Key Takeaways
- The Department of Justice’s Data Security Program (DSP), effective October 2025, restricts U.S. persons and companies from sharing sensitive personal data with six countries of concern: China, Russia, Iran, North Korea, Cuba, and Venezuela.
- The program restricts bulk data from being shared, such as health, financial, biometric, genomic, and geolocation information, even if that data has been anonymized or encrypted.
- Although the DSP has bipartisan support, the program still raises debate about vague definitions, compliance burdens on ordinary businesses, and friction with existing health data privacy laws including the Health Insurance Portability and Accountability Act (HIPAA).
Background
Every day, companies across the U.S. buy and sell large amounts of personal data, such as information about location history, health records, finances, and even DNA. For years, foreign governments were able to purchase this same data legally through commercial markets. Introduced in 2025, the Department of Justice (DOJ) Data Security Program (DSP) is a new federal initiative seeking to change the exchange of data.
Issued under Executive Order 14117 and finalized as 28 C.F.R. Part 202, the DSP took full effect on October 6, 2025. The program exists as a federal regulatory framework, restricting or outright banning certain data transactions with countries that the U.S. government considers national security threats. The DSP is administered by the DOJ’s National Security Division (NSD). Both the Biden administration, which created the rule, and the Trump administration, which continued it, have framed the DSP as consistent with their national security and economic priorities. The program has also received broad bipartisan support in Congress.
What the DSP Does
Covered Data
The data covered by the framework is defined by the DSP as “bulk sensitive personal data.” This includes geolocation, biometric data, genomic or DNA-related data, health, financial, and government-related information above certain volume thresholds. Crucially, the DSP applies even if the data has been anonymized, encrypted, or de-identified. DSP is a deliberate break from the Health Insurance Portability and Accountability Act (HIPAA), which exempts anonymized data from privacy regulations. In justifying the large reach of the DSP, the government argues that modern artificial intelligence can reconstruct individual identities from datasets that were once considered private, making traditional anonymization an unreliable protection.
Covered Entities and Covered Persons
The DSP broadly applies to any U.S. citizen, green card holder, company, university, hospital, or nonprofit. Additionally, organizations do not need to work in a national security field for the DSP to apply. So long as an individual or organization handles covered data and/or interacts with a country of concern or a “covered person”, the DSP applies and prohibits the transfer of covered data. “Covered persons” are defined by the government as foreign companies and their contractors that are largely owned, controlled, or directed by one of six countries of “concern”. The six countries of concern are China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela.
The DSP draws a line between two types of transactions. Any data deal that directly transfers covered data to a country of concern or covered person is outright prohibited. However, vendor agreements, employment contracts, and investment arrangements involving covered persons may continue if certain conditions are met. These requirements include meeting data security standards set by the Cybersecurity and Infrastructure Security Agency (CISA), examining the vendor’s partners, filing annual reports with the DOJ’s National Security Division, and cooperating with audits that are performed by a third-party auditor obtained by the company. Finally, the audits are reviewed by the National Security Division (NSD) as part of its enforcement authority.
Penalties for Violation
Companies that violate the DSP face civil or criminal penalties. A whistleblower program, administered by the Financial Crimes Enforcement Network, offers financial rewards for tips that lead to enforcement actions resulting in penalties above one million U.S. dollars. The NSD can also issue licenses authorizing specific transactions that would otherwise be banned, allowing for legitimate business, research, and diplomatic activity to proceed.
How does the DSP Prevent Adversary Access?
Foreign adversaries have increasingly turned to legal commercial data markets to acquire information that has historically been stolen through cyberattacks. Bulk personal data, purchased cheaply and legally, allows for the profiling of millions of Americans without ever needing to hack into a computer system. The DSP cuts off that commercial pathway.
For transactions that are restricted rather than prohibited outright, the DSP’s compliance framework creates a second line of defense. Companies must check their business partners, follow CISA’s data security rules, send yearly reports to the CISA, and get audited. More importantly, the rule defines “access” broadly, meaning that companies cannot satisfy their obligations simply by conducting technical controls like encryption. Businesses must restructure the relationship between underlying vendors and employees, as well as conduct further analysis and review on investments.
The NSD’s licensing mechanism also adds a pressure valve: transactions that would otherwise be banned can be authorized on a case-by-case basis, preserving legitimate activity while keeping oversight and regulation intact.
Debates Surrounding DSP
Despite the DSP program attracting broad bipartisan support, the support has not quieted debate over how the rule works in practice. Supporters of DSP argue that one of its greatest strengths is forcing foreign adversaries to buy what was once stolen. The 2015 Office of Personnel Management (OPM) breach demonstrated exactly how bulk personal data can be weaponized. In the breach, China used files on millions of federal employees to identify U.S. intelligence personnel and map American networks. The DSP’s supporters argue the rule closes the commercial pipeline that makes general data acquisition cheap and legal, protecting U.S. intelligence and personal data.
Critics push back, saying the government has not provided substantial public evidence to restrict commercial exchange of data. Because the protected evidence is mostly kept secret, businesses and citizens cannot determine themselves if the restrictions imposed by the DSP are truly necessary and efficient. Therefore, critics feel as if they’re being asked to trust the security benefits without being able to check them.
The artificial intelligence justification for covering anonymized data is also heavily contested by opponents of the program. Traditional privacy frameworks like HIPAA treat de-identified data as safe and exempt from regulations. Yet critics note that the DSP rejects that assumption, reasoning that modern algorithms can reconstruct individual identities from datasets once considered private. Opponents see the DSP as a dramatic expansion of federal regulatory reach with consequences that fall hardest on researchers, hospitals, and universities whose international collaborations involve data that HIPAA already governs. A research institution conducting a fully HIPAA-compliant genomic study could still trigger DSP obligations simply because it uses an internationally affiliated vendor or employs foreign nationals with no clear guidance on how to comply.
That compliance burden is a thread running through nearly every objection to the rule. The DSP’s penalties were designed for willful bad actors, but apply equally to companies with routine international vendor relationships or overseas employees. The definitions of “covered person”, “bulk” data, and restricted translation types remain ambiguous enough that compliance-oriented businesses cannot always determine with confidence whether ordinary activities are covered. For smaller organizations without dedicated legal teams, that uncertainty creates real exposure.
Frequently Asked Questions
Does the DSP apply to me if I am not a national security contractor?
Yes. The DSP applies to any U.S. person or company that collects, stores, or transfers covered data, regardless of what industry they work in. A hospital, a university, a tech startup, or a payroll company could all be subject to the rule if they handle bulk sensitive personal data and have relationships with entities in covered countries.
What if the data is already anonymized or encrypted, does the DSP still apply?
Yes. The DSP explicitly covers anonymized, pseudonymized, de-identified, and encrypted data. The government’s reasoning is that modern AI can reconstruct identities from data previously considered safe, so the format of the data does not determine whether the rule applies.
How does the DSP relate to other data privacy laws?
The DSP is a national security regulation, not a privacy law. It operates alongside, and sometimes in conflict with, existing frameworks like HIPAA. Organizations that are already HIPAA-compliant cannot assume that compliance extends to the DSP. The two standards have different coverage areas, and the DSP will often require additional steps.