EO 14117 Bulk Data Rules: The DOJ Data Security Program

Six categories of sensitive personal data, counted over the preceding 12 months: human 'omic data (genomic, epigenomic, proteomic, transcriptomic), bulk at 100 US persons for genomic (1,000 for the others); biometric identifiers (facial templates, voiceprints, fingerprints), 1,000 US persons; precise geolocation (within 1,000 meters), 1,000 US devices; personal health data, 10,000 US persons; personal financial data (payment cards, accounts, credit history), 10,000 US persons; covered personal identifiers (listed classes of identifiers, government IDs, device identifiers, demographic or contact data linked to other identifiers, that are linked or linkable), 100,000 US persons. Combined datasets take the lowest applicable threshold. Anonymization is no exit: the rule covers data regardless of whether it is anonymized, pseudonymized, de-identified, or encrypted, a deliberate rejection of the privacy-law playbook, grounded in re-identification risk at bulk scale. Government-related data (precise geolocation within the Government-Related Location Data List's coordinates, or any data marketed as concerning federal employees or contractors) is covered at ANY volume.

Prohibited (no license, no security measures suffice): data brokerage, selling, licensing, or otherwise providing access to covered data where the recipient did not collect it directly, with countries of concern or covered persons; any covered transaction giving access to bulk human 'omic data or human biospecimens from which it can be derived; and knowingly directing prohibited transactions, plus evasion structures. Data brokerage with ANY foreign person requires contractual onward-transfer restrictions (the foreign counterparty must agree not to resell to countries of concern) with reporting of known violations. Restricted (permitted only under CISA's security requirements plus the compliance program): vendor agreements (including cloud and IT services), employment agreements, and non-passive investment agreements involving covered data access by covered persons. The CISA requirements are substantive: asset inventories, logical and physical access controls, data minimization and masking, encryption with key custody outside countries of concern, and denial-by-default configurations for covered systems.

Four definitional classes plus designations: entities 50-percent-or-more owned by, organized under the laws of, or with principal place of business in a country of concern; entities 50-percent-or-more owned by covered persons; foreign-person employees and contractors of such entities or of countries of concern; and foreign persons primarily resident in countries of concern. DOJ can also designate specific persons anywhere. The practical sting is in the workforce and corporate-structure math: a US company's transaction with a European vendor becomes restricted if that vendor's covered-person employees (say, staff resident in China) get access to the covered data; a Cayman fund majority-owned by PRC entities is a covered person regardless of domicile. Diligence therefore has to reach ownership chains and workforce location for any counterparty touching covered data, screening the entity's flag alone misses most of the definition.

For restricted transactions, mandatory since October 6, 2025: a written data compliance program with risk-based procedures verifying data flows (types and volumes of covered data, transaction parties, end-use), vendor identity validation, and written policies certified annually; annual independent audits verifying compliance and CISA-requirement implementation; recordkeeping (10 years); and reports to DOJ for certain transactions, including any rejected prohibited-transaction offers and known onward-transfer violations. For everyone: know-your-data as a de facto obligation, you cannot apply thresholds you have not measured, so data inventories mapping categories, volumes, and foreign access paths are the foundational artifact. DOJ's April 2025 guidance promised enforcement restraint through July 8, 2025 for good-faith compliance efforts, then expected full implementation; NSD has framed the program as national-security enforcement, meaning IEEPA-scale penalties and criminal referral for willful evasion, not privacy-style corrective plans.

Three regimes now govern foreign access to Americans' data, with different hooks. EO 14117/DSP: transaction-based, six data categories with thresholds, six countries, DOJ-enforced. PADFAA (April 2024): prohibits data brokers from selling personally identifiable sensitive data of US individuals to foreign-adversary-controlled entities, FTC-enforced, no bulk thresholds, narrower actor (brokers) but immediate effect. CFIUS: investment-based review where foreign acquisitions implicate sensitive personal data of US citizens (the Grindr and TikTok fact patterns). None preempts privacy law: state comprehensive statutes, sectoral rules (HIPAA, GLBA, FCRA), and state genetic-privacy acts apply concurrently, and their consent or de-identification mechanisms do NOT excuse DSP compliance, again, the DSP covers even de-identified data. Practical synthesis: map covered data once, then run three screens (am I brokering to adversary-controlled entities? do my transactions give covered persons access? does any investment involve my data assets?), because the same dataset can trigger all three regimes on a single deal.