DOJ Data Security Program compliance
The Data Security Program, established under Executive Order 14117 and 28 C.F.R. Part 202, restricts and in some cases prohibits U.S. companies from giving China, Russia, Iran, North Korea, Cuba or Venezuela, and people and companies tied to them, access to Americans’ bulk sensitive personal data and government-related data. Prohibitions applied from April 8, 2025; due diligence, audit and reporting obligations from October 6, 2025. We map where your data goes and who can reach it, implement CISA’s security requirements where access is allowed, and build the compliance program the rule expects.
Who it is for
- Companies with engineering, support or data teams, vendors or investors connected to a country of concern.
- Companies holding sensitive personal data above the bulk thresholds: genomic, biometric, precise geolocation, health, financial data or covered personal identifiers.
- Data brokers and adtech, health and fintech companies, and anyone selling or licensing data to foreign parties.
What we assess
- Data mapping: which of the six sensitive data categories you hold, against the bulk thresholds over the preceding 12 months, plus government-related data, which is covered at any volume.
- Counterparty analysis: which vendors, employees, contractors and investors may be covered persons, in support of your counsel’s legal determination.
- Transaction classification evidence: data brokerage and human ’omic access (prohibited), vendor, employment and non-passive investment agreements (restricted, if CISA’s requirements are met), and the exemptions that may apply.
- CISA security requirements for restricted transactions: organizational and system-level controls, plus data-level controls such as minimization, masking, encryption, privacy-enhancing techniques and denying access to covered persons.
- Your data compliance program: written policies, due diligence and verification procedures, auditable logging of data access, training, and the annual officer certification.
- Contract language for data brokerage with foreign persons that prohibits onward transfer to countries of concern and covered persons.
What you receive
- A data and transaction map: what sensitive data you hold, how much, where it goes and who can reach it.
- A gap register against 28 C.F.R. Part 202 and CISA’s security requirements, each gap with an owner, a fix and a price range.
- A data compliance program: policies, procedures and the evidence trail for due diligence, recordkeeping and reporting.
- For engineering teams split across borders: an architecture that lets covered persons work without access to the data, with masking, scoped tooling and full audit logs.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically four to eight weeks, depending on how many data flows and counterparties are in scope.
Common questions
Does the Data Security Program apply to us?
It applies to U.S. persons, including U.S. companies, that engage in covered data transactions with a country of concern or a covered person involving bulk sensitive personal data or government-related data. The bulk thresholds are low for some categories: human genomic data on more than 100 U.S. persons, biometric identifiers or precise geolocation on more than 1,000, health or financial data on more than 10,000, and covered personal identifiers on more than 100,000, in each case over the preceding 12 months. Data counts even if it is anonymized, pseudonymized, de-identified or encrypted.
We have engineers in China. Is that prohibited?
Not necessarily. Employment and vendor agreements with covered persons are restricted transactions, not prohibited ones. They can continue if you meet CISA’s security requirements, which in practice means the people concerned cannot access the bulk sensitive data, and you keep the due diligence, audit and records the rule requires. Corporate group transactions that are ordinarily incident to routine administrative operations are exempt. Whether a given arrangement is covered is a legal determination for your counsel; we build and evidence the controls.
What are the penalties?
The program is enforced under IEEPA. DOJ’s Compliance Guide cites civil penalties of up to the greater of $368,136 or twice the value of each violative transaction, and for willful violations up to 20 years’ imprisonment and a $1,000,000 fine.
Are you lawyers?
No. We are a security consultancy. We work alongside your counsel: they determine whether a transaction is covered, prohibited or exempt; we map the data, implement and test the security requirements, and build the compliance evidence.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
DOJ Data Security Program compliance
We reply within one business day.
Nothing you send is shared outside Calibre.