On April 8, 2025, key parts of the United States Department of Justice (“DOJ”) “Provisions Pertaining to Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons” (the “Data Security Program” or “DSP”) Final Rule¹ entered into force. The DSP establishes what are effectively export controls intended to prevent foreign adversaries, and those subject to their control and direction, from accessing US Government-related data and bulk US sensitive personal data by prohibiting “covered data transactions” to identified “Countries of Concern” or “Covered Persons.”² Although the DSP Final Rule uses the terms “bulk” and “sensitive” data, in practice the rule applies to an incredibly broad swath of data transfers. It may cover, for example, a data set of human genomic data of more than 100 persons, or the MAC and IP addresses of more than 100,000 persons.

The DSP is a unique addition to the patchwork of US data governance laws because it applies to even anonymized/deidentified data,³ does not contain a consent exception,⁴ and imposes additional compliance obligations on covered data access by all non-US persons, meaning that there are now legal requirements that must be met to engage in nearly any extra-territorial data transfer.

Although the bulk of the rule is currently in effect, some compliance obligations are delayed until October 6, 2025.⁵ Additionally, the DOJ guidance states that it will not prioritize enforcing violations of the DSP for an additional 90 days from April 8 if the company is acting in good faith to comply.⁶

Introduction

The DOJ National Security Division (“NSD”) DSP Final Rule prohibits or otherwise restricts certain “covered data transactions” to “Countries of Concern” identified as China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela. A “covered data transaction” is any transaction that involves any access by a Country of Concern or Covered Person to any “government-related data”⁷ or “bulk U.S. sensitive personal data”⁸ and that involves: (1) a data brokerage agreement;⁹ (2) a vendor agreement;¹⁰ (3) an employment agreement;¹¹ or (4) an investment agreement.¹²

Nearly all data transfers to non-US jurisdictions are subject to new rules

As a result of the DSP Final Rule, nearly all extra-territorial data transfers fall into one of three tranches: “regulated,” restricted, and prohibited.

The “regulated” category is not found in the text of the DSP Final Rule; rather, it is a recognition that the DSP Final Rule introduces compliance obligations for a data brokerage agreement involving the transfer of government-related data or bulk US sensitive personal data to any foreign person under 28 CFR § 202.302.

“Restricted” transactions differ from “prohibited” transactions as prohibited transactions involve a covered data transaction pursuant to a data brokerage agreement,¹³ while restricted transactions involve covered data transactions pursuant to vendor agreements, employment agreements, or investment agreements.¹⁴

US persons engaging in any restricted transactions must comply with: (1) the security requirements promulgated by CISA¹⁵; (2) certain Data Compliance Program development and implementation requirements¹⁶ ; (3) specific audit requirements¹⁷; and (4) recordkeeping requirements.¹⁸  

Key takeaways

Pursue ‘good-faith efforts’ for compliance

The DOJ has indicated that compliance with the DSP Final Rule may require “revising or creating new internal policies and processes, identifying data flows, changing vendors or suppliers, adjusting employee roles or responsibilities, deploying new security requirements, and revising existing contracts.”¹⁹ Although enforcement of the DSP Final Rule has been generally delayed until July 8, 2025, DOJ has made clear that it will “pursue penalties and other enforcement actions as appropriate for egregious, willful violations,” particularly where the US Person “did not engage in good-faith efforts to comply with, or come into compliance with, the DSP [Final Rule].”²⁰

The enforcement policy statement enumerates many examples of conduct that constitute evidence of good-faith compliance efforts, including (1) negotiation (or renegotiation) of vendor agreements for compliance with the DSP Final Rule; (2) conducting due diligence on vendors; and (3) review of datasets to determine if they are subject to the DSP Final Rule

Update data processing addenda

The DSP imposes additional obligations prior to the transfer of bulk US sensitive personal data or US Government-related data as part of a data-brokerage agreement to any foreign person, not just “Covered Persons” or “Countries of Concern.”

