DOJ Data Security Program — countries-of-concern data transactions
Enacted in force
Fields requiring verification
- enforcement date: Unverified — No distinct enforcement-start date was established. Primary source
- penalty amount: Unverified — Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description. Primary source
In plain English
- U.S. persons engaging in defined covered data transactions involving bulk U.S. sensitive personal data or U.S. government-related data and countries of concern or covered persons. Primary source
- Transaction categories, data thresholds, exemptions and licensing rules control; this is not a general ban on all cross-border data flows. Primary source
- Identify covered counterparties, covered data and transactions; avoid prohibited data-brokerage and other prohibited transactions unless authorized. Primary source
- Conduct restricted transactions only when authorized and compliant with the applicable security requirements. Primary source
- Perform applicable due diligence, audits, recordkeeping and reporting, including the phased-in obligations. Primary source
Dates and phased obligations
Legal effective / principal operative date: 2025-04-08. Sections 202.1001–1002 and 202.1103–1104 apply to the relevant transactions from 2025-10-06. Primary source
The final rule and codified section 202.216 identify April 8, 2025 as the legal effective date. Due diligence and audit requirements in sections 202.1001–1002 and specified reporting requirements in sections 202.1103–1104 apply to relevant transactions (or rejected proposed transactions) on or after October 6, 2025. No claim is made that every reporting provision started in October. Source and qualifications
Questions from this record
Who does 28 CFR 202; 90 FR 1636 cover?
U.S. persons engaging in defined covered data transactions involving bulk U.S. sensitive personal data or U.S. government-related data and countries of concern or covered persons. Transaction categories, data thresholds, exemptions and licensing rules control; this is not a general ban on all cross-border data flows. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
Legal effective / principal operative date: 2025-04-08. Sections 202.1001–1002 and 202.1103–1104 apply to the relevant transactions from 2025-10-06. Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
- DOJ final rule, 90 FR 1636DATES; preamble effective-date discussion; 28 CFR 202.101, 202.216, subparts C–E, J–M
Verification history
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.