The U.S. Department of Justice issued a Final Rule, effective April 8, 2025, implementing Executive Order 14117, Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern. The DOJ Final Rule restricts, and in some cases prohibits, the transfer of large quantities of Americans’ sensitive personal and government-related data to certain countries and entities. Specifically, the Rule restricts individuals from engaging in Covered Data Transactions with Covered Persons that are affiliated with Countries of Concern, which include China, Cuba, Iran, North Korea, Russia, Venezuela. The rule includes extensive definitions for the types of data and transactions that it covers.
What is Covered Data?
The regulations cover two primary types of data:
- Bulk U.S. Sensitive Personal Data: this includes data on U.S. persons that exceeds specific thresholds, and applies to biospecimens to the extent this data can be derived from such samples. The regulations apply even if the data has been anonymized or encrypted. The categories of data covered, along with their bulk thresholds are:
- Human `Omics Data
- Genomic Data: The data of 100 or more U.S. persons
- Epigenomic, Proteomic, and Transcriptomic Data: The data of 1,000 or more U.S. persons
- Biometric Identifiers: The biometric identifiers of 1,000 or more U.S. persons
- Precise Geolocation Data: The precise geolocation data of 1,000 or more U.S. persons
- Personal Health Data: The personal health data of 10,000 or more U.S. persons
- Covered Personal Identifiers: Personal identifiers (such a full name, physical address, phone number, and Social Security number) of 100,000 or more U.S. persons
- Human `Omics Data
- U.S. Government-Related Data: This includes precise geolocation data near U.S. government facilities or sensitive personal data that is marketed as linkable to U.S. government personnel, regardless of volume.
What is a Covered Person?
The term “Covered Person” means:
- Foreign entities that are organized under the laws of a Country of Concern, have their principal place of business in a Country of Concern, or are 50% or more owned by a Country of Concern.
- Entities that are 50% or more owned by another Covered Person.
- Foreign individuals who are:
- Primarily a resident in a Country of Concern, or
- Employed by or acting on behalf of a covered entity.
The Attorney General can also designate any person, whether U.S. or foreign, as a Covered Person.
What is a Covered Data Transaction?
The term “Covered Data Transaction” is any transaction that involves access by a country of concern or covered person to any bulk U.S. sensitive personal data or government-related data and that involves:
Activities that are not restricted by the Rule
The following activities are generally permitted under the DOJ Final Rule:
- A Covered Person can access bulk U.S. sensitive personal data or U.S. government-related data while located in the United States. Upon leaving the United States, the Covered Person can no longer access this data.
- Access provided BY Covered Persons: The rule does not apply when a U.S. person (including U.S. institutions) receives data FROM a Covered Person.
More information
This information provides an overview. There are extensive definitions, exemptions, exclusions, and restrictions included the Final Rule. More information can also be found in the U.S. DOJ’s Data Security Program FAQ and in the DOJ’s Compliance Guide. For a brief, one-page overview, see IAPP’s Data Security Program Cheat Sheet.
How does this impact researchers?
If you are dealing with U.S. government-related data or bulk U.S. sensitive data meeting the volume thresholds and plan to disclose or make the data accessible to an external entity, please contract Melanie Roewe, Associate Vice Chancellor, Research Administration (roewem@wustl.edu) prior to proceeding.