U.S. DOJ Bulk Sensitive Personal Data Rule (Data Security Program)

Build a data inventory and test each category against the bulk thresholds: human omic data on more than 1,000 U.S. persons (100 for human genomic data), biometric identifiers on more than 1,000, precise geolocation data on more than 1,000 U.S. devices, personal health data and personal financial data on more than 10,000 each, and covered personal identifiers on more than 100,000. Combined data is measured at the lowest applicable threshold. Thresholds aggregate across transactions between the same U.S. person and the same foreign or covered person in the preceding 12 months, and apply regardless of anonymization, pseudonymization, de-identification or encryption.

Applies when

Any entity organized in the United States, any person located in the United States, and the U.S. subsidiaries or branches of Chinese groups that collect, hold or can make available U.S. persons sensitive personal data.

Evidence to retain

• · Inventory of sensitive personal data mapped to the six categories in 28 CFR § 202.249 plus government-related data
• · Working papers showing 12-month aggregation per counterparty
• · Determination memo for combined data and covered personal identifiers, listing the paired listed identifiers
• · Screening record against the Government-Related Location Data List in § 202.1401

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

Determine before contracting whether the counterparty is a covered person. Countries of concern are China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela. Covered persons include foreign entities organized in, or with a principal place of business in, a country of concern, foreign entities 50 percent or more owned directly or indirectly, individually or in the aggregate, by such persons, and persons designated by the Attorney General on the Covered Persons List. Publication in the Federal Register is deemed constructive knowledge.

Applies when

U.S. persons whose data can be accessed by a Chinese parent, Chinese affiliates, employees resident in China or Chinese investors, which is the most common exposure for the U.S. entities of Chinese AI groups.

Evidence to retain

• · Counterparty due-diligence questionnaire and ownership chain chart including the aggregate 50 percent test
• · Covered Persons List screening records with screening date and hits
• · Register of foreign employees and contractors with citizenship and primary residence
• · Signed screening conclusion approved by the compliance owner

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Do not knowingly engage in data brokerage involving government-related data or bulk U.S. sensitive personal data with a country of concern or covered person. Data brokerage means the sale of data, licensing of access to data or similar commercial transactions where the recipient did not collect or process the data directly from the linked individuals. The rule examples expressly cover selling or licensing bulk precise geolocation data from an autonomous-driving fleet to a parent company abroad, embedding tracking pixels or SDKs that pass data to a covered person, and licensing subscription access to a chatbot trained on bulk sensitive data that can be prompted to disclose that training data.

Applies when

U.S. entities of Chinese AI groups that route U.S. user data back to China for model training, advertising monetization or resale, and operators of U.S.-facing apps, autonomous-driving fleets, wearables or robotics products.

Evidence to retain

• · Data-flow map annotating each outbound channel with recipient and legal characterization
• · Inventory of SDKs, tracking pixels and advertising partners with field-level data mapping
• · List of terminated or restructured data-brokerage contracts with evidence of termination
• · Training-data provenance statement showing no prohibited transaction was used to obtain or transfer data

Estimated first-time effort: 10–40 person-days (estimate, not a commitment)

When engaging in data brokerage involving government-related data or bulk sensitive personal data with any foreign person that is not a covered person, the U.S. person must contractually require that the foreign person not engage in onward data brokerage of the same data with a country of concern or covered person, and must report any known or suspected breach to DOJ within 14 days, including the date, a description of the transaction and clause, the parties involved and copies of relevant documents.

Applies when

U.S. persons, including the U.S. entities of Chinese groups, that provide U.S. user data to partners in Europe, Southeast Asia, the Middle East or other third countries.

Deadline: Report within 14 days of becoming aware of a known or suspected breach

Evidence to retain

• · Template and executed contracts containing the onward-transfer prohibition
• · Clause-implementation register maintained per counterparty
• · Internal escalation and investigation records for suspected breaches
• · Breach report filed with DOJ within 14 days and the filing receipt

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)

Any covered data transaction giving a country of concern or covered person access to bulk human omic data (genomic, epigenomic, proteomic, transcriptomic) or to human biospecimens from which such data could be derived is prohibited outright, including vendor, employment and investment agreements. It cannot be converted into a restricted transaction by implementing the CISA security requirements. The bulk threshold for human genomic data is only 100 U.S. persons.

Applies when

U.S. entities of Chinese companies working on AI drug discovery, biocomputing, genomics analytics or multi-omics plus medical imaging, and teams handling U.S. biospecimens.

Evidence to retain

• · Inventory of omic datasets and biospecimens with source-country tagging
• · Access matrix showing which onshore and offshore R&D staff can reach omic data systems
• · Review records for omics collaborations, outsourced sequencing and academic partnerships
• · Training attendance records on the prohibition for R&D and business development teams

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Vendor, employment and investment agreements with a country of concern or covered person that involve access to bulk sensitive personal data are restricted transactions, permitted only if the U.S. person complies with the CISA Security Requirements for Restricted Transactions (EO 14117 Implementation, January 2025) and all other applicable requirements. A rule example is explicit: substituting self-designed controls the company believes are equivalent, instead of the security requirements, makes the transaction prohibited.

