Data Security Risk: How the Justice Department’s Bulk Data Rule Works and What It Means for Companies and Governments

Rows of servers in a data center, the kind of infrastructure the bulk data rule reaches — Bulk data on Americans is now regulated as a national security asset. Photo: Envato.

Personal data has become a strategic commodity, and Washington now regulates it much as it regulates weapons parts and dollar payments. Executive Order 14117 rests on a blunt finding: “Countries of concern can use AI to target United States persons for espionage or blackmail,” and bulk datasets help them refine those tools (EO 14117). The result is a Justice Department rule that treats a sale of location records, a cloud contract, or a hire in Beijing as a national security transaction. For a company, the risk sits in ordinary commercial plumbing: ad-tech feeds, vendor access, clinical-trial data, and the ownership of the firm on the other end of the contract.

This page explains how the Justice Department’s Data Security Program and the related U.S. data security laws work, how they became instruments of geopolitics, what enforcement and litigation look like so far, and what executives and the officials who advise exporters should do about it. It closes a series on enforcement risk that began with sanctions; sibling regimes such as export controls and investment screening have their own pages. This is a general overview of public law and agency records, not legal advice. Anyone facing a specific question should talk to counsel.

The bulk data rule at a glance

Legal basis: the International Emergency Economic Powers Act (IEEPA) and Executive Order 14117 of February 28, 2024, which “expand[s] the scope of the national emergency declared in Executive Order 13873 of May 15, 2019,” the emergency covering foreign threats to information and communications technology (Federal Register). The Justice Department’s final rule is codified at 28 C.F.R. Part 202 (Federal Register, January 8, 2025).
Who runs it: the National Security Division (NSD) administers the Data Security Program, which the department describes as setting export-control-like restrictions on certain data transactions with countries of concern and covered persons (NSD). The Cybersecurity and Infrastructure Security Agency (CISA) wrote the security requirements for “restricted” transactions, set at the organizational, system, and data levels (CISA).
Key dates: the program took effect April 8, 2025. Due diligence, audit, and certain reporting duties were delayed “until October 6, 2025” (Federal Register; Gibson Dunn).
Countries of concern: China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela (DOJ Compliance Guide).
Covered persons: foreign entities 50 percent or more owned by a country of concern, organized under its laws, or with their principal place of business there; foreign entities 50 percent or more owned by such a covered person; foreign employees and contractors of those entities or of a country of concern; and foreign individuals primarily resident in a country of concern (Wiley). NSD can also designate covered persons by name.
Sensitive personal data and “bulk”: six categories, counted over any 12-month period, alone or aggregated across transactions with the same foreign party: human genomic data on more than 100 U.S. persons (other human ’omic data, more than 1,000); biometric identifiers, more than 1,000 persons; precise geolocation data, more than 1,000 U.S. devices; personal health data and personal financial data, more than 10,000 persons each; and covered personal identifiers, more than 100,000 persons (28 C.F.R. § 202.205).
Government-related data: covered at any volume. It includes precise geolocation data for sites on the Attorney General’s Government-Related Location Data List and sensitive personal data marketed as linked to current or recent federal employees or contractors, former senior officials, or members of the military and Intelligence Community (28 C.F.R. § 202.222).
Prohibited transactions: U.S. persons may not knowingly engage in data brokerage with a country of concern or covered person, or in covered data transactions that give them access to bulk human ’omic data or the biospecimens it can be derived from. Data brokerage with any other foreign person requires a contract clause barring onward transfer to countries of concern or covered persons, and known or suspected breaches must be reported (DOJ Compliance Guide).
Restricted transactions: vendor, employment, and non-passive investment agreements with countries of concern or covered persons are allowed only if the U.S. person meets CISA’s security requirements and runs a data compliance program with due diligence, annual independent audits, and 10-year recordkeeping (DOJ Compliance Guide; Gibson Dunn).
What it is not: the executive order “does not authorize the imposition of generalized data localization requirements,” and it disclaims any broad bar on commerce with countries of concern (EO 14117). The program “does not address purely domestic data transactions between U.S. persons” (NSD FAQs).
Licenses and advisory opinions: NSD may issue general licenses and specific licenses, the latter reviewed under a “presumption of denial,” and may answer written requests for advisory opinions (DOJ Compliance Guide).
Reporting: any U.S. person that rejects a proposed prohibited transaction must report it to NSD within 14 days. U.S. companies at least 25 percent owned by a country of concern or covered person that engage in restricted cloud-computing transactions must file annual reports (NSD FAQs; Gibson Dunn).
Penalties: the rule sets the civil maximum at “the greater of $368,136 or an amount that is twice the amount of the transaction,” subject to inflation adjustment; several law firms cite the 2025 IEEPA level of $377,700 (DOJ Compliance Guide; Gibson Dunn). Willful violations carry up to $1 million in fines and up to 20 years in prison. IEEPA also reaches anyone who “causes” a violation.
Related laws: the Protecting Americans’ Data from Foreign Adversaries Act of 2024 (PADFA), enforced by the Federal Trade Commission, bars data brokers from selling or giving access to Americans’ sensitive data to North Korea, China, Russia, Iran, or entities they control, with civil penalties of up to $53,088 per violation (FTC). The TikTok law and Commerce’s connected-vehicle rule are covered below.

