The US Department of Justice's Final Rule on preventing access to bulk US sensitive personal data creates sweeping compliance obligations for businesses handling data connected to countries of concern like China, Russia, and Iran. This regulation, stemming from President Biden's Executive Order 14117, will force companies across healthcare, technology, and other sectors to fundamentally reassess vendor agreements, employment practices, and data-handling procedures. With enforcement beginning in 2025, organi
United StatesGovernment, Public Sector
Overview
Updated July 10, 2025: The enforcement “grace period” for the DOJ’s final rule on bulk sensitive data transactions ended on July 8, 2025, so entities should be particularly conscious about compliance with the complex rule. For any questions about or help navigating the rule, contact your regular McDermott lawyer or the authors below.
The US Department of Justice’s (DOJ’s) Final Rule on preventing access to US sensitive personal data, published in the Federal Register on January 8, 2025, will prohibit or significantly restrict the transfer of or other access to bulk US sensitive personal data and US government-related data through certain data transactions to countries of concern, which are countries or entities the US government deems high-risk, as well as certain covered persons as defined in the final rule. Currently, the countries of concern are China (including Hong Kong and Macao), Cuba, Iran, North Korea, Russia, and Venezuela.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
View source
