Cybersecurity Policy Report, U.S. Rules Restricting Data Exports to Foreign Adversaries Become Effective, (Apr 11, 2025)
Regulations restricting the transfer of data related to U.S. government operations or large quantities of data about Americans to adversarial foreign nations have gone into effect, the Department of Justice announced today.
The rules, published in January (CPR, Jan. 3), became effective on Tuesday.
The rules were developed pursuant to an executive order issued under the Biden administration that sought to ban certain types of data transfers, including “bulk” sales by data brokers of Americans’ personal data to “countries of concern” and transfers of “some categories of sensitive personal data linked to populations and locations associated with the Federal Government—including the military—regardless of volume.”
The rules create a Data Security Program within DoJ’s National Security Division (NSD) that “establishes what are effectively export controls that prevent foreign adversaries, and those subject to their control, jurisdiction, ownership, and direction, from accessing U.S. government-related data and bulk genomic, geolocation, biometric, health, financial, and other sensitive personal data,” DoJ said in a news release.
“If you’re a foreign adversary, why would you go through the trouble of complicated cyber intrusions and theft to get Americans’ data when you can just buy it on the open market or force a company under your jurisdiction to give you access?” said Deputy Attorney General Todd Blanche. “The Data Security Program makes getting that data a lot harder.”
“To assist the public in coming into compliance with the Data Security Program, NSD has issued a Compliance Guide, an initial list of over 100 Frequently Asked Questions (FAQs), and an Implementation and Enforcement Policy for the first 90 days,” DoJ said.
“NSD will be taking additional steps over the coming weeks and months to implement the Data Security Program, including publishing an initial Covered Persons List that identifies and designates persons subject to the control and direction of foreign adversaries,” it noted.
Provisions of the rules related to “affirmative due-diligence obligations” will not become effective until Oct. 6, the department said, “to provide additional time for entities and individuals to come into compliance.”
In addition, NSD said it would not “prioritize civil enforcement actions against any person for violations of the Data Security Program that occur from April 8 through July 8, 2025, so long as the person is engaging in good faith efforts to comply with or come into compliance with the Data Security Program during that time.”
“NSD recognizes that individuals and companies may need to take a number of steps to determine whether the Data Security Program’s prohibitions and restrictions apply to their activities, and to implement changes to their existing policies or to implement new policies and processes to comply,” it said.
“Countries of concern” targeted by the rules include China, Cuba, Iran, North Korea, Russia, and Venezuela.
Violations of the rules would be punishable by civil and criminal penalties, with the most severe penalties—fines of up to $1 million and 20 years in prison—reserved for “willful violations,” DoJ said.
MainStory: TopStory FederalLegislation DataSecurity DataPrivacy