Under § 202.302, unless exempt or otherwise authorized by a general or specific license, US persons may not knowingly engage in a data transaction involving data brokerage with a foreign person (who are not covered persons) unless the US person:

1. Contractually requires that the foreign person refrain from engaging in a subsequent covered data transaction involving data brokerage of the same data with a country of concern or covered person; and
2. Reports any known or suspected violations of this contractual requirement in accordance with § 202.302(b).²¹

Although the DSP uses the term “bulk U.S. sensitive personal data” to describe “regulated” datasets, in practice, many types of data not traditionally considered sensitive are covered, even Media Access Control (“MAC”) addresses, IP addresses, mobile advertising ID (“MAID”), and demographic information.²²

US businesses should carefully review the DSP Final Rule as well as the proposed contractual terms in the DOJ Data Security Program Compliance Guide to update existing contracts, including Data Protection Addenda.

Review tracking technologies deployed on websites and apps

The DSP Final Rule’s expansive definition of “data broker”²³ means that any company deploying online tracking technologies may qualify as a “data broker.”²⁴ The Compliance Guide states:

"Some activities that may not be thought of in ordinary parlance as data brokerage may nonetheless constitute data brokerage under the DSP, such as a U.S. company maintaining a website or mobile application that contains ads with tracking pixels or software development kits that were knowingly installed or approved for incorporation into the app or website by the U.S. company. That transfer or provision of access to government-related or bulk U.S. sensitive personal data to covered persons or countries of concern could constitute data brokerage and could be a violation of the DSP."²⁵

US businesses should carefully review the tracking technologies they have deployed on their websites and determine whether any particular tracking technology may be supplied by a Covered Person, or an entity the US Government is reasonably likely to consider a Covered Person.²⁶

Update procurement policies and procedures to implement DSP Final Rule requirements

The DSP Final Rule requires US persons engaging in restricted transactions to implement a Data Compliance Program to develop, implement, and routinely update policies and procedures to conduct individualized, risk-based due diligence prior to conducting a restricted transaction. The due diligence must include risk-based procedures for verifying data flows involved in any restricted transaction²⁷ and verifying the identity of vendors.²⁸

As part of the third-party risk management and procurement process, businesses should adopt additional due diligence policies and procedures to verify that a recipient is not a Covered Person.

However, even if a business is only engaging in “regulated,” as opposed to restricted, transactions, the DSP Final Rule creates additional compliance obligations. The Compliance Guide states:

"U.S. persons engaged in these kinds of data brokerage transactions with non-covered foreign persons and third countries should not simply shift responsibility to or entirely rely on the contractual provisions or on their foreign counterparties to comply with these contractual provisions. Instead, as the Notice of Proposed Rulemaking explains, consistent with the overall approach to compliance and enforcement under the DSP, NSD expects U.S. persons engaged in these kinds of data brokerage transactions to take reasonable steps to evaluate whether their foreign counterparties are complying with the contractual provision as part of implementing risk-based compliance programs under the proposed rule." (emphasis added).²⁹

Importantly, the DOJ rejected creating a “safe harbor” in the DSP Final Rule, instead including a knowledge requirement to encourage businesses to conduct due diligence as a defense against violation in the event they are deceived about a foreign adversary’s ownership or control of a customer company.³⁰

Update Record of Processing Activities (RoPA) Procedure to identify potential covered data transactions

The DSP does not address purely domestic data transactions between US persons—such as the collection, maintenance, processing, or use of data by US persons within the United States—except to the extent that such US persons are designated as covered persons.³¹ Therefore, “covered data transactions” will only involve disclosures to non-US entities.

As indicated above, the definition of “sensitive personal data” is broad enough to include many disclosures of personal data that some may assume would be outside the scope of the rule, and the thresholds to be considered a “bulk” transfer (e.g. 100,000 US persons for “covered personal identifiers”) are low enough to cause a compliance burden on many organizations.

