Data Defense: Justice Department Issues Compliance Guidance And Delays Civil Enforcement Of New "Data Security Program"

In January 2025, the U.S. Department of Justice (DOJ) issued a final rule restricting transfers of Americans' bulk sensitive personal data, as well as certain U.S. government-related data, to foreign adversaries (referred to as the Data Security Program, or DSP). On April 11, 2025, DOJ issued guidance about how it would enforce this novel and complex rule. First, it unexpectedly announced that it would delay enforcing portions of the rule. Second, DOJ issued a Compliance Guide and a set of answers to "Frequently Asked Questions" (FAQs) designed to facilitate compliance with the DSP. As the Compliance Guide underscores, DOJ plans to prioritize the DSP as a countermeasure against foreign adversaries' ability to obtain U.S. government-related or sensitive personal data via commercial transactions for the purpose of committing espionage, engaging in surveillance and counterintelligence activities, and advancing artificial intelligence and military capabilities.