What Is
What Is the DOJ Data Security Program
The Data Security Program is a Justice Department rule, 28 C.F.R. part 202, issued under Executive Order 14117 and the International Emergency Economic Powers Act. It took effect April 8, 2025. Its specified due-diligence, audit, and reporting duties took effect October 6, 2025. It regulates transactions that give a country of concern, or a covered person linked to one, access to bulk U.S. sensitive personal data or to government-related data. The countries of concern are China, Cuba, Iran, North Korea, Russia, and Venezuela.
A 'covered data transaction' (28 C.F.R. 202.210) is any transaction giving a country of concern or covered person access to government-related data or bulk U.S. sensitive personal data through data brokerage, a vendor agreement, an employment agreement, or an investment agreement. Covered persons include specified foreign entities with at least 50 percent direct or indirect ownership by countries of concern or other covered persons, foreign entities organized or principally based in a country of concern, foreign individuals employed by or contracting for specified covered entities or countries of concern, foreign individuals primarily resident in a country of concern, and any person designated by the Attorney General under the rule (28 C.F.R. 202.211).
Bulk thresholds are measured at any point in the preceding 12 months, for a single transaction or transactions aggregated between the same U.S. person and the same foreign or covered person. The thresholds are:
- human genomic data: more than 100 U.S. persons;
- biometric identifiers: more than 1,000 U.S. persons;
- other human 'omic data: more than 1,000 U.S. persons;
- precise geolocation data: more than 1,000 U.S. devices;
- personal health data: more than 10,000 U.S. persons;
- personal financial data: more than 10,000 U.S. persons; and
- covered personal identifiers: more than 100,000 U.S. persons.
Combined data is subject to the rule's lowest-applicable-threshold test (28 C.F.R. 202.205(h)).
Government-related data is a separate defined category and is covered at any volume. It includes precise geolocation data within geofenced areas on the Government-Related Location Data List and sensitive personal data a party markets as linked or linkable to current or recent former employees or contractors, or former senior officials, of the U.S. government (28 C.F.R. 202.222; location list at 202.1401).
Data brokerage with a country of concern or covered person is largely prohibited, as are transactions enabling circumvention and, under 28 C.F.R. 202.303, covered data transactions involving bulk human 'omic data or human biospecimens from which bulk human 'omic data could be derived. Vendor, employment, and investment agreements are restricted: they are allowed only if the U.S. party meets security requirements set by the Cybersecurity and Infrastructure Security Agency, along with the rule's due-diligence, audit, and recordkeeping duties. Meeting the restricted-transaction security requirements does not authorize a prohibited bulk human-omic or biospecimen transaction under section 202.303.
Exemptions apply only within their own regulatory conditions, including personal communications that do not involve the transfer of anything of value (28 C.F.R. 202.501), transactions ordinarily incident to providing telecommunications or financial services (28 C.F.R. 202.509, 202.505), and limited regulatory-approval data for drugs, biological products, and medical devices (28 C.F.R. 202.510). Civil penalties under 28 C.F.R. 202.1301 may not exceed the greater of $368,136 or twice the amount of the transaction that is the basis of the violation, subject to adjustment under the Federal Civil Penalties Inflation Adjustment Act. Willful violations are crimes.
Why it matters in Texas. Texas has added its own foreign-access rules that work alongside this one. The Texas Genomic Act bars storing Texans' genomic data in, or allowing access from, foreign adversary countries, but exempts research data already covered by 28 C.F.R. part 202; SB 1188 requires electronic health records to be stored in the United States. A single vendor contract can trigger all three regimes, and compliance with one does not satisfy the others.
Pinpoint: 28 C.F.R. part 202.