US companies should (1) identify all “sensitive” personal data being disclosed to non-US persons; (2) implement risk-based procedures for verifying the identity of vendors to determine whether they may be “covered persons,” particularly as the covered persons list is updated; (3) determine whether the transfer would be a “prohibited” or “restricted” transaction; and (4) either suspend access to the “sensitive” personal information or update contracts as necessary.

Conclusion

The DSP Final Rule imposes significant compliance obligations on many extra-territorial data transfers. Businesses must carefully review their data flows and implement compliance programs to avoid violations. As the enforcement date approaches, companies should prioritize updating their data maps, data access controls, and relevant contracts to ensure compliance.

1. 90 FR 1636, codified at 28 CFR Part 202. ↩
2. The five categories of covered persons are defined in 28 CFR § 202.211(a).↩
3. 28 CFR § 202.206 “The term bulk U.S. sensitive personal data means a collection or set of sensitive personal data relating to U.S. persons, in any format, regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted, where such data meets or exceeds the applicable threshold set forth in § 202.205,” (emphasis added). ↩
4. Department of Justice National Security Division, “Data Security Program Frequently Asked Questions” pg. 8 (available at https://www.justice.gov/opa/media/1396351/dl), last accessed May 7, 2025.↩
5. Those provisions with delayed enforcement include subpart J (related to due diligence and audit requirements for restricted transactions), § 202.1103 (related to reporting requirements for certain restricted transactions), and 28 CFR § 202.1104 (related to reports on rejected prohibited transactions). ↩
6. Department of Justice National Security Division, “Data Security Program: implementation and Enforcement Policy Through July 8, 2025, (available at https://www.justice.gov/opa/media/1396346/dl?inline), last accessed May 7, 2025.↩
7. There are two types of government-related data. The first is any precise geolocation data, regardless of volume, for any location within any area enumerated on the Government-Related Location Data List in § 202.1401. Examples of such locations can be found at § 202.222(a)(1). The second type of government-related data is any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors, or former senior officials, of the United States Government, including the military and Intelligence Community. ↩
8. The term “sensitive personal data” means covered personal identifiers, precise geolocation data, biometric identifiers, human omic data, personal health data, personal financial data, or any combination thereof. ↩
9. 28 CFR § 202.214. ↩
10. 28 CFR § 202.258. ↩
11. 28 CFR § 202.217.↩
12. 28 CFR § 202.228. ↩
13. Under § 202.243, the term “prohibited transaction” means a data transaction that is subject to one or more of the prohibitions described in DSP subpart C. The prohibited transactions described in §§ 202.301 – 202.302 involve covered data transactions that involve data brokerage. The prohibitions involving data brokerage in subpart C apply to the sale or licensing of access to data, or similar commercial transactions, involving the transfer of data from any person (the provider) to any other person (the recipient), where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data. ↩
14. Under § 202.246, the term “restricted transaction” means a transaction subject to the restrictions in subpart D. US persons are prohibited from knowingly engaging in a covered data transaction involving a vendor agreement, employment agreement, or investment agreement with a Country of Concern or Covered Person. ↩
15. 28 CFR § 202.248 ↩
16. 28 CFR § 202.1001 ↩
17. 28 CFR § 202.1002↩
18. 28 CFR §§ 202.1101–1104 ↩
19. Department of Justice National Security Division, “Data Security Program: Implementation and Enforcement Policy Through July 8, 2025,” pg. 2 (available at https://www.justice.gov/opa/media/1396346/dl?inline), last accessed May 19, 2025. ↩
20. Ibid. ↩
21. 28 CFR § 202.302(a). ↩
