DOJ’s Data Security Program limits giving countries of concern access to Americans’ bulk sensitive personal data

The Justice Department’s Data Security Program, in effect since April 8, 2025, prohibits or restricts transactions that give six countries of concern and covered persons access to government-related data or Americans’ bulk sensitive personal data, such as biometric, geolocation, health and financial data above set thresholds.

Source facts

The Justice Department’s Data Security Program page says the program went into effect on April 8, 2025 and establishes what are effectively export controls that prohibit or restrict countries of concern and covered persons from transactions that give them access to government-related data or Americans’ bulk sensitive personal data; its binding rules are in 28 CFR part 202. The FAQ names China, Iran, North Korea, Russia, Venezuela and Cuba as countries of concern, and the compliance guide says due diligence, audit and reporting duties started October 6, 2025.

Sensitive personal data includes covered personal identifiers, precise geolocation data, biometric identifiers and personal health and financial data, and it counts regardless of whether it is anonymized, pseudonymized, de-identified or encrypted. The FAQ’s bulk thresholds include 1,000 U.S. persons for biometric identifiers, 1,000 U.S. devices for precise geolocation data, 10,000 U.S. persons for health or financial data and 100,000 U.S. persons for covered personal identifiers, measured over the preceding twelve months.

Data brokerage with a country of concern or covered person is prohibited. Vendor, employment and investment agreements with them are restricted transactions, allowed only with CISA’s security requirements, a written data compliance program, audits and records kept for at least ten years, and covered persons include foreign entities headquartered in a country of concern or 50% or more owned by one.

Applicability

Use this for organizations subject to U.S. jurisdiction. The program has exemptions and licenses, and DOJ says its guidance does not change the regulation itself, so confirm specific transactions with counsel.

DSE recommendation

DSE recommends mapping where bulk personal data is stored and who can reach it, then screening data buyers and vendors against the program’s countries of concern and covered persons. Include biometric templates, location histories and customer databases, record vendor headquarters and ownership, add resale prohibitions to data-sharing contracts, and send any possible restricted transaction to counsel before signing.

Verification

Keep a register of vendors and data recipients with the data categories, approximate volumes, ownership and screening date, and review it yearly and before each new data-sharing agreement.

Official references

U.S. Department of Justice, National Security Division — Data Security. U.S. Department of Justice — Data Security Program: Compliance Guide (April 11, 2025). U.S. Department of Justice — Data Security Program: Frequently Asked Questions (September 24, 2025). Reviewed October 19, 2026.