Any US company that shares bulk personal data, or US Government-related data, with a vendor, employee, investor or buyer linked to China, Russia, Iran, North Korea, Cuba or Venezuela may now be breaking a national security rule, not just a privacy one. The Department of Justice (DOJ) Data Security Program, codified at 28 CFR Part 202 under Executive Order 14117 and the International Emergency Economic Powers Act (IEEPA), bans some data transactions outright and allows others only if the US party meets security requirements written by the Cybersecurity and Infrastructure Security Agency (CISA). It reaches cloud contracts, offshore teams and contractor access, so it is an access control problem as much as a legal one. This guide explains scope, the prohibited and restricted categories, the CISA controls, due diligence, audit and reporting duties, penalties, and how the related Protecting Americans' Data from Foreign Adversaries Act (PADFA) fits.
Status line (checked 27 October 2026): the eCFR text of 28 CFR Part 202, up to date as of 22 October 2026, took effect at 12:01 a.m. Eastern on 8 April 2025. The due diligence, audit and reporting duties in Subparts J and K apply to transactions on or after 6 October 2025, as the regulation text states (the DOJ programme page lists the date as 5 October 2025). The DOJ National Security Division (NSD) page, updated 8 October 2026, lists no public enforcement actions. Check both before relying on this page.
Key takeaways
- Two tiers of transaction. Data brokerage with a country of concern or covered person is prohibited; vendor, employment and investment agreements that give such parties access to covered data are restricted and allowed only with the CISA security requirements in place.
- Thresholds are low for some data. Bulk means more than 100 US persons for human genomic data, 1,000 for biometrics or precise geolocation devices, 10,000 for health or financial data and 100,000 for covered personal identifiers, counted over the preceding 12 months.
- Access is the test, not transfer. Logical or physical ability to read, copy, decrypt or view data counts as access, and the rule assesses access without regard to security controls when deciding whether a transaction is covered.
- The CISA controls are concrete. Monthly asset inventory, internet-facing known exploited vulnerabilities fixed within 45 calendar days, MFA at AAL2 or AAL3, same-day access revocation, 12 months of central logs, and identity controls that deny covered persons access to covered data.
- Paperwork carries real exposure. Restricted transactions need a written, annually certified compliance programme, an independent annual audit and 10 years of records; civil penalties reach the greater of USD 368,136 or twice the transaction value.
Scope: who and what is covered
The rule applies to US persons: US citizens, nationals and lawful permanent residents, admitted refugees and asylees, entities organised solely under US law (including their foreign branches) and any person in the United States (28 CFR 202.256). It controls "covered data transactions": any transaction that gives a country of concern or covered person access to government-related data or bulk US sensitive personal data through data brokerage, a vendor agreement, an employment agreement or an investment agreement (202.210).
Countries of concern and covered persons
Section 202.601 lists six countries of concern: China, Cuba, Iran, North Korea, Russia and Venezuela. Covered persons (202.211) are:
- Foreign entities: 50% or more owned, directly or indirectly, individually or in aggregate, by a country of concern or covered person, or organised under the laws of, or with a principal place of business in, a country of concern.
- Foreign individuals: employees or contractors of a country of concern or a covered entity, and foreign individuals primarily resident in a country of concern.
- Designated persons: anyone, anywhere, whom the Attorney General designates as owned or controlled by or acting for a country of concern or covered person. Designations appear in the Federal Register and on the NSD Covered Persons List (202.701), with a petition route for removal (202.702).
Data categories and bulk thresholds
| Category (28 CFR) | Bulk threshold (US persons or devices, preceding 12 months) | Examples in practice |
|---|---|---|
| Human 'omic data | More than 1,000 persons; more than 100 for human genomic data | Genetic test results, sequencing data |
| Biometric identifiers | More than 1,000 persons | Face templates, fingerprints, voiceprints |
| Precise geolocation data | More than 1,000 devices | Mobile SDK location, fleet telematics |
| Personal health data | More than 10,000 persons | Claims, patient records, wearables data |
| Personal financial data | More than 10,000 persons | Card, account, credit and transaction data |
| Covered personal identifiers (202.212) | More than 100,000 persons | A listed identifier combined with another, such as a device ID with an advertising ID, or account-authentication data with contact data |
| Government-related data (202.222) | Any volume | Location data for sites on the Government-Related Location Data List; data marketed as linked to current or recent former government or military personnel |
Volumes aggregate per counterparty (202.205). A single listed identifier on its own, such as a username, is not a covered personal identifier (202.212). Sensitive personal data excludes public government records, personal communications and informational materials (202.249).
