should be a key aim given that US firms are world leaders in digital trade.
Promote Global CBPR as a vehicle for trusted data flows. While there are currently only thirteen jurisdictions taking part in Global CBPR, they include both major US trading partners, such as Japan, Canada, and Australia, and partners critical to global technological collaboration and innovation, such as Singapore and Taiwan. The UK is considering membership; similarly, the system has been considered in talks between the United States and India. If the White House could convince both states to join, along with a rising middle power like Indonesia, for example, it could help achieve a critical mass to make the framework a truly valuable global mechanism for data transfers.
Create a trusted government access initiative to address the data privacy and security issues raised by China’s data management approach. The US has the principles, partners, and forum — the ongoing OECD-led initiative on trusted government access to data held by private entities — to develop a coordinated approach to concerns about overly broad government access to data. It should work with partners to develop new tools to define trusted government access to data and to prevent sensitive data from going to untrustworthy jurisdictions. Most jurisdictions do not have a clear legal mechanism, process, or framework to do this. The US government’s experience with trying to bring the bulk data initiative to life would be instructive to other countries.
Establish a trusted cloud initiative with key allies and trading partners — such as the Five Eyes intelligence partners, Japan, and the EU, among others — to develop a common, flexible, and risk-based approach to issues pertaining to cloud trustworthiness, national security, and sensitive data. Detailed and clear criteria for cloud trustworthiness would also take on broader commercial and strategic significance in terms of geopolitical competition over technology market share in third-country markets.

Conclusion

The United States cannot set out a clear, forward-thinking strategy for global data policy alone. It should lead a coalition of like-minded partners that want an open, innovative, and rights-respecting digital world. This means listening to partners as well as leading, sharing expertise, and supporting them through technical and policy cooperation. The stakes are high. Data is increasingly central to global commerce, innovation, and diplomacy. If differing and conflicting data rules fragment the global digital economy, the US’ and its allies’ leadership in technology — and the open internet itself — could suffer. This is a critical effort that the Trump administration should lead.

Access the full white paper