Recently enacted federal guidelines involving some data transactions outside of the United States could put companies large and small at legal risk.