How data security became a strategic instrument

Timeline of U.S. data security policy leading to the bulk data rule, 2019 to 2026 — How U.S. Data Became Security Policy. Chart: Competitive Futures.

For most of the internet era, U.S. policy favored open data flows and treated privacy as a consumer issue. The shift came first through investment review, as the Committee on Foreign Investment in the United States began treating access to Americans’ sensitive personal data as a national security concern; in March 2020 a presidential order unwound a Chinese company’s purchase of a U.S. hotel software firm, a case widely read as turning on guest data (Covington). Separately, Executive Order 13873 of May 15, 2019, declared a national emergency over foreign adversary threats to information and communications technology and services (ICTS), the basis for Commerce Department supply-chain rules (as recited in EO 14117).

Executive Order 14117 of February 28, 2024, widened that emergency to cover data itself. Its target is access by named countries to bulk and government-related data, not cross-border data flows in general (EO 14117). Two months later, on April 24, 2024, Congress enacted both PADFA and the foreign adversary applications law in the same appropriations package (Pub. L. 118-50).

The Justice Department published its final rule on January 8, 2025, and CISA issued its security requirements alongside it. On April 11, 2025, the department released a compliance guide, FAQs, and a policy under which NSD would not prioritize civil enforcement through July 8, 2025, against companies “engaging in good faith efforts to comply with or come into compliance” (Justice Department). The deputy attorney general said: “The Data Security Program makes getting that data a lot harder.” From April 4, 2025, the National Institutes of Health barred institutions in the same six countries from its controlled-access data, “prohibiting access to NIH Controlled-Access Data Repositories” (NIH).

The last compliance provisions took effect on October 6, 2025, and NSD updated its FAQs on September 24, 2025, addressing how to report possible violations and the financial incentives for doing so (Gibson Dunn). As of late October 2026, NSD’s program page listed no public enforcement action, and law firms tracking the rule reported none (NSD; Morrison Foerster). Enforcement may begin with nonpublic inquiries (Gibson Dunn). Meanwhile, the rule has begun to bite through private lawsuits, FTC letters, and congressional inquiries.

What the risk looks like in practice

Because the Data Security Program has no published enforcement record yet, the matters below, in date order, span the wider U.S. data security regime: orders, court rulings, and warning letters. Allegations are marked as such.

Beijing Shiji and StayNTouch (2020): data makes an acquisition reviewable

Shiji Group acquired StayNTouch, a U.S. maker of cloud hotel management software, in September 2018. On March 6, 2020, acting on a CFIUS recommendation, a presidential order prohibited the acquisition, finding “credible evidence” that the buyer might act to impair U.S. national security, and required divestment within 120 days (Federal Register). Covington noted the likely concern was foreign access to guest identification and location data, including that of people in sensitive government roles; interim measures barred Shiji from that data (Covington). Lesson: a modest software deal becomes a national security matter when the target holds personal data, and closing without review does not end the exposure.

Kaspersky (2024): privileged access can be banned outright

On June 20, 2024, the Commerce Department’s Bureau of Industry and Security issued a Final Determination barring Kaspersky Lab, Inc., the U.S. subsidiary of a Russia-based cybersecurity company, and its affiliates from providing antivirus and cybersecurity products or services in the United States or to U.S. persons. Permitted updates ended September 29, 2024. BIS found the risk “could not be addressed through mitigation measures short of a total prohibition,” and called it “our first use of the Commerce Department’s ICTS authorities” (BIS). Lesson: software that holds deep access to customer systems and data can be removed from the market by agency order, and customers inherit the transition cost.

