FDA Joins the Data Security Program Conversation: The Agency’s Scrutiny of Cross-Border Clinical Trials & 28 C.F.R. Part 202 Exemptions

At a Glance

• FDA contends that some clinical trials have “failed to inform participants about the international transfer and manipulation of their biological material and may have exposed Americans’ sensitive genetic data to misuse by foreign governments including adversaries.”
• It is not yet clear whether FDA or NIH have begun any such review of clinical trials.
• It is also unclear whether or when FDA (or NIH) will provide further guidance for clinical trial sponsors.

On June 18, 2025, the U.S. Food and Drug Administration (FDA) announced “an immediate review of new clinical trials that involve sending Americans’ living cells to China and other hostile countries for genetic engineering and subsequent infusion back into U.S. patients – sometimes without their knowledge or consent.” The press release further comments on the Department of Justice’s (DOJ) newly effective Data Security Program (DSP), which imposes restrictions and prohibitions on transfers of specific kinds of sensitive data, at certain bulk thresholds, to “countries of concern.” This program incorporates the principles of Executive Order 14117 on “Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” and the DOJ implementing regulations.

In its press release, FDA contends that some clinical trials have “failed to inform participants about the international transfer and manipulation of their biological material and may have exposed Americans’ sensitive genetic data to misuse by foreign governments including adversaries.” FDA further states (somewhat inexplicably, given the DSP’s recent effective date and its narrowly tailored exemptions):

“This practice was made possible by a data security rule finalized under the Biden Administration in December 2024 and implemented in April 2025 by the U.S. Department of Justice. While the rule imposed export controls to limit sensitive data transfers to countries of concern, the Biden Administration specifically requested and approved a sweeping exemption that allowed U.S. companies to send trial participants’ biological samples — including DNA — for processing overseas as part of FDA-regulated clinical trials. This exemption applied even in cases involving companies partially owned or controlled by the Chinese Communist Party.”

For background, the DSP prohibits or restricts certain transactions that would allow access to government-related data or bulk U.S. sensitive personal data by any “covered person” or “country of concern” (currently including China, Hong Kong, Macau, Russia, North Korea, Iran, Venezuela and Cuba). This program went into effect on April 8, 2025, and had an initial enforcement discretion period that ended on July 8, 2025. The DSP has limited, narrow exemptions, including two that are primarily relevant to FDA’s press release — the clinical investigation/post-market surveillance exemption (28 C.F.R. § 202.511) and the official government business exemption (28 C.F.R. § 202.504).

First, the DSP provides an exemption in 28 C.F.R. § 202.511 for transactions that are “ordinarily incident to and part of” (1) clinical investigations regulated by FDA or that support applications to FDA for research or marketing permits for drugs, biological products, devices, combination products or infant formula; or (2) collection or processing of clinical care data indicating real world performance or safety of products, or collection or processing of post-marketing surveillance data, and necessary to support or maintain authorization by FDA, provided that the data is de-identified or pseudonymized. FDA’s press release (albeit vague and being merely a press release) takes issue with the Section 511 exemption, with FDA Commissioner Dr. Marty Makary stating:

“The previous administration turned a blind eye and allowed American DNA to be sent abroad — often without the knowledge or understanding of trial participants. The integrity of our biomedical research enterprise is paramount. We are taking action to protect patients, restore public trust, and safeguard U.S. biomedical leadership.” The release continues, “the FDA is actively reviewing all relevant clinical trials that relied on this exemption and will require companies to demonstrate full transparency, ethical consent and domestic handling of sensitive biological materials. New trials that cannot meet these standards will not proceed.”

Although the DOJ’s commentary already indicated that this exemption is intended to be construed narrowly, the FDA appears to be encouraging clinical trial sponsors to not rely on the Section 511 exemption, even where doing so would otherwise be permissible under the DSP. FDA may seek to operationalize this position through its review of clinical trial protocols, informed consent forms and other aspects of clinical research under Investigational New Drug (IND) applications.

Second, the DSP provides an exemption in 28 C.F.R. § 202.504 for transactions that are for the conduct of official business of the United States government; for an authorized activity of any United States government department or agency; or conducted pursuant to a grant, contract or other agreement entered into with the United States government. This would include, for example, federally funded clinical research conducted pursuant to a National Institutes of Health (NIH) grant. FDA’s press release specifically mentions and rejects support for this exemption as well, stating that FDA is “working closely with the National Institutes of Health (NIH) to ensure that no federally funded research is compromised by these practices.” On June 18, NIH Director Dr. Jay Bhattacharya made a similar statement supporting FDA’s position, stating:

“In light of the FDA’s actions and new information surrounding the Biden Administration’s egregious policies, NIH is actively reviewing its entire research portfolio to determine whether any federally funded clinical trials utilized the exemption issued under the Biden Administration that allowed American biological materials to be sent abroad for genetic modification – particularly to entities operating in countries of concern . . . Our goal is to protect Americans’ sensitive biological data while continuing to support life-saving innovation in a way that is safe, secure, and worthy of the public’s trust. This exemption requested created a dangerous blind spot in our research security that put the privacy and trust of American participants at risk. We are assessing the scope of this issue to ensure that no NIH dollars are supporting clinical trials that compromise data integrity, patient consent, or national security.”

As of now, it is not clear whether FDA or NIH have begun any such review of clinical trials. It is also not yet clear whether or when FDA (or NIH) will provide any further guidance for clinical trial sponsors related to the DSP. That said, FDA and NIH may look for ways to use their enforcement capabilities and tools under current rules to crack down on data-sharing and other research practices that the agencies view as problematic. For example, FDA may increase scrutiny of ongoing trials as a part of clinical development interactions with sponsors, as well as of submitted applications containing data from completed trials that could be found to violate the DSP. This may cause delays as FDA asks questions about data-sharing arrangements or requires sponsors to institute changes for forthcoming trials. Moving forward, the agencies may also seek to work with DOJ to make the DSP regulations more stringent. Sponsors should be mindful of how FDA may raise these issues for new applications and be prepared to engage with agencies as the relevant regulations may be further changed.