22. 28 CFR § 202.249 defines "sensitive personal data" as "covered personal identifiers, precise geolocation data, biometric identifiers, human ‘omic data, personal health data, personal financial data, or any combination thereof,” (emphasis added). 28 CFR § 202.212(a) defines "covered personal identifiers" as "any listed identifier: (1) In combination with any other listed identifier; or (2) In combination with other data that is disclosed by a transacting party pursuant to the transaction such that the listed identifier is linked or linkable to other listed identifiers or to other sensitive personal data,” (emphasis added). Finally, 8 CFR § 202.234 defines listed identifier as: (a) Full or truncated government identification or account number (such as a Social Security number, driver's license or State identification number, passport number, or Alien Registration Number); (b) Full financial account numbers or personal identification numbers associated with a financial institution or financial-services company; (c) Device-based or hardware-based identifier (such as International Mobile Equipment Identity (“IMEI”), Media Access Control (“MAC”) address, or Subscriber Identity Module (“SIM”) card number); (d) Demographic or contact data (such as first and last name, birth date, birthplace, ZIP code, residential street or postal address, phone number, email address, or similar public account identifiers); (e) Advertising identifier (such as Google Advertising ID, Apple ID for Advertisers, or other mobile advertising ID (“MAID”)); (f) Account-authentication data (such as account username, account password, or an answer to security questions); (g) Network-based identifier (such as Internet Protocol (“IP”) address or cookie data); or (h) Call-detail data (such as Customer Proprietary Network Information (“CPNI”)). ↩
23. 28 CFR § 202.214(a) “The term data brokerage means the sale of data, licensing of access to data, or similar commercial transactions, excluding an employment agreement, investment agreement, or a vendor agreement, involving the transfer of data from any person (the provider) to any other person (the recipient), where the recipient did not collect or process the data directly from the individuals linked or linkable to the collected or processed data.” ↩
24. 28 CFR 202.214(7) “Example 7. A U,S. company owns or operates a mobile app or website for U.S. users. That mobile app or website contains one or more tracking pixels or software development kits that were knowingly installed or approved for incorporation into the app or website by the U.S. company. The tracking pixels or software development kits transfer or otherwise provide access to government-related data or bulk U.S. sensitive personal data to a country of concern or covered person-owned social media app for targeted advertising. The U.S. company engages in prohibited data brokerage.” ↩
25. Department of Justice, National Security Division “Data Security Program: Compliance Guide,” pg. 5. ↩
26. The Final Rule states, “According to the FBI, ‘[h]ybrid [c]ommercial [t]hreats are businesses whose legitimate commercial activity can facilitate foreign government access to U.S. data, critical infrastructure, and emerging technologies that enable adversaries to conduct espionage, technology transfer, data collection, and other disruptive activities under the disguise of an otherwise legitimate commercial activity,” quoting In Camera, Ex Parte Classified Decl. of Kevin Vorndran, Assistant Dir., Counterintel. Div., Fed. Bureau of Invest., Doc. No. 2066897 at Gov't App. 33 ¶ 6, TikTok Inc. v. Garland, Case Nos. 24-1113, 24-1130, 24-1183 (D.C. Cir. July 26, 2024) (publicly filed redacted version), 90 FR 1636 at 1692. ↩
27. 28 CFR § 202.1001(b)(1). ↩
28. 28 CFR § 202.1001(b)(2) ↩
29. Department of Justice National Security Division, “Data Security Program: Compliance Guide,” pg. 7 (available at https://www.justice.gov/opa/media/1396356/dl), last accessed May 7, 2025. ↩
30. 90 FR 1636, at 1648. (“The prohibition on data brokerage in § 202.301 requires a U.S. person to act ‘knowingly,’ which ‘means that a person has actual knowledge, or reasonably should have known, of the conduct, the circumstance, or the result.’ See § 202.230. Generally, U.S. persons engaged in data brokerage who are in fact deceived by countries of concern or covered persons, despite taking reasonable measures to comply with § 202.301, would not be liable because they would not have had actual knowledge of, nor would they have reasonably known of, the circumstances.”). ↩
31. Department of Justice National Security Division, “Data Security Program Frequently Asked Questions” pg. 5. ↩