On Friday April 11, 2025, the DOJ released a Compliance Guide and more than 100 FAQs on the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons Rule (the “DOJ Rule”). It also released an Implementation and Enforcement Policy, which indicates it will not prioritize enforcement against companies making good faith efforts to comply until July 8, 2025.
If your company is subject to the DOJ Rule, it should review the Compliance Guide and FAQs, which contain a fair amount of guidance about what DOJ staff is expecting companies to do to comply. Here are ten takeaways from these new resources:
1️⃣Enforcement is a priority. The new guidance suggests that the DOJ Rule will be an enforcement priority for the “urgent threat” it addresses, including the threats posed to national security when “foreign adversary” countries obtain data on Americans. The Trump Administration is embracing the Rule, including it as a tool that helps advance its America First Investment Policy. Deputy Attorney General Todd Blanche is quoted in the press release announcing the new resources: “If you’re a foreign adversary, why would you go through the trouble of complicated cyber intrusions and theft to get Americans’ data when you can just buy it on the open market or force a company under your jurisdiction to give you access? The Data Security Program [required by the DOJ Rule] makes getting that data a lot harder.” If your organization was hoping that the DOJ Rule’s ties to a Biden executive order would make it a target for repeal or non-enforcement, that now seems unlikely. The FAQs also note that whistleblowers for non-compliant companies may be compensated, so employees, contractors, and partners may be emboldened to report companies that are not fully compliant.
2️⃣ Full compliance expected by July 8. Companies are expected to get into compliance by July 8, 2025. The Implementation and Enforcement Policy notes that at “the end of this 90-day period, individuals and entities should be in full compliance with the [DOJ Rule] and should expect [the DOJ National Security Division] to pursue appropriate enforcement with respect to any violations.” Between now and then, companies will not be targeted for enforcement if they engage in good faith efforts to comply. The Implementation and Enforcement Policy notes a number of good faith efforts for companies to consider. These include:
-
Reviewing datasets and data types to determine if they are regulated by the DOJ Rule (tip: review this closely—many data types that aren’t typically thought as sensitive are covered)
-
Reviewing what stakeholders have access to sensitive personal data
-
Assessing whether data transactions involve data brokerage under the DOJ Rule
-
Renegotiating vendor contracts
-
Moving services to new vendors
-
Conducting due diligence on new vendors
-
Amending contracts to address onward transfer provisions with foreign person counterparties to data brokerage transactions (i.e., any non-U.S. incorporated entity)
-
Changing employee work locations, roles, or responsibilities
-
Evaluating investments and renegotiating investment agreements from covered persons or countries of concern, and
-
Implementing the Cybersecurity and Infrastructure Agency (“CISA”) Security Requirements for restricted transactions, including to prevent any covered person from accessing in-scope data.
3️⃣ Know your data. Companies are expected to know their data practices, including the types and volumes of data handled, how the data is used, whether the company engages in restricted transactions (with vendors, employees, etc.), the identities of parties they engage in data transactions with, and how data is ultimately used by recipients they disclose data to. Both the Guide and FAQs refer to these as companies’ “know their data” obligations, which require effective data governance practices for sensitive data and government-related data throughout its lifecycle, including with respect to internal access and external disclosures.
4️⃣ Anonymized and aggregated data is included. The guidance emphasizes that sensitive data that has been anonymized and aggregated is still sensitive data. While these security techniques are good data privacy and data security tactics, they will not be very helpful in avoiding application of the DOJ Rule. The guidance also emphasizes that some sensitive personal data categories should be interpreted broadly. For example, sensitive “financial data” includes purchase and payment history companies have, so any company that has a record of its customer’s purchases or transactions may have sensitive financial data. Sensitive “health data” includes fitness, wellness, and other data held by any company—not just medical or healthcare institutions—mirroring a similar trend under U.S. privacy laws that’s taken a broad view of what constitutes health data.
5️⃣ Some website tracking technologies are prohibited. The guidance emphasizes that some cookies, pixels, and software development kits (SDKs) on your company’s website or mobile app may be prohibited data brokerage. Most companies with consumer-facing websites and apps use these technologies to enable and measure targeted advertising campaigns. This underscores the need to keep an up-to-date understanding of the current tracking technologies a company’s websites and apps use. Processes to add new ones may need to be enhanced to stay in-line with these data brokerage requirements, which will be an obligation of companies that choose to use them (not the third parties that provide the tracking technologies).
6️⃣ Companies have to identify covered persons. The guidance emphasizes that U.S. companies are accountable for determining whether the vendors, employees, investors, customers, or partners they work with are “covered persons” under the DOJ Rule. This is challenging when it comes to understanding the direct and ownership of an entity; challenging or not, the guidance makes clear that this is an obligation that every U.S. company has. The DOJ will also maintain a new “Covered Person List” that companies will regularly need to scrub against, but use of this list will not excuse companies from their obligation to determine whether entities are covered persons. The FAQs have some guidance on expectations for identifying covered persons, and FAQ #60 contains a number of examples for how to determine if an entity is a “covered person” based on complex ownership structures. The examples suggest the kind of ownership details DOJ staff may expect companies to assess in connection with the Rule:
