The question you're really asking is: "Do reviewers actually care about data and code being distributed with papers?". If I saw a "promise" to distribute those kinds of resources as a reviewer, I'd understand that those resources will not be distributed if I give a positive review. The promise is immaterial to this assessment-- the content is simply missing.
Not including essential data is quite a risk, I think. I've seldom heard of this being omitted. Code seems more variable by field.
You don't say exactly why you want to hold back this data and code. Perhaps you're paranoid about plagiarism, but that's deeply unlikely to happen via reviews at a reputable journal.
Perhaps you're worried that your code isn't currently as presentable as you'd like it to be, but don't want improvements to hold up starting the review process. My recommendation there: Make a "frozen" version of your code and data that you won't be modifying during the review, then send it off. Make any improvements you'd like in a different instance of the project, and you can link to this software in the final paper version if it's accepted. If you don't want the versions you give to reviewers distributed widely, host them via some reasonably private hosting service and maybe mention this wish in your cover letter with the submission. If you're a field which does double-blind submissions, perhaps you can distribute a copy to the appropriate editor for them to anonymize when they allow reviewers access.
