The U.S. Sensitive Data Rule: A New Era in Data Regulation

As of July 9, 2025, the U.S. Department of Justice (DOJ) has begun full enforcement of a transformative regulation known as the Sensitive Data Rule (SDR). This initiative, implemented under President Biden’s Executive Order 14117, represents a significant shift in how the United States manages the cross-border flow of sensitive personal and government-related data. The SDR is not merely a privacy concern; it is fundamentally intertwined with national security.

A New Era in Data Regulation

Signed on February 28, 2024, Executive Order 14117 mandates the DOJ to prevent foreign adversaries from acquiring bulk quantities of sensitive data that could jeopardize U.S. national security. The DOJ’s Final Rule, issued in April 2025, introduced the Data Security Program, a comprehensive framework aimed at restricting certain data transactions involving sensitive U.S. information. With the grace period for enforcement concluding on July 9, entities are expected to achieve full compliance by October 6, 2025.

Unlike traditional data privacy laws, the SDR focuses on transactional access to data, regardless of whether the data is sold. Its primary goal is to limit how and with whom sensitive data is shared, especially when such sharing involves entities associated with foreign nations deemed hostile to U.S. interests.

“Countries of Concern” and Covered Persons

The SDR specifically targets data transactions involving “countries of concern,” which include China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela. However, the regulation also encompasses a broad range of “covered persons,” including:

• Entities based in a country of concern or owned 50% or more by such a country.
• Individuals residing in those countries.
• Employees, agents, or contractors acting on behalf of covered persons.
• Any individual designated by the DOJ based on their conduct or affiliations.

What Data is Regulated?

The Sensitive Data Rule categorizes data into two primary types: Sensitive Personal Data and Government-Related Data.

Sensitive Personal Data

This category includes data that, if obtained in bulk, could be exploited by foreign adversaries. The Bulk Data Rule establishes specific volume thresholds for regulated data types, which must exceed the following amounts to be subject to regulation:

• Covered identifiers (e.g., names with Social Security Numbers): 100,000 U.S. persons
• Geolocation data: 1,000 U.S. devices
• Biometric data (e.g., facial images, retina scans): 1,000 U.S. persons
• Genomic data: 100 U.S. persons
• Other “omic” data (epigenomic, proteomic, transcriptomic): 1,000 U.S. persons
• Health data: 10,000 U.S. persons
• Financial data: 10,000 U.S. persons

Importantly, the SDR applies even to anonymized, pseudonymized, or encrypted data.

Government-Related Data

This category includes precise geolocation information tied to government activities or facilities, as well as personal data about current or former U.S. government employees, including military and intelligence personnel. Unlike Sensitive Personal Data, Government-Related Data is regulated regardless of volume.

Restricted or Prohibited Transactions

The SDR outlines specific prohibited transactions, including:

1. Data brokerage involving covered sensitive personal data and covered persons or countries of concern.
2. Access to bulk human genomic, epigenomic, proteomic, or transcriptomic data by covered persons.

These restrictions particularly target human ‘omic data and biospecimens, categorizing them as high-risk transactions under the Bulk Data Rule. Additionally, vendor, employment, or investment agreements allowing access to covered data are permitted only if stringent Cybersecurity and Infrastructure Security Agency (CISA) standards are implemented.

Compliance Timeline: What’s Required, and When

Prohibitions and Restrictions Take Effect: April 8, 2025

Entities must comply with the Data Security Program’s prohibitions and restrictions. While affirmative obligations will not take effect until October 6, 2025, organizations are expected to make good-faith compliance efforts during the grace period.

Grace Period: April 8 – July 8, 2025

During this period, the DOJ will not prioritize civil enforcement but expects organizations to:

• Review internal data access and potential data brokerage.
• Identify covered datasets and data types.
• Conduct due diligence on agreements involving covered persons or countries of concern.
• Begin implementing CISA-level cybersecurity standards.

Enforcement Begins: July 9, 2025

After the grace period, entities should prioritize compliance actions, including:

• Evaluating current transactions for compliance and remediating as necessary.
• Confirming that counterparties are not covered persons or from countries of concern.
• Implementing CISA security requirements for restricted transactions.
• Incorporating DOJ model contract language where applicable.

Full Compliance: October 6, 2025

Once full compliance takes effect, entities must meet affirmative obligations, including:

• Conducting due diligence and auditing for restricted transactions.
• Submitting annual reports on restricted transactions and rejected prohibited transactions.
• Providing annual compliance certifications signed by responsible officers.

Penalties for Non-Compliance

The penalties for non-compliance can be severe. U.S. persons must report any known or suspected violations within 14 days. Civil penalties may reach up to $368,136—or twice the value of the transaction—per violation. Willful violations may also incur criminal penalties, including fines of up to $1 million and imprisonment for up to 20 years.

Industry Impact and Recommendations

The Sensitive Data Rule is poised to significantly impact organizations that process or share large volumes of sensitive data, particularly in sectors like healthcare, financial services, technology, and government contracting. Industries that routinely handle large datasets should pay close attention to the Bulk Data Rule, as its thresholds could apply even to aggregated or anonymized information.

Steps to Take Now

To assist organizations in achieving compliance, the DOJ has published a Compliance Guide and Frequently Asked Questions. Between now and the October 6 full compliance date, organizations should:

• Know your data: Identify sensitive personal and government-related data collected, stored, or shared.
• Vet your relationships: Ensure business partners and vendors aren’t covered persons or tied to countries of concern.
• Secure your data: Implement cybersecurity controls that meet or exceed CISA recommendations.
• Update policies and contracts: Include provisions addressing compliance with the Sensitive Data Rule.
• Train employees: Educate staff on new compliance risks and DOJ guidance.
• Prepare for audit: Maintain documentation demonstrating compliance readiness.

Organizations should also stay updated on new developments, including monitoring enforcement actions by the DOJ and understanding how compliance expectations may evolve.

Conclusion

The U.S. Sensitive Data Rule, through its implementation via the Data Security Program, marks a pivotal moment in data governance. This new regulation redefines how organizations must approach data sharing, access, and compliance—not only for privacy and ethical considerations but also for national security. Companies and institutions operating across various sectors must act now to assess their exposure, strengthen their compliance infrastructure, and prepare for a more tightly controlled data environment.