Update: Enforcement Of DOJ Data Security Program Set To Begin July 9

The U.S. Department of Justice (DOJ) is set to enforce its sweeping new rule on certain U.S. data transactions with countries of concern and covered persons as of July 9, 2025. The new rule regarding "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons" (Rule) – which is being referred to by the DOJ as the Data Security Program (DSP) – imposes strict prohibitions on certain data transfers outside the U.S., as well as detailed privacy, cybersecurity, and data governance restrictions on a broader set of transactions outside the U.S.

While the bulk of the Rule took effect on April 8, 2025, the DOJ issued the Data Security Program Implementation and Enforcement Policy Through July 8, 2025 (Policy) on April 11, 2025, which initiated a 90-day pause in civil enforcement of the new Rule for companies working in good faith to come into compliance with the DSP. Beginning July 9, 2025, that pause will