a transaction involving the user) or information needed to decipher that data provided that the transfer and any storage necessary to enact the transfer is conducted solely to carry out the user’s intent to share such data with individual users in other countries and that necessary storage occurs only on the intended recipient's individual device. (c) Effective date The requirements of this section shall take effect 90 days after the date of enactment of this Act. 4. Data security requirements for other technology companies (a) In general The following requirements shall apply to any company operating in or affecting interstate or foreign commerce that provides a data-based service such as a website or internet application but is not a covered technology company: (1) Prohibition on transfer to countries of concern The company shall not transfer any user data collected from an individual in the United States or information needed to decipher that data, such as encryption keys, to any country of concern (including indirectly through a third country that is not a country of concern). (2) Prohibition on storing data in countries of concern The company shall not store any user data collected from an individual in the United States or information needed to decipher that data, such as encryption keys, on a server or other data storage device that is located in any country of concern. (b) Exceptions (1) Exception for law enforcement and military The requirements of subsection (a) shall not apply where data is collected, used, retained, stored, or shared by a covered technology company solely for the purpose of assisting a law enforcement or military agency that is not affiliated with a country of concern. (2) Transfer of shared content The requirements of subsection (a) shall not apply to user data that is content produced by a user for the purpose of sharing with other users (such as social media posts, emails, or data related to a transaction involving the user) or information needed to decipher that data provided