United StatesDOJ Data Security Program (Bulk Sensitive Personal Data Rule)
In force since .
A cross border transfer rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Transfer, Security, Governance
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Kept
What it requires
- Do not engage in a prohibited bulk data-brokerage transaction involving bulk U.S. sensitive personal data, including biometric identifiers such as facial images or voice prints, or government-related data, with a country of concern or covered person.NIST Privacy FrameworkCT.PO-P2
- Apply the required security safeguards to a restricted vendor, employment, or investment transaction that would give a country of concern or covered person access to that data.NIST Privacy FrameworkPR.AC-P4
- Treat data as in scope even when it is anonymized, pseudonymized, de-identified or encrypted: a collection of sensitive personal data counts toward the bulk threshold in any of those forms (28 CFR 202.206).
These lines are LexLint's reading of the law's text. Also read by: U.S. Department of Justice, National Security Division (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Willfully committing, attempting, or conspiring to commit a violation of a Data Security Program license, order, regulation, or prohibition is a federal crime under 50 U.S.C. 1705(c) and 28 CFR 202.1301(a)(3): a fine of up to $1,000,000, and for a natural person imprisonment of up to 20 years, or both.
Penalty structure
IEEPA (50 U.S.C. 1705(b)), applicable to a Data Security Program violation via 28 CFR 202.1301(a), sets the nominal civil penalty ceiling at the greater of $250,000 or twice the transaction value underlying the violation. 28 CFR 202.1301(a)(2) states the current inflation-adjusted figure for the fixed leg as $368,136; a court or the Department may instead impose twice the transaction amount where that alternative is greater, which is not a fixed dollar figure and so is not itself recorded as a cap here.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 368,136
Who enforces it
Enforcement body
U.S. Department of Justice, National Security Division
Enforcement record
The National Security Division's own Public Actions page for the Foreign Investment Review Section, its chronological log of program milestones and enforcement matters, lists only rulemaking and policy documents under its Data Security tag: the February 2024 executive order and advance notice, the October 2024 proposed rule, the December 2024 final rule, and the announcement implementing the program with an initial 90-day enforcement policy. It names no civil penalty, judicial action, or other completed enforcement matter brought under 28 CFR Part 202 as of the page's own last update. NSD's separate Data Security Program overview page, updated more recently on , likewise lists only the rule text, FAQs, and a compliance guide under its Current Resources heading and names no enforcement action. The rule took effect with an initial enforcement policy running through .
- As of
- Source link
- https://www.justice.gov/nsd/public-actions-0
Settledness
- As of
- Guidance link
- https://www.justice.gov/nsd/media/1415006/dl
- Guidance body
- U.S. Department of Justice, National Security Division
- Open questions
- How often must a person screen its vendor, employee and investor records against the Covered Persons List to meet the due diligence requirement of 28 CFR 202.1001, when the National Security Division says the list is not exhaustive and that the frequency is guided by the person's own risk profile?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Data lineage
Log retention
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
A U.S. person engaging in a transaction subject to the Part must keep a full and accurate record of it, available for examination for at least 10 years. For a restricted transaction the records must also be kept in an auditable manner and include the written compliance and security policies certified annually, the results of annual audits, due diligence on the data flow (the parties' identities and the end-use), the method of data transfer, the dates the transaction began and ended, and the agreements and licenses. Section 202.1102 lets the Department require reports and the production of books and documents at any time. The annual audit sets a yearly clock; the text names no auditor and no independence condition, so the audit is attributed to the U.S. person, and the results are kept. The reach test is the Part's definition of a U.S. person, which includes an entity organized under the laws of the United States and any person in the United States; the further limb for a citizen or resident alien wherever located has no value in the hook vocabulary and is left out.
- Kind
- Explicit
- As of
- Provision
- 28 CFR 202.1101(a) and (b) (a full and accurate record of each transaction kept for at least 10 years; for a restricted transaction, auditable records of the compliance program, security requirements, annual audit results, due diligence on the data flow, method of transfer, dates, agreements and licenses)
- Trigger
- personal_data_processing
What this law does
Prohibits U.S. persons from engaging in data-brokerage transactions involving bulk U.S. sensitive personal data or government-related data with a country of concern or covered person, and restricts, subject to required security measures, vendor, employment, and investment-agreement transactions that would give such a country or person access to bulk sensitive personal data, including biometric identifiers such as facial images or voice prints collected on more than 1,000 U.S. persons, or human genomic data on more than 100.
Data counts as bulk U.S. sensitive personal data regardless of whether it is anonymized, pseudonymized, de-identified, or encrypted, once it meets or exceeds the applicable threshold.
When LexLint raises it
When your app profile says your app crawls the web, trains models, processes biometric data, processes voice recordings or processes personal data.
Back to the example · Lint your app
Page updated .