Bulk data transfer limits are coming: What’s my exposure?

The regulator’s take

The DOJ rule implements a Biden-era executive order, EO 14117, the first directive of its kind to address risks stemming from the commercial sale or transfer of sensitive US data to certain foreign entities and their affiliates. Taken together, the EO and its implementing rule seek to strengthen privacy protections and protect national security by setting strict limits and oversight mechanisms on the collection, processing and cross-border transfer of bulk sensitive data. The data in question includes sensitive personal information about US individuals — health, financial, geolocation, biometric and genomic data — as well as government-related data.

The goal is to counter the economic espionage efforts of “countries of concern” — China, Russia, Iran, North Korea, Cuba and Venezuela.

Affected entities and transactions. The DOJ rule applies to entities that are based in or controlled by a country of concern, or that are controlled by a person who’s a resident, employee or contractor of such a country. It also applies to individuals who are a resident, employee or contractor of such a country.

Given the vastness of trade relations between the US and China, businesses would do well to consider their Chinese/Hong Kong owned or based suppliers, as well as suppliers employing Chinese/Hong Kong personnel for certain business processes subject to the rule. The DOJ conducted extensive analysis of the US population to identify those most vulnerable to foreign espionage efforts. At the top of the list are those associated with “covered data transactions” (defined in §202.210) that are also accessible by “covered persons” (defined in §202.211).

For affected entities, the rule prohibits certain data transfers outright and permits others only if they meet certain security requirements.

• Prohibited transactions. If a data transfer involves covered data in a prohibited transaction (described in Part C), businesses must stop the transaction. Prohibited transactions include data brokerage, onward data brokerage by foreign persons and transactions involving bulk human ‘omic (genomic, epigenomic, proteomic or transcriptomic) data. For global business processes, this means separating or replacing the “country of concern” aspects of the people, processes and technologies.
• Restricted transactions. If a data transfer involves covered data in a restricted transaction (described in Part D), the rule requires a significant security drill before the transaction can go forward. The Cybersecurity and Infrastructure Security Agency (CISA) has established specific security requirements for these use cases. Examples include:
  • Organizational-level measures including regular risk assessments, policies and access controls
  • Data-level measures including data minimization, masking, encryption and privacy-enhancing technologies
  • Compliance measures including an annual independent audit, record-keeping and reporting

Bulk personal data and thresholds. The term “bulk US sensitive personal data” means a collection of sensitive personal data relating to US persons, in any format, regardless of whether it’s anonymized, de-identified or encrypted, where the data exceeds certain thresholds at any point in the preceding 12 months.

Exempted transactions. The rule exempts certain transactions (described in Subpart E) considered lower risk, allowing multinational corporations to maintain operations within countries of concern provided they implement stringent security controls to limit access to sensitive data. Exempt transactions include:

• Person-to-person communications
• Travel-related data transfers
• Payment processing
• Regulatory and compliance-related transactions
• Financial services
• Telecommunication services
• Drug and medical device approvals
• Intra-entity transactions incidental to business operations such as HR, payroll, taxes, permits, customer support and internal communications

Compliance deadlines. Covered entities need to be aware of two key dates.

• April 8, 2025: Most aspects of the DOJ rule become enforceable. Restricted transactions on or after this date will have to comply with CISA cybersecurity requirements adopted separately but referenced in the DOJ rule (at §202.248).
• October 6, 2025: Due diligence and audit requirements (under Subpart J) and reporting and recordkeeping requirements (under Subpart K) become enforceable.

Note, however, that the Trump administration has imposed a blanket freeze on all pending regulations ― including this one ― to allow it time to review and potentially reconsider them. While this creates some uncertainty for the DOJ rule, the rule’s objectives align generally with the Trump administration’s posture toward China. Moreover, the fact that new administration hasn’t rescinded the underlying EO, like so many other Biden-era directives, is an indication of that alignment.

Enforcement and penalties. The DOJ has broad powers to enforce the rule (described in Subpart M), including through audits as well as civil and criminal enforcement. It can impose civil penalties for violations up to the greater of $368,136 or twice the value of the unlawful transaction. In cases of willful violations, criminal penalties can be severe, including a fine of up to $1 million, imprisonment for up to 20 years, or both.

Sectors most impacted. We evaluated the types of businesses with operations that typically match the footprint outlined in the decision-tree above and ― given the unique importance of the Chinese market ― identified the top 10 outbound US-to-China and China-to-US sectors likely to experience significant compliance challenges.