DOJ's Bulk Personal Data Rule Becomes Effective–Resources For Compliance

The new Department of Justice (DOJ) rule governing international transfers of Americans' information, codified at 28 C.F.R. Part 202, became effective on April 8, 2025.

Our user's guide to the rule lays out what it covers, and we recently recorded a webinar walking through the rule.

Any U.S. company that transfers personal data to foreign companies or gives foreign companies access to personal data should review the rule–even if they encrypt or anonymize their data. The rule imposes prohibitions, restrictions, and security and recordkeeping requirements for different types of transfers or access. The rule covers data that a company uses in its everyday business, such as advertising IDs and location information, as well as data that third-party vendors such as internal or external helpdesks or customer support can access. U.S. companies that use foreign vendors will need to look at their contracts and due diligence processes, and vendors to U.S. companies will need