Exempt transactions
Subpart E exempts, among others, personal communications, informational materials, travel, official US Government business, financial services, corporate group transactions, transactions required or authorised by federal law or international agreement, investment agreements subject to a CFIUS action, telecommunications services, and regulatory submissions for drug, biological product and medical device authorisations and clinical investigations. The passive investment exclusion in 202.228 needs publicly traded or pooled-fund interests, under 10% of voting and equity interest and no rights beyond standard minority protections.
Key obligations
Prohibited transactions (Subpart C)
- Data brokerage (202.301): US persons may not knowingly engage in data brokerage, a sale or licence of data the recipient did not collect from the individuals, with a country of concern or covered person.
- Onward transfer (202.302): data brokerage with any other foreign person involving government-related data or bulk sensitive data is prohibited unless the contract bars onward transfer to countries of concern and covered persons, and the US person reports known or suspected violations of that clause within 14 days.
- 'Omic data and biospecimens (202.303): covered data transactions giving access to bulk human 'omic data or human biospecimens are prohibited, not merely restricted.
- Evasion and direction (202.304, 202.305): attempts, conspiracies, evasion, and knowingly directing a prohibited or restricted transaction are violations in their own right.
Restricted transactions (Subpart D)
Vendor agreements (including cloud computing, 202.258), employment agreements (including board roles, 202.217) and investment agreements (202.228) that give a country of concern or covered person access to covered data are allowed only if the US person complies with the security requirements incorporated by 202.248 and every other applicable requirement (202.401). Typical triggers are an engineering subsidiary or support contractor in a country of concern with production data access.
CISA security requirements (January 2025)
| Requirement | What it demands | NIST CSF 2.0 reference given by CISA |
|---|---|---|
| I.A.1 Asset inventory | Inventory of covered system assets with IP addresses (including IPv6), IT assets updated at least monthly | ID.AM-01 |
| I.A.2 Accountability | Named individual(s) responsible for cybersecurity and for governance, risk and compliance | GV.RR-02 |
| I.A.3 Known exploited vulnerabilities | Remediate KEVs in internet-facing systems within a risk-informed timeframe, all within 45 calendar days, with compensating controls if patching is not possible and a check for prior compromise | ID.RA-08 (and ID.RA-01) |
| I.A.4 to I.A.7 | Documented vendor agreements with security terms, accurate network topology, approval before new hardware or software with an allowlist, incident response plan reviewed annually | GV.SC-05 to GV.SC-10, ID.AM-03 |
| I.B.1 MFA | MFA on all covered systems at NIST SP 800-63B AAL2 or AAL3; where MFA is not feasible, passwords of 15 or more characters | PR.AA-03 |
| I.B.2 Revocation | Credentials and access revoked on termination or role change, on the day of departure or within a risk-informed timeframe | PR.AA-01 |
| I.B.3 Logging | Access and security logs collected and stored centrally for at least 12 months, kept until any US Government investigation is resolved, alerting when a critical log source stops | PR.PS-04, DE.CM-09 |
| I.B.4 and I.B.5 | Deny connections by default; manage identities and credentials for users, services and hardware with least functionality | PR.AA-05 |
| I.C Data risk assessment | Annual assessment of whether the chosen controls prevent covered person access, with a mitigation strategy | Privacy Framework ID.RA-P |
| II.A to II.D Data-level controls | A combination that fully prevents access: minimisation and masking (pseudonymisation, aggregation, de-identification), encryption in transit and at rest (TLS 1.2 or higher) with keys held apart and never in a country of concern, privacy-enhancing technologies, and IAM configured to deny covered persons access to covered data | Privacy Framework CT.DP-P, PR.DS-P, PR.AC-P4 |
Systems that perform minimisation, PET processing or key storage are themselves covered systems that must meet Section I. See the Privacy-Enhancing Technologies Guide and the Pseudonymisation Techniques Guide.
Compliance programme, audit, records and reports
- Data compliance programme (202.1001): risk-based procedures that verify and log, in an auditable way, data types and volumes, the identity and ownership of transaction parties, end use and transfer method; vendor identity verification; a written programme policy and a written security policy, each certified annually by a responsible officer or employee.