Applies when

U.S. entities whose R&D, outsourcing or data-labelling teams in China can reach U.S. user data, and U.S. companies receiving non-passive Chinese investment that could confer data access.

Evidence to retain

• · Implementation statement mapping each CISA security requirement to a control
• · Evidence of identity and access management configuration, data minimization and encryption or de-identification
• · Register of restricted transactions split into vendor, employment and investment agreements
• · Written security-requirements policy certified annually by the officer responsible for compliance

Estimated first-time effort: 20–60 person-days (estimate, not a commitment)

A U.S. person engaging in any restricted transaction must develop and implement a data compliance program no later than 2025-10-06. At a minimum it must include risk-based procedures to verify and log, in an auditable manner, the types and volumes of data, the identity of the parties (entity ownership and individual citizenship or primary residence) and the end use and transfer method; risk-based vendor identity verification; a written policy describing the compliance program; and a written policy describing implementation of the security requirements. The last two must be certified annually by an officer, executive or employee responsible for compliance.

Applies when

Any U.S. person already engaging in restricted transactions, including U.S. subsidiaries of Chinese AI companies.

Deadline: In place no later than 2025-10-06

Applies from: 2025-10-06

Evidence to retain

• · Written data compliance program policy with the annual officer certification page
• · Written security-requirements implementation policy with the annual officer certification page
• · Auditable data-flow verification logs
• · Vendor identity verification records

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

A U.S. person engaging in restricted transactions on or after 2025-10-06 must conduct an audit once for each calendar year in which it engages in such transactions, covering the preceding 12 months. The auditor must be qualified, independent and not a covered person or country of concern. The audit must examine the restricted transactions, the data compliance program and its implementation, the records required by § 202.1101 and the security requirements. The auditor must deliver a written report within 60 days of completing the audit, describing any failures or deficiencies in the security requirements and recommending improvements. The report must be retained for at least 10 years.

Applies when

Every U.S. person that engaged in a restricted transaction during the relevant calendar year.

Deadline: Once per calendar year in which restricted transactions occur; report due within 60 days of audit completion

Applies from: 2025-10-06

Evidence to retain

• · Auditor independence and qualification statement
• · Annual audit report covering methodology, personnel interviewed and systems or facilities examined
• · Remediation plan for audit findings and evidence of closure
• · Archival record demonstrating 10-year retention of the audit report

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

A U.S. person engaging in any transaction subject to this part must keep a full and accurate record of each transaction, available for examination for at least 10 years. For restricted transactions the following must additionally be maintained in an auditable manner: the annually certified compliance-program and security-requirements policies, annual audit results, due-diligence documentation of the data flow (types and volumes, party identities including direct and indirect ownership or individual citizenship and primary residence, and end use), the transfer method, transaction start and end dates, copies of agreements, copies of any licenses or advisory opinions and their document reference numbers, and an annual certification by the responsible compliance person as to the completeness and accuracy of the due-diligence records.

Applies when

Any U.S. person within the scope of this part.

Deadline: At least 10 years from the date of the transaction

Evidence to retain

• · Transaction record archive index with the 10-year retention marker
• · Due-diligence file covering data types and volumes, party identities, end use and transfer method
• · Register of agreements, licenses and advisory opinions with document reference numbers
• · Signed annual certification of completeness and accuracy of the due-diligence records

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Two reporting duties apply. First, an annual report: a U.S. person that, on or after 2025-10-06, engages in a restricted transaction involving cloud-computing services and has 25 percent or more of its equity owned, directly or indirectly and through any contract, arrangement, understanding or relationship, by a country of concern or covered person must file by March 1 for transactions in place as of December 31 of the previous year. Second, a rejected-transaction report: from 2025-10-06, a U.S. person that receives and affirmatively rejects (including automatically, using software or automated tools) an offer to engage in a prohibited data-brokerage transaction must file within 14 days of the rejection. Both must be signed and certified as true, accurate and complete by an officer, director, a person performing those functions, or an employee responsible for compliance.

Applies when

U.S. cloud or AI platform entities with Chinese ownership reaching the 25 percent aggregate threshold, and any U.S. person that fields inbound data-transaction offers.

Deadline: Annual report by March 1 of the following year; rejected-transaction report within 14 days of rejection

Applies from: 2025-10-06

Evidence to retain

• · Ownership look-through calculation showing whether the 25 percent threshold is met
• · Annual report working papers and filing receipt, covering transaction dates, data types and volumes, transfer method and party names and locations
• · Rejected-transaction log and copies of the reports filed within 14 days
• · Signature authority documentation and the certification page for each filing

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)