Tracker record · Federal · Final rule
DOJ Data Security Program (28 CFR Part 202)
Final rule implementing Executive Order 14117, effective April 8, 2025, restricting access by countries of concern and covered persons to U.S. data. The rule uses a defined category, 'government-related data,' distinct from bulk U.S. sensitive personal data: it covers (1) precise geolocation data, regardless of volume, within geofenced areas on the Government-Related Location Data List (28 CFR 202.1401), and (2) sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors, or former senior officials, of the U.S. Government, including the military and intelligence community. No bulk threshold applies to government-related data. A 'covered data transaction' (28 CFR 202.210) is any transaction giving a country of concern or covered person access to government-related data or bulk U.S. sensitive personal data through (1) data brokerage, (2) a vendor agreement, (3) an employment agreement, or (4) an investment agreement. 'Covered persons' (28 CFR 202.211) include specified foreign entities with at least 50 percent direct or indirect ownership by countries of concern or other covered persons, foreign entities organized or principally based in a country of concern, foreign individuals employed by or contracting for specified covered entities or countries of concern, foreign individuals primarily resident in a country of concern, and any person designated by the Attorney General under the rule. Prohibited transactions include data brokerage with countries of concern or covered persons; transactions enabling circumvention; and, under 28 CFR 202.303, covered data transactions with a country of concern or covered person involving access to bulk human 'omic data or human biospecimens from which bulk human 'omic data could be derived, which compliance with restricted-transaction security requirements does not authorize. Restricted transactions (vendor, employment, and investment agreements) must comply with CISA security requirements. Exemptions apply only within their particular regulatory conditions: personal communications that do not involve the transfer of anything of value (28 CFR 202.501); corporate group transactions between a U.S. person and its subsidiary or affiliate in or controlled by a country of concern, only to the extent ordinarily incident to and part of administrative or ancillary business operations (202.506); transactions required or authorized by federal law or an international agreement, or ordinarily incident to and part of ensuring compliance with federal law (202.507); investment agreements subject to a CFIUS action (202.508); telecommunications services other than data brokerage, only to the extent ordinarily incident to and part of providing those services (202.509); financial services transactions only to the extent ordinarily incident to and part of providing financial services (202.505); drug, biological product, and medical device regulatory-approval data limited to de-identified or pseudonymized sensitive personal data reasonably necessary for the regulatory entity to assess safety and effectiveness, with recordkeeping and reporting compliance required (202.510); and clinical-investigation and post-marketing surveillance data ordinarily incident to and part of FDA-regulated clinical investigations or the collection or processing of real-world performance or safety data to support or maintain FDA authorization, with data de-identified or pseudonymized (202.511). Civil penalties under 28 CFR 202.1301 may not exceed the greater of $368,136 or twice the transaction amount, subject to applicable inflation adjustments; willful violations carry criminal penalties.
Status
- Legal status
- In effect (Effective April 8, 2025; due-diligence, audit, and reporting duties October 6, 2025; civil penalty under 28 CFR 202.1301: greater of $368,136 or twice the transaction amount, subject to applicable inflation adjustments)
- Allegation or finding
- Operative law
- Applicability
- U.S. persons engaging in data brokerage, vendor, employment, or investment transactions giving countries of concern or covered persons access to government-related data or bulk U.S. sensitive personal data
- Enforceability
- Binding on U.S. persons within scope
- Law checked through
- October 12, 2026
- Primary-source pinpoint
- 28 C.F.R. part 202
- Citation
- 28 C.F.R. part 202
- Source
- 28 C.F.R. part 202