- Annual audit (202.1002): one independent, qualified audit for each calendar year with restricted transactions, covering the preceding 12 months, the programme, records and the security requirements. The auditor reports within 60 days; the report is kept for at least 10 years. The auditor may not be a covered person.
- Records (202.1101): full and accurate records of each transaction kept for at least 10 years, including due diligence, transfer methods, agreements, licences and annual certifications.
- Annual reports (202.1103): US persons engaged in restricted transactions involving cloud computing services that are 25% or more owned, directly or indirectly, by a country of concern or covered person report by 1 March for the previous calendar year.
- Rejected transaction reports (202.1104): a US person that affirmatively rejects an offer of a prohibited data brokerage transaction, including through automated means, reports within 14 days of rejecting it.
NSD can issue general and specific licences (Subpart H) and advisory opinions (202.901).
Timeline and current status
| Date | Event | Source |
|---|---|---|
| 28 February 2024 | Executive Order 14117 signed | CISA |
| 24 April 2024 | PADFA enacted (15 U.S.C. 9901), effective 60 days later | US Code |
| 26 December 2024 | NSD issued the final rule | DOJ NSD |
| January 2025 | Final CISA security requirements; final rule published at 90 FR 1706 on 8 January 2025 | CISA, eCFR |
| 8 April 2025 | Rule effective, 12:01 a.m. Eastern | 28 CFR 202.216 |
| 11 April 2025 | Compliance Guide and Implementation and Enforcement Policy (to 8 July 2025) | DOJ NSD |
| 8 July 2025 | End of the limited enforcement period that deprioritised civil enforcement against good-faith compliance efforts | DOJ NSD; law firm commentary |
| 6 October 2025 | Due diligence, audit and reporting duties apply | 28 CFR 202.1001 to 202.1104 |
Watch for Covered Persons List designations, new general licences, FAQ revisions and amendments to Part 202 or the CISA document.
Enforcement and penalties
- Civil: up to the greater of USD 368,136 or twice the value of the transaction, per violation, for violating, attempting, conspiring or causing a violation (202.1301(a)). The amount is inflation-adjusted.
- Criminal: for wilful violations, fines of up to USD 1,000,000 and, for individuals, up to 20 years' imprisonment.
- Process: NSD issues a pre-penalty notice; the respondent has 30 days from service to answer in writing, or the right is waived (202.1302, 202.1306).
- PADFA overlap: PADFA separately bars data brokers from making personally identifiable sensitive data of US individuals available to foreign adversary countries (listed in 10 U.S.C. 4872(d)(2)) or entities they control, which includes entities at least 20% owned by such persons. The FTC enforces it as an unfair or deceptive practice rule.
What it means for AI agents and non-human identities
Access by any means counts, including through credentials that do not belong to a person.
- Service accounts and API keys held by vendors: a covered vendor's integration key, OAuth client or cloud role that can read a bulk dataset gives that vendor access. Inventory them as part of the transaction. See the Service Account Security Guide and the Third-Party Access Guide.
- Requirement I.B.5 names services and hardware: identities and credentials for users, services and hardware must be managed with least functionality. Workload identities, CI/CD tokens and machine certificates are in scope.
- Revocation applies to machines too: when a covered vendor contract ends, rotate shared secrets and remove federated trusts the same day. See the NHI Offboarding and Decommissioning Guide.
- AI agents and model providers: an AI service operated by a covered entity that ingests bulk health, location or identifier data from a US firm is a vendor agreement with access. So is an agent with tool permissions that can pull a covered dataset and send it to such a service. Data-level controls (II.D) must hold for agent identities, and logging under I.B.3 must capture agent reads.
- Keys: II.B.2 bars storing keys in countries of concern and authorising covered persons to access them. Key management systems and the secrets they hold are covered systems. See the Secrets Management Guide.
Compliance steps
- Map data: classify datasets against the six sensitive categories and government-related data, and count US persons or devices over a rolling 12 months, aggregating per counterparty. See the Data Classification Guide.
- Map counterparties: screen vendors, cloud and AI providers, contractors, employees with data access, investors and data buyers for country-of-concern ownership (50% rule), residence and the Covered Persons List. Re-screen on ownership changes.
- Map access paths: for each counterparty list every human account, service account, API key, federated trust and support tool that reaches the data, including break-glass and offshore support routes.
- Classify each relationship: prohibited (stop it, then report any rejected offers within 14 days), restricted (apply the CISA requirements), exempt (document the exemption and its conditions) or out of scope (record why).
