Between late January and mid-February 2025, regulatory responses to DeepSeek appeared in several jurisdictions in quick succession. They were not aimed at model capability. They concentrated on two dimensions — data handling and national security — which together map the two thresholds a generative AI product faces when it goes overseas.
The data compliance questions
Italy’s data protection authority opened an investigation in late January, asking for the sources of data, the purposes of collection, the legal basis and where data is stored. It then issued an order blocking the service, effective immediately, on the ground that the answers were insufficient. South Korea acted in mid-February: app stores restricted downloads, several government departments and the police blocked access on office devices, and the company was asked to explain its handling of user data in more detail.
The common thread is that regulators asked where data comes from, where it is stored and on what basis. For companies going overseas, these three questions map onto lawful data sourcing, storage location and cross-border transfer, and the legal basis for processing. See our notes on data export policy questions and on obligations of major personal information processors.
The national security track
Running alongside data compliance is government-device and supply-chain security review. On 4 February Australia’s Department of Home Affairs issued a direction under its protective security policy framework, banning the use of the products, applications and network services in government entities and in projects receiving government funding. This path brings generative AI applications into routine government-device and procurement security review.
The combined effect is that a public-facing AI product may simultaneously trigger a data protection investigation and a national security device restriction, and the two do not follow the same logic. See our notes on simplified measures for small processors and on EDPB coordinated enforcement.
Room that overseas companies can reserve
A few practical points follow from this round. First, prepare the data-handling explanation as a document that can be submitted on demand, covering sources, legal basis, storage location and retention. Second, separate “public-facing product” from “government or funded projects”, since the second has clearly higher entry requirements.
Third, build an event-response mechanism that runs across jurisdictions in parallel. Different countries may issue instructions of different character at the same time, and the data track and the security track need to advance together rather than one after the other. See our notes on the Australian government-device ban.
The difficulty in overseas compliance is not any single rule but standing up a product in several jurisdictions whose logics run in parallel.
This article is based on public information from Italy’s data protection authority, relevant Korean authorities and Australia’s Department of Home Affairs, together with media reports, and is for reference only; it does not constitute legal advice.