Clinical Site Agreement: Navigating US Export Control Review of Cross-Border Data Transfers in Clinical Trials

Sponsors should adopt a structured pre-contractual and contractual approach to manage export control risk in clinical site agreements. Key recommended practices include: (1) Conducting early site feasibility due diligence to identify whether the site has an Export Control Office and what its requirements are; (2) Preparing a granular data flow map for each site transfer scenario to support both federal and institutional review; (3) Not relying on federal exemptions — such as the clinical investigation exemption — without first obtaining institutional confirmation that the exemption is accepted; (4) Explicitly addressing aggregate threshold risk in the agreement, rather than relying only on study-level participant counts; and (5) Building sufficient review timelines into the study schedule to accommodate institutional export control approval processes, which can cause delays if not anticipated early.

Not at this stage. The clinical investigation exemption under the DOJ Bulk Data Rule is not yet settled law, and no common sector-wide interpretation exists. While Executive Order 14117 and the implementing regulations issued by the DOJ in early 2025 include provisions that may exclude certain FDA-regulated clinical investigations from the scope of bulk data restrictions, the precise boundaries of this exemption remain subject to regulatory interpretation. Key open questions include which data categories it covers, whether it applies to coded as well as identified data, and how it interacts with institutional review requirements. Sponsors and legal counsel should not treat this exemption as a conclusive determination and should instead prepare detailed data flow maps and engage proactively with each site's Export Control Office.

Academic medical centres in the United States frequently maintain Export Control Offices that apply institution-wide policies derived from a combination of federal export control regulations — including the Export Administration Regulations administered by the Bureau of Industry and Security — and internal risk management frameworks. These offices may require a Technology Control Plan, an end-use certificate, or formal written authorisation before approving any data transfer to a country of concern, regardless of the size of the study. Sponsors should identify, at the site feasibility stage, whether a candidate site has such an office and clarify its standard review timelines and documentation requirements, so that these obligations can be reflected in the clinical site agreement and the overall study timeline.

Thresholds under the DOJ Bulk Data Rule are calculated on an aggregate basis across all covered data transactions conducted by a covered person over the preceding twelve-month period — not on a per-study basis. This means that even if a specific clinical study involves far fewer participants than the applicable volume threshold, the investigative site (particularly a large academic institution) may have conducted numerous other data transactions with the same country of concern during the same period. The institution's aggregate exposure across all its research activities may therefore exceed the threshold even if the individual study does not. Sponsors must request information about how a site calculates its institutional aggregate and must not rely solely on the study-level participant count when assessing federal threshold applicability.

No. A site's internal institutional policy is not subordinate to federal exemption thresholds. Even if a sponsor correctly determines that a study falls below the DOJ Bulk Data Rule's volume thresholds or qualifies for the clinical investigation exemption, the investigative site's Export Control Office may still require a formal prior review and approval before any data transfer to a country of concern can proceed. This distinction is fundamental: an institution's compliance infrastructure operates in parallel to federal rules and can halt or delay a transfer regardless of the sponsor's federal-level compliance assessment.

The DOJ Bulk Data Rule, established under Executive Order 14117, is a US federal framework that restricts or prohibits certain data transactions with designated countries of concern — such as China — when those transactions exceed defined volume thresholds for sensitive personal data categories, including genomic, biometric, financial and health information. For clinical trials, it is relevant because multi-site studies routinely transfer participant data across borders to sponsors, CROs and data processors located outside the United States. Importantly, even when a sponsor determines that federal thresholds are not met, the investigative site's own institutional Export Control Office may impose stricter, independent review requirements that must also be satisfied before any transfer can proceed.

Sponsors should adopt a structured pre-contractual and contractual approach to manage export control risk in clinical site agreements. Key recommended practices include: (1) Conducting early site feasibility due diligence to identify whether the site has an Export Control Office and understanding its requirements before contract negotiation begins; (2) Preparing a granular data flow map that details every cross-border transfer scenario specific to the study; (3) Not relying on federal exemptions — such as the clinical investigation exemption — without first obtaining explicit institutional confirmation; (4) Addressing aggregate threshold risk explicitly in the agreement, rather than assuming study-level participant counts are sufficient; and (5) Building export control review timelines into the study schedule to prevent delays during trial execution.

No — not yet. As of the date of the article, the clinical investigation exemption under the DOJ Bulk Data Rule is not settled law, and no common sector-wide interpretation exists. While the implementing regulations issued by the DOJ in early 2025 include provisions that may exclude certain FDA-regulated clinical investigations from the scope of the bulk data restrictions, the precise boundaries of this exemption remain subject to regulatory interpretation. Key open questions include which data categories it covers, whether it applies to coded as well as identified data, and how it interacts with institutional review requirements. Sponsors and legal counsel should not treat the exemption as a conclusive determination and should instead prepare detailed data flow maps and engage proactively with each site's Export Control Office.

Academic medical centres in the United States frequently maintain dedicated Export Control Offices that apply institution-wide policies derived from federal export control regulations — including the Export Administration Regulations administered by the Bureau of Industry and Security — as well as internal risk management frameworks. These offices may require a Technology Control Plan, an end-use certificate, or a formal written authorisation before approving any data transfer to a country of concern, regardless of the study's size or participant count. Sponsors should identify at the site feasibility stage whether a candidate site has such an office and understand its standard review timelines and documentation requirements, so these obligations can be properly reflected in the clinical site agreement and study schedule.