TikTok (2025–2026): courts accepted the data rationale, and the remedy was ownership

The Protecting Americans from Foreign Adversary Controlled Applications Act required ByteDance to divest TikTok or see U.S. app stores and hosting providers barred from serving it (Pub. L. 118-50). On January 17, 2025, in TikTok Inc. v. Garland, the Supreme Court unanimously upheld the law against a First Amendment challenge, finding “the Government’s data collection justification sufficient” and writing that “Congress has determined that divestiture is necessary to address its well-supported national security concerns regarding TikTok’s data collection practices and relationship with a foreign adversary” (Supreme Court). Successive executive orders then paused enforcement while a sale was negotiated. Executive Order 14352 of September 25, 2025, determined that a framework agreement would be a “qualified divestiture”: a U.S.-majority joint venture, ByteDance and affiliates below 20 percent, U.S. user data in a cloud run by an American company, and recommendation models retrained and monitored by trusted security partners (Federal Register). In January 2026, TikTok announced that TikTok USDS Joint Venture LLC had been formed, with ByteDance retaining 19.9 percent and Oracle, Silver Lake, and MGX each holding 15 percent (Engadget), and said its security program would align with CISA’s requirements for restricted transactions, among other standards (The Hacker News). Lesson: courts will defer to a data-access rationale, and the practical remedy is often a change in ownership and control, negotiated under deadline.

Connected vehicles (2025): data rules become product rules

On January 14, 2025, BIS finalized an ICTS rule barring the import and sale of connected passenger vehicles with Chinese- or Russian-linked vehicle connectivity or automated driving software from Model Year 2027, and covered connectivity hardware from Model Year 2030. It also bars manufacturers with ties to China or Russia from selling new connected vehicles in the United States, even if built there. The rule took effect March 17, 2025; commercial vehicles were left for a separate rulemaking (BIS). Lesson: where a product collects data, the data rule reaches the supplier’s nationality and the bill of materials, years before the deadline.

FTC warning letters under PADFA (2026): military status is sensitive data

On February 9, 2026, the FTC sent letters to 13 companies it identified as data brokers, urging a “comprehensive review” of their practices and warning that violations could lead to enforcement. The agency said some recipients had “offered solutions and insights involving the status of an individual as a member of the Armed Forces,” information covered by PADFA (FTC). Letters are not findings of violation. Lesson: PADFA puts a second regulator on the same problem, and data on service members is an early priority.

Baker v. Index Exchange (2026): private plaintiffs borrow the rule

The rule creates no private right of action. In Baker v. Index Exchange, however, a plaintiff alleged that the Canadian advertising exchange intercepted website communications and passed personal data to advertising partners including Temu, which the plaintiff alleged is a covered person, making the transfers prohibited data brokerage. In June 2026, the U.S. District Court for the Northern District of Illinois let a federal wiretap claim proceed, holding that the alleged violation could satisfy the statute’s crime-tort exception and that a non-U.S. company may be vicariously liable for its U.S. employees’ conduct. The ruling came on a motion to dismiss; nothing has been proven, and the defendants contest the allegations (Morrison Foerster). A similar suit, Christy v. Lenovo, alleges transfers of identifiers to a Chinese parent and is at an early stage (Mayer Brown). Lesson: even before the government acts, the rule can define wrongful conduct in class actions, and ad-tech pipelines are the first target.

What it means for companies

The bulk data rule turns on three questions: what data you hold, who can reach it, and who owns the party on the other end.

Driver using a connected-car navigation screen, a source of precise geolocation data under the bulk data rule — Connected cars generate the precise geolocation data that the bulk data rule treats as sensitive. Photo: Envato.

Map data by category and count. Inventory genomic, biometric, location, health, financial, and identifier data, and count it the way the rule does: per foreign counterparty, over a rolling 12 months, with combined datasets measured against the lowest applicable threshold. Flag any government-related data, which has no threshold.
Screen ownership, residence, and employment, not names. Covered person status turns on 50 percent ownership, place of organization or business, primary residence, and employment. Check your vendors’ staff, not only their owners.
Find the access, not just the transfer. The rule reaches access: remote engineering support, offshore IT administration, cloud tenancy, and investor information rights can each create a covered transaction without any file leaving the country.
Build the restricted-transaction program before you need it. If a vendor, employment, or investment agreement with a covered person is unavoidable, CISA’s requirements, written policies, annual independent audits, and 10-year records are the price of keeping it.
Audit ad-tech and analytics. Real-time bidding, software development kits, and tracking pixels move identifiers and location data without anyone deciding to send them, and the private suits started there.
Treat research and clinical data as high risk. Genomic data has the lowest threshold; review collaboration agreements, biobank access, and contract research organizations.

