United States. Data localisation / cross-border. Regulation
DOJ Data Security ProgramPreventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (28 C.F.R. Part 202), implementing Executive Order 14117
Partly verified
Medium confidence.dpo_required Conditional: restricted-transaction compliance programmes need a designated officer. IEEPA civil penalty figure is inflation-adjusted; verify the current amount.
§1Summary
- Synopsis
Prohibits or restricts US persons from engaging in data brokerage, vendor, employment and investment transactions that give countries of concern or covered persons access to bulk US sensitive personal data or government-related data. Restricted transactions are permitted only with CISA security requirements, due diligence and audits.
- Key themes
- Unique features
Export-control style regime with criminal penalties applied to personal data; volume thresholds per data type (e.g. 100,000 US persons for covered personal identifiers).
- SaaS relevance
US SaaS companies with China-linked vendors, employees, investors or customers must screen access to bulk datasets, and onward data brokerage contracts need prohibited-transfer clauses.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Reporting of rejected prohibited transactions within 14 days; annual reports for certain restricted transactions
- DPO
- Conditional
- Cross-border transfers
- Prohibited/restricted transfers to China (incl. HK/Macau), Russia, Iran, North Korea, Cuba, Venezuela
- Maximum penalty
- IEEPA civil penalties (greater of ~$377,700 or twice the transaction value) and criminal penalties up to $1m and 20 years
§3Dates
- Key dates
- Adopted
- In force
- EO 14117 signed 2024-02-28; final rule published 2025-01-08; core prohibitions effective 2025-04-08; due diligence, audit and reporting obligations effective 2025-10-06.
§4Text and authority
- Text
- Authoritative text ecfr.gov
- Authority
- US Department of Justice, National Security Division (NSD)
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.dpo_required Conditional: restricted-transaction compliance programmes need a designated officer. IEEPA civil penalty figure is inflation-adjusted; verify the current amount.