Thresholds under the DOJ Bulk Data Rule are calculated on an aggregate basis across all covered data transactions conducted by a covered person over the preceding twelve-month period — not on a per-study basis. This means that even if a specific clinical trial involves fewer participants than the applicable volume threshold, the investigative site (as a large academic institution) may have conducted numerous other data transactions with the same country of concern during that same period. The institution's aggregate exposure across all its research activities and partnerships may therefore exceed the threshold even if the individual study does not. Sponsors must request information about how the site calculates its institutional aggregate and must not rely solely on study-level participant counts.

Yes. Institutional policy is not subordinate to federal exemption thresholds. Even when a sponsor correctly determines that a study does not meet the DOJ Bulk Data Rule's volume thresholds or qualifies for an exemption, the site's Export Control Office may still require a formal prior review and approval before any data transfer to a country of concern can proceed. This means a site's internal review process can halt or delay a transfer even if the sponsor has assessed the transaction as fully compliant under federal law. Sponsors must engage with each site's Export Control Office early and not assume federal compliance equates to institutional clearance.

The DOJ Bulk Data Rule, established under Executive Order 14117, is a US federal framework that restricts or prohibits certain data transactions with designated countries of concern — such as China — when those transactions exceed defined volume thresholds for sensitive personal data categories, including genomic, biometric, financial, and health information. For clinical trials, it matters because multi-site studies routinely transfer participant data across borders to sponsors, CROs, and data processors located outside the United States. Any such transfer involving a US academic institution may trigger not only federal obligations but also the institution's own internal export control review, which can be stricter than federal requirements.

Sponsors should adopt the following practices when negotiating a clinical site agreement that involves cross-border data transfers subject to export control review: (1) Conduct early site feasibility due diligence by asking whether the site has an Export Control Office, what restrictions it applies, and what its standard review timelines are. (2) Prepare a granular data flow map covering all transferred data categories, recipients, legal bases, and volumes. (3) Do not rely on federal exemptions without institutional confirmation — require the site to confirm Export Control Office approval as a condition precedent to data transfers. (4) Address aggregate threshold risk explicitly by including a site representation that its institutional aggregate has been assessed and that the proposed transfer is compliant. (5) Build realistic export control review timelines into the study schedule to avoid delays at site activation.

A clinical site agreement involving cross-border data transfers to countries of concern should be accompanied by a granular data flow map identifying: every data category transferred (including whether data is coded or identified), the recipient entity and its country of establishment, the legal basis for the transfer, and the volume of data involved. In addition, depending on the site's institutional requirements, documentation may include a Technology Control Plan, an end-use certificate, and a formal written authorisation from the site's Export Control Office. The clinical site agreement itself should include a clause making Export Control Office approval a condition precedent to the commencement of any data transfers.

No — not yet. The clinical investigation exemption under the DOJ Bulk Data Rule is not settled law, and no common sector-wide interpretation exists. While the implementing regulations issued in early 2025 include provisions that may exclude certain FDA-regulated clinical investigations from the bulk data restrictions, the precise boundaries of this exemption remain subject to regulatory interpretation. Key open questions include which data categories are covered, whether the exemption applies to coded as well as identified data, and how it interacts with institutional review requirements. Sponsors should not treat the exemption as a conclusive shield and should instead engage proactively with each site's Export Control Office while preparing detailed data flow maps for every transfer scenario.

Thresholds under the DOJ Bulk Data Rule are calculated on an aggregate basis across all covered data transactions conducted by a covered person over the preceding twelve-month period — not on a per-study basis. This creates a significant compliance gap in many clinical site agreements. A sponsor may correctly determine that a specific study falls below the applicable volume threshold, but the investigative site — as a large academic institution — may have conducted many other data transactions with the same country of concern during the same period. The institution's aggregate exposure could therefore exceed the threshold even if the individual study does not. Sponsors must request information on how the site calculates its institutional aggregate and not rely solely on study-level participant counts.

Yes. Institutional export control policy is not subordinate to federal exemption thresholds. A clinical site's Export Control Office — particularly at a US academic medical centre — operates in parallel to federal rules and may impose stricter or broader obligations. This means a site can halt or delay a cross-border data transfer even when the sponsor has assessed the transaction as fully compliant under federal law. Sponsors must therefore engage with the site's Export Control Office early in the process and not assume that a federal compliance assessment is sufficient to proceed.

The US Department of Justice (DOJ) Bulk Data Rule, established under Executive Order 14117, restricts or prohibits certain data transactions with designated countries of concern — such as China — when those transactions exceed defined volume thresholds for sensitive personal data categories, including genomic, biometric, financial, and health information. For clinical trials, this matters because multi-site studies routinely transfer participant data across borders to sponsors, CROs, and data processors outside the US. Importantly, even when a sponsor determines that federal thresholds are not met, a clinical site hosted by a US academic institution may still require its own internal export control review before any data transfer to a country of concern can proceed.