DOJ Data Security Program: Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons

This regulation bars U.S. persons from data brokerage and genomic-data transactions that give countries of concern or covered persons access to bulk sensitive personal data or government-related data. Other vendor, employment, and investment transactions are allowed only if CISA security requirements are met. Bulk thresholds range from 100 persons (genomic data) to 100,000 persons (covered identifiers); due diligence, audit, and reporting duties began October 6, 2025.