# DOJ’s Data Security Program limits giving countries of concern access to Americans’ bulk sensitive personal data > The Justice Department’s Data Security Program, in effect since April 8, 2025, prohibits or restricts transactions that give six countries of concern and covered persons access to government-related data or Americans’ bulk sensitive personal data, such as biometric, geolocation, health and financial data above set thresholds. - Canonical URL: https://update.dsesecurity.com/updates/doj-data-security-program-28-cfr-202-bulk-sensitive-personal-data-countries-of-concern/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:27:52+00:00 - Modified: 2026-10-19T01:55:07+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Explainer - DSE priority: Important - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know The Justice Department’s Data Security Program, in effect since April 8, 2025, prohibits or restricts transactions that give six countries of concern and covered persons access to government-related data or Americans’ bulk sensitive personal data, such as biometric, geolocation, health and financial data above set thresholds. ## Potentially affected Organizations that hold large volumes of personal data, including biometric access-control templates, location data and customer records, and that sell data or give vendors, employees or investors access to it. ## DSE recommendation DSE recommends mapping where bulk personal data is stored and who can reach it, then screening data buyers and vendors against the program’s countries of concern and covered persons. ## Article The Justice Department’s Data Security Program, in effect since April 8, 2025, prohibits or restricts transactions that give six countries of concern and covered persons access to government-related data or Americans’ bulk sensitive personal data, such as biometric, geolocation, health and financial data above set thresholds. ## Source facts The Justice Department’s [Data Security Program page](https://www.justice.gov/nsd/data-security) says the program went into effect on April 8, 2025 and establishes what are effectively export controls that prohibit or restrict countries of concern and covered persons from transactions that give them access to government-related data or Americans’ bulk sensitive personal data; its binding rules are in 28 CFR part 202. The [FAQ](https://www.justice.gov/nsd/media/1415006/dl) names China, Iran, North Korea, Russia, Venezuela and Cuba as countries of concern, and the [compliance guide](https://www.justice.gov/opa/media/1396356/dl) says due diligence, audit and reporting duties started October 6, 2025. Sensitive personal data includes covered personal identifiers, precise geolocation data, biometric identifiers and personal health and financial data, and it counts regardless of whether it is anonymized, pseudonymized, de-identified or encrypted. The FAQ’s bulk thresholds include 1,000 U.S. persons for biometric identifiers, 1,000 U.S. devices for precise geolocation data, 10,000 U.S. persons for health or financial data and 100,000 U.S. persons for covered personal identifiers, measured over the preceding twelve months. Data brokerage with a country of concern or covered person is prohibited. Vendor, employment and investment agreements with them are restricted transactions, allowed only with CISA’s security requirements, a written data compliance program, audits and records kept for at least ten years, and covered persons include foreign entities headquartered in a country of concern or 50% or more owned by one. ## Applicability Use this for organizations subject to U.S. jurisdiction. The program has exemptions and licenses, and DOJ says its guidance does not change the regulation itself, so confirm specific transactions with counsel. ## DSE recommendation DSE recommends mapping where bulk personal data is stored and who can reach it, then screening data buyers and vendors against the program’s countries of concern and covered persons. Include biometric templates, location histories and customer databases, record vendor headquarters and ownership, add resale prohibitions to data-sharing contracts, and send any possible restricted transaction to counsel before signing. ## Verification Keep a register of vendors and data recipients with the data categories, approximate volumes, ownership and screening date, and review it yearly and before each new data-sharing agreement. ## Official references [U.S. Department of Justice, National Security Division — Data Security](https://www.justice.gov/nsd/data-security). [U.S. Department of Justice — Data Security Program: Compliance Guide (April 11, 2025)](https://www.justice.gov/opa/media/1396356/dl). [U.S. Department of Justice — Data Security Program: Frequently Asked Questions (September 24, 2025)](https://www.justice.gov/nsd/media/1415006/dl). Reviewed October 19, 2026. ## Primary reference - Name: U.S. Department of Justice, National Security Division — Data Security - Authority: www.justice.gov - URL: https://www.justice.gov/nsd/data-security - Source publication date: Not stated by the source ## Citation and use Preferred citation: “DOJ’s Data Security Program limits giving countries of concern access to Americans’ bulk sensitive personal data,” DSE Security, https://update.dsesecurity.com/updates/doj-data-security-program-28-cfr-202-bulk-sensitive-personal-data-countries-of-concern/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.