- Close data brokerage gaps: add onward-transfer prohibitions to every data sale or licence with a foreign person and set up the 14-day violation reporting path.
- Implement the CISA controls: start with I.B.1 MFA, II.D deny-access IAM rules and II.B encryption with separated keys, because these prevent access outright; then inventory, KEV patching and logging. Test in a pilot environment that a covered persons group is denied and logged.
- Write and certify: produce the programme and security policies, name the accountable officer, and set annual certification dates.
- Audit and report: appoint an independent auditor for each calendar year with restricted transactions, file 1 March annual reports where the cloud ownership trigger applies, and retain everything for 10 years.
- Plan for exits (rollback): if a restricted transaction cannot meet the requirements, unwind it by removing access first (keys, accounts, routes) and record the date.
| Situation | Practical choice | Trade-off |
|---|---|---|
| Small firm, one offshore contractor with production access | Remove access or move work to masked or synthetic data (II.A) | Lower productivity, but avoids audit and certification overhead |
| Large firm with a subsidiary in a country of concern | Treat as restricted; enforce II.D deny rules and separate keys; annual audit | Ongoing cost; strongest evidence position |
Framework mapping and measurement
| Part 202 / CISA element | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|
| Vendor verification and agreements | SR-6 Supplier Assessments and Reviews | GV.SC-05 |
| MFA (I.B.1) | IA-2 Identification and Authentication | PR.AA-03 |
| Revocation and identities (I.B.2, I.B.5) | AC-2 Account Management | PR.AA-05 |
| Deny covered persons (II.D) | AC-3 Access Enforcement | PR.AA-05 |
| KEV remediation (I.A.3) | RA-5 Vulnerability Monitoring and Scanning | ID.RA-08 |
| Logging (I.B.3) | AU-11 Audit Record Retention | PR.PS-04 |
| Encryption and keys (II.B) | SC-8, SC-28, SC-12 | PR.DS (via Privacy Framework PR.DS-P) |
Metrics that show the programme works:
- Share of vendors and contractors with data access screened against the Covered Persons List and ownership rules in the last 12 months.
- Number of non-human credentials held by counterparties in restricted transactions, and the share with an owner and expiry.
- Internet-facing KEVs on covered systems open beyond 45 calendar days (target zero).
- Median time from contract end or departure to full access revocation, human and machine (target same day).
- On-time annual certifications, audit reports and 1 March filings.
Common failure patterns
- Counting rows, not people: thresholds are per US person or device across 12 months and aggregated per counterparty, so splitting deliveries does not get under them.
- Treating encryption as an exit: access is assessed without regard to security requirements, so encryption helps meet the restricted conditions but does not take a transaction out of scope.
- Forgetting machine access: screening named staff while a covered vendor's API key, support tooling or cloud role still reads the data.
- Ignoring ownership drift: a vendor acquired by an entity in a country of concern becomes a covered person under the 50% rule mid-contract.
- Missing the reporting duties: automated rejections of data brokerage offers still need a 14-day report.
Practitioner checklist
- Check the NSD page and eCFR quarterly for amendments, licences and designations.
- Build a register of datasets by Part 202 category with rolling 12-month counts per counterparty.
- Screen all counterparties with data access, including AI and cloud providers, for country-of-concern links and Covered Persons List entries.
- List every human and non-human access path for each counterparty in a restricted transaction.
- Enforce MFA at AAL2 or above and IAM deny rules for covered persons on every covered system.
- Patch internet-facing KEVs on covered systems within 45 calendar days and record compensating controls.
- Add onward-transfer clauses to data sales and a 14-day reporting process for violations and rejected offers.
Standards and references
- eCFR: 28 CFR Part 202, Access to US Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons
- US Department of Justice, National Security Division: Data Security Program
- CISA: Security Requirements for Restricted Transactions
- eCFR: 28 CFR Part 202 Subpart J, Due Diligence and Audits
- eCFR: 28 CFR Part 202 Subpart M, Penalties
- Cornell LII: 15 U.S.C. 9901, Protecting Americans' Data from Foreign Adversaries Act
- Cleary Gottlieb: Enforcement Countdown for the Bulk Data Rule
Related NHI Mgmt Group resources: Data Sovereignty and Residency Guide · Global Privacy Regulatory Map · Third-Party Risk Management Guide · Non-Human Identity (NHI) Guide. This guide summarises 28 CFR Part 202 and related US law as of 27 October 2026 and is not legal advice.