The short answer
The Data Security Program is a national-security rule run by the Justice Department’s National Security Division. It was established under Executive Order 14117 (February 28, 2024) and published as 28 C.F.R. Part 202. It controls data transactions, not just breaches: selling, licensing or giving access to Americans’ bulk sensitive personal data or U.S. government-related data to a country of concern or a covered person.
Prohibitions and restrictions have applied since April 8, 2025. The affirmative obligations (due diligence and audits for restricted transactions, annual reports and reports of rejected transactions) have applied since October 6, 2025.
Who it is about
The six countries of concern are China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela. Covered persons include entities 50 percent or more owned by a country of concern or by a covered person, entities organized or principally based there, foreign employees or contractors of those entities, foreign individuals primarily resident in a country of concern, and anyone DOJ designates.
What data, and how much
Six categories of sensitive personal data are covered, when linked or linkable to identifiable U.S. persons. The rule applies above bulk thresholds, counted in the aggregate over the preceding 12 months, and counts data even if it is anonymized, pseudonymized, de-identified or encrypted.
| Category | Bulk threshold |
|---|---|
| Human genomic data | More than 100 U.S. persons |
| Other human ’omic data (epigenomic, proteomic, transcriptomic) | More than 1,000 U.S. persons |
| Biometric identifiers | More than 1,000 U.S. persons |
| Precise geolocation data | More than 1,000 U.S. devices |
| Personal health data | More than 10,000 U.S. persons |
| Personal financial data | More than 10,000 U.S. persons |
| Covered personal identifiers | More than 100,000 U.S. persons |
A dataset that combines categories uses the lowest threshold that applies. Government-related data (precise geolocation in listed government locations, and data marketed as linked to current or recent former U.S. government personnel) is covered at any volume.
Prohibited, restricted and exempt
- Prohibited: data brokerage with a country of concern or covered person, and transactions giving access to bulk human ’omic data or the biospecimens it can be derived from.
- Restricted: vendor, employment and non-passive investment agreements. These are allowed only if they meet the security requirements published by CISA, plus the rule’s due diligence, audit and recordkeeping obligations.
- Data brokerage with any other foreign person needs contract terms prohibiting onward transfer to a country of concern or covered person.
- Exempt classes include certain financial services, official U.S. government activities, and corporate group transactions ordinarily incident to routine administrative operations such as HR, payroll and compliance.
Whether a specific arrangement is covered, prohibited or exempt is a legal question. Decide it with counsel; the security work below is what makes a restricted transaction defensible.
What CISA’s security requirements ask for
For restricted transactions, CISA’s requirements combine organizational and system-level controls (security policies, asset inventory, physical and logical access control, logging) with data-level controls: data minimization and masking, encryption, privacy-enhancing techniques, and denying covered persons access to the covered data. For a company with engineers in a country of concern, that usually means they work through tooling that never exposes the underlying data, with every action logged.
The compliance program and the annual audit
- A written data compliance program with risk-based due diligence and verification of counterparties, annually certified by an officer.
- An independent, objective audit for each calendar year in which you engage in restricted transactions, covering the preceding 12 months. Audits done for other purposes can count only if they expressly address the Data Security Program.
- Records kept in an auditable form for ten years.
- Reports: rejected prohibited transactions go to DOJ within 14 days; certain restricted transactions require an annual report.
Penalties
The program is enforced under the International Emergency Economic Powers Act. DOJ’s Compliance Guide cites civil penalties of up to the greater of $368,136 or twice the value of each violative transaction, and for willful violations up to 20 years’ imprisonment and a $1,000,000 fine.
Where to start
- Map which sensitive data you hold and how much, against the thresholds above.
- List every vendor, employee, contractor and investor who can reach it, and where they are.
- With counsel, classify each relationship as prohibited, restricted, exempt or outside scope.
- For restricted ones, implement and evidence CISA’s requirements, and stand up the compliance program before the next annual audit.
We help with the security side of each step: DOJ Data Security Program compliance and the annual independent audit.
Sources: U.S. Department of Justice, National Security Division, Data Security Program; final rule fact sheet; Data Security Program Compliance Guide (April 11, 2025). Check DOJ’s site for updates before relying on any figure here.
Last reviewed October 13, 2026.