Navigating The DOJ's New Data Transfer Rule: Implications And Compliance Requirements

Author: On January 8, 2025, the Department of Justice ("DOJ") issued a final rule under Executive Order 14117, which established the Rule on Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (the "Rule"). The Rule, which took effect on April 8, 2025, establishes export-like restrictions and prohibitions on transferring specific types of "bulk U.S. sensitive personal data" and certain specified "government-related data" (including of current or recent U.S. Government employees and sensitive government location data) to designated "countries of concern," including China (with Hong Kong and Macau), Iran, North Korea, Cuba, Venezuela, and Russia, as well as transactions involving "covered persons," which includes entities that are established under the laws of by a country of concern and their employees. The Rule established high civil penalties and allows for criminal enforcement. However, on April