Insight
Why Foreign Vendor Access Belongs in the Data Map
How vendor access, recipient status, and data volume affect distinct foreign-data regimes.
Most data maps record where data is stored. The newest federal rules care more about who can reach it. A vendor's engineer in Shanghai who can log in to a U.S. database may trigger the same rule as a file shipped overseas. A map that leaves out access leaves out the question regulators now ask.
The DOJ data security program
The Justice Department's rule, 28 C.F.R. part 202, took effect April 8, 2025. Its due-diligence, audit, and reporting duties became enforceable on October 6, 2025. It regulates transactions that give countries of concern or covered persons access to bulk U.S. sensitive personal data or government-related data. The countries of concern are China, Cuba, Iran, North Korea, Russia, and Venezuela.
The rule turns on volume, and the thresholds are strictly "more than" the stated quantities, measured over the preceding 12 months:
| Data category | Bulk threshold under §202.205 |
|---|---|
| Human genomic data | More than 100 U.S. persons |
| Other human 'omic data | More than 1,000 U.S. persons |
| Biometric identifiers | More than 1,000 U.S. persons |
| Precise geolocation | More than 1,000 U.S. devices |
| Personal health data | More than 10,000 U.S. persons |
| Personal financial data | More than 10,000 U.S. persons |
| Covered personal identifiers | More than 100,000 U.S. persons |
Section 202.205(g) adds an aggregation and combined-category rule: exactly 100 persons' genomic data does not exceed the single-category genomic threshold, but a government-related-data classification or another applicable rule can still matter. Government-related data is a separately defined category without a bulk-volume prerequisite, not a loose synonym for anything involving government.
Data brokerage with a country of concern or covered person is largely prohibited. Restricted transactions must meet §202.401's conditions, including the security requirements defined in §202.248 and the other applicable requirements of Part 202. These include due diligence and audits under §§202.1001-1002 and applicable recordkeeping, reporting, exemption, and licensing provisions. A service-contract label does not override an otherwise applicable prohibition. Section 202.1301 states a maximum civil penalty of the greater of $368,136 or twice the amount of the transaction underlying the violation. The dollar amount is subject to applicable inflation adjustments (§202.1301).
PADFAA
The Protecting Americans' Data from Foreign Adversaries Act of 2024 is narrower and blunter. It bars data brokers from selling or otherwise making available sensitive data about U.S. individuals to a foreign adversary country or an entity it controls (15 U.S.C. §9901). It has no volume threshold. The FTC enforces it.
Different regimes, different questions
| Regime | Question for the relationship |
|---|---|
| DOJ program | Does a covered transaction enable access to bulk U.S. sensitive personal data or government-related data by a country of concern or covered person? |
| PADFAA | Is a covered data broker making covered sensitive data available to a prohibited foreign-adversary recipient? |
| CFIUS | Is there a covered investment or control transaction involving a covered U.S. business and relevant data or access rights? |
| Texas SB 1188 | Do covered record storage, authorized access, and safeguards meet §183.002? |
| Texas Genomic Act | Do the particular entity, data, sequencing, storage, access, and transfer facts trigger Chapter 174's restrictions? |
A single vendor relationship can raise all five. Compliance with one does not satisfy the others. An ordinary vendor service contract alone does not trigger CFIUS; the question is whether there is a covered investment or control transaction.
What the data map should record
For each system holding sensitive data, add four facts to the map:
- Which vendors, subprocessors, and affiliates can access it, and from which countries.
- Whether any of them meets the actual covered-person or control definitions: ownership, organization, or residency tied to a country of concern, not an unspecified "foreign-owned" label.
- Whether access is for storage, support, development, or analytics.
- Volume by data type, counted over 12 months, against the DOJ thresholds.
Those facts let counsel decide which regime applies.
Sources
- 28 C.F.R. part 202 (DOJ data security program; §§202.205, 202.401)
- DOJ National Security Division, Data Security (agency guidance)
- PADFAA, 15 U.S.C. §9901
- Tex. Health & Safety Code §183.002
- 31 C.F.R. part 800 (CFIUS regulations on certain investments in the United States by foreign persons)
- Tex. Health & Safety Code ch. 174 (Texas Genomic Act)