Abstract States are using legislation to regulate cross-border data transfer, which has raised new concerns that international investment agreements (IIAs) may be used to protect foreign investment. According to current IIA texts and arbitration practices, some data is likely to be regarded as ‘investment’, but indefinite data ownership and invisibility ‘in the territory’ make use traditional IIA structures to regulate cross-border data transfer uncertain. What IIAs can contribute to regulating cross-border data transfer has a significant impact on the protection of foreign investments. IIAs need to be reformed to keep their vitality in the face of the challenges brought by digital technology. As a response, they can clarify essential concepts, including when is data an ‘investment’ and who is the ‘investor’ that is entitled to bring claims. Considering the distinct data realms, IIA reform is more likely to be initiated through bilateral or regional negotiations among States with similar cultures or complementary interests.