U.S. Congress moves on data center NDA bill

The U.S. House of Representatives received H.R.10118, the No Data Center NDAs Act, on Aug. 20, 2026. Sponsored by Rep. Tom Barrett, the bill would prohibit members of Congress from signing certain confidentiality agreements tied to data centers and was referred the same day to the House Committee on House Administration.

What changes for data centers?

The bill seeks to limit nondisclosure agreements around decisions involving water- and energy-intensive digital infrastructure. According to the text filed on Congress.gov, its scope covers investments, site selection, construction designs, and data on water or energy consumption. Reporting by The Detroit News added that Barrett is also backing a separate proposal to bar federal preemption over zoning, siting, permitting, and land use for data centers.

What is moving in the Senate on water?

The Water Cyber Shield Act of 2026 was introduced in August by federal lawmakers, including Amy Klobuchar and Adam Schiff, and would expand federal oversight of cybersecurity in drinking water and wastewater systems. ESE Magazine reported that the measure would give the EPA explicit authority to conduct cybersecurity assessments, require corrective action for significant vulnerabilities, and set tiered standards together with CISA, NIST, states, and industry stakeholders.

What new obligations does it propose?

The S.5368 measure, introduced by Sen. Adam B. Schiff, would require drinking water and wastewater operators to identify and reduce cyber risks. Quiver Quantitative added that the text would require cyber risk assessments updated at least every five years, while Slate said the bill would amend the Safe Drinking Water Act and the Clean Water Act to give the EPA enforcement tools and a sector baseline.

How would water cybersecurity be funded?

The Water Cyber Shield Act authorizes an additional $300 million a year for each state drinking water and wastewater revolving fund, to be used for cybersecurity upgrades, according to ESE Magazine. The same coverage said the bill would extend federal cyber incident reporting requirements to state and local systems that were previously exempt, and would allow states with sufficient capacity to take primary enforcement authority, with EPA oversight where states do not.

What is the broader legislative context?

Plural Policy described an active stretch in early to mid-August 2026 of federal and state bills on privacy and data protection, including initiatives in California and at least one federal transparency proposal, even though no comprehensive federal privacy framework exists yet. That backdrop sits alongside sector-specific bills on water and data centers, which could affect Latin American subsidiaries of essential service operators and companies subject to cross-border privacy rules.