Forecasting data security risk

The regime grows by accretion, agency by agency, on the same six-country template, which makes it forecastable. Useful signposts include NSD designations of covered persons and any first enforcement release; updates to the FAQs and the Government-Related Location Data List; Commerce ICTS rulemakings on new product classes such as commercial vehicles; FTC letters and complaints under PADFA; congressional letters, such as the House Select Committee on the CCP’s June 30, 2026, inquiries to five pharmaceutical companies about clinical trials in China (Morgan Lewis); and appellate rulings in the private wiretap suits. Watch countermoves too, such as China’s April 13, 2026, regulations on countering foreign “improper extraterritorial jurisdiction” (Morgan Lewis). A disciplined program tracks these against its data map and sets exit triggers in advance. Competitive intelligence helps with the hardest part: knowing who really owns and staffs the counterparties.

What it means for governments advising their companies

Trade ministries, investment agencies, and embassy commercial sections hear one question from companies with American data or customers: does the U.S. rule reach us?

Pipette and DNA sample tubes, representing genomic data covered by the bulk data rule — Genomic data gets the strictest treatment under the bulk data rule, with a threshold of more than 100 U.S. persons. Photo: Envato.

Nexus and the “causing” theory. The Data Security Program binds U.S. persons, including U.S. subsidiaries and U.S.-based staff of foreign companies. A non-U.S. company can be exposed by causing a U.S. person to violate it, by acting through U.S. employees, as the Index Exchange ruling suggests, or by becoming a covered person itself if it is owned from or based in a country of concern.

Allied and home-country regimes start from different premises. The European Union’s General Data Protection Regulation restricts transfers out of the EU unless the destination is deemed adequate or safeguards apply (GDPR, Chapter V). Article 48 provides that a foreign court or agency order to transfer or disclose personal data may be recognized or enforced only if based on an international agreement, such as a mutual legal assistance treaty (GDPR, Article 48). After the Court of Justice struck down the Privacy Shield in Schrems II (Case C-311/18, 2020) (EUR-Lex), the Commission adopted the EU-U.S. Data Privacy Framework on July 10, 2023; the General Court dismissed a challenge to it in Latombe v. Commission (T-553/23) on September 3, 2025 (Hogan Lovells). China takes the opposite angle: its Personal Information Protection Law and the Cyberspace Administration’s March 22, 2024, cross-border provisions require a security assessment for exports of personal data of more than one million people, or sensitive data of more than 10,000, in a year, with exemptions below 100,000 (Freshfields), and its Data Security Law bars providing data stored in China to foreign judicial or law enforcement agencies without government approval (WilmerHale). India’s Digital Personal Data Protection Act, 2023, lets the central government restrict transfers to notified countries, and its rules were notified on November 13, 2025, with most obligations phased in over 18 months (King Stubb & Kasiva; Hunton).

The divergence is the point. The EU and Indian regimes are general privacy laws that govern where data may go. The U.S. rule is a national security instrument that governs who may reach it. China’s rules govern what may leave. A company can be compliant under one and exposed under another, and China’s counter-extraterritoriality rules may create conflicts for firms that cut off covered persons to comply with U.S. law.

How good briefings work. Useful advice to companies is concrete: whether they hold U.S. data at bulk levels, whether their ownership, staff, or vendors make them or their counterparties covered persons, which U.S. contract clauses and audit duties they will meet from American partners, how home-country transfer and blocking rules interact with U.S. demands, and where to seek counsel or a U.S. license. That service is useful whatever view a government takes of the U.S. program.

Frequently asked questions

Does the Data Security Program apply to non-U.S. companies?

It binds U.S. persons, including U.S. subsidiaries and people in the United States. Non-U.S. companies are reached when they cause a U.S. person to violate it, act through U.S. staff, receive U.S. data under contracts that must bar onward transfer, or are themselves covered persons. A non-U.S. company owned 50 percent or more from a country of concern is a covered person.

What counts as “bulk” sensitive personal data?

Over any 12 months: more than 100 U.S. persons for human genomic data; more than 1,000 for other ’omic data or biometric identifiers; more than 1,000 U.S. devices for precise geolocation; more than 10,000 for health or financial data; and more than 100,000 for covered personal identifiers. Government-related data has no threshold.

Is the bulk data rule a data localization law?

No. Executive Order 14117 says it does not authorize “generalized data localization requirements,” and the rule does not cover purely domestic transactions. It targets transactions that give countries of concern or covered persons access to covered data.

What are the penalties?

Civil penalties up to the greater of the per-violation maximum (stated in the rule as $368,136, subject to inflation adjustment) or twice the transaction value; for willful violations, up to $1 million and 20 years in prison. PADFA carries FTC civil penalties of up to $53,088 per violation.

Has the Justice Department brought an enforcement case yet?

As of late October 2026, none had been announced publicly. The limited enforcement period ended July 8, 2025, and NSD has said companies should expect enforcement for violations.