Navigating the DOJ's New Rule on Cross-Border Data Transfers: What Tech Companies Need to Know
The U.S. Department of Justice (DOJ) recently finalized a significant new rule that will reshape how companies (particularly those operating internationally) manage sensitive personal and government-related data. Issued on January 8, 2025, the rule introduces new restrictions on cross-border data transactions involving U.S. individuals and certain government-affiliated datasets.
For technology companies engaging in global operations or vendor relationships that involve U.S. personal data, the compliance landscape is about to change substantially. Most of the rule goes into effect on April 8, 2025, with additional audit and reporting obligations beginning in October 2025.
Here are the key components of the DOJ’s rule, what it covers, and how technology companies can begin preparing.
Scope of the Rule
The rule, titled “Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons,” prohibits or restricts certain transactions involving data transfers outside the United States. It applies to both U.S.-based individuals and entities, and foreign organizations that conduct business involving U.S. data.
At a high level, the rule covers:
Bulk transfers of sensitive personal data of U.S. individuals.
Transfers of government-related data to designated foreign countries or entities.
Transactions involving foreign ownership, investment, employment, or service agreements that could expose sensitive data to foreign access.
Countries of Concern and Covered Persons
The rule restricts transactions with "countries of concern," which currently include China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela. It also applies to entities and individuals classified as “covered persons,” including:
Organizations incorporated or operating in a country of concern.
Entities 50 percent or more owned by a covered country or person.
Foreign individuals residing in a country of concern, or who are employed by a government or entity affiliated with such a country.
The definition of a “covered person” is broad, and companies will need to assess ownership structures of their vendors, service providers, and investors.
Types of Data Affected
The rule primarily covers two categories:
Bulk Sensitive Personal Data, including:
Identifiers such as Social Security numbers.
Biometric and genomic data.
Health and financial data.
Precise geolocation data.
Government-Related Data, including:
Location data tied to sensitive government facilities.
Data linkable to U.S. government personnel.
Companies should review how their datasets are collected, stored, and used, particularly in cases where sensitive or regulated data could be transmitted internationally.
Transactions in Scope
The rule applies to a broad range of data-related commercial transactions. These include:
Data brokerage transactions, such as the sale or licensing of personal data.
Vendor, employment, and investment agreements where a foreign party could gain access to protected data.
Cloud-based service arrangements, especially those involving foreign service providers.
Importantly, a transaction may fall under this rule even if the foreign recipient is not from a country of concern, if there is a risk of indirect data access.
Prohibited Activities
Certain transactions are explicitly prohibited, including:
Data brokerage transactions involving sensitive or government-related data transferred to a covered person or country.
Any transaction that would enable access to human biospecimens or genomic data by a covered person.
Attempts to circumvent the rule through indirect arrangements.
Restricted Transactions and Compliance Requirements
For restricted but not outright prohibited transactions, companies must implement a range of compliance safeguards, including:
Enhanced cybersecurity protocols based on CISA standards and requirements.
Due diligence procedures to assess exposure and document risk mitigation.
Regular audits, recordkeeping, and mandatory reporting to the DOJ.
These requirements apply to employment, vendor, and investment arrangements involving covered persons or entities.
Exemptions
The rule carves out exemptions for certain categories of transactions, such as:
Routine personal communications and data exchanges not involving bulk data.
Transactions governed by existing federal oversight, including FDA-regulated clinical trials or CFIUS-reviewed investments.
Activities tied to U.S. government operations or international civil aviation.
However, companies must verify whether an exemption applies on a case-by-case basis. These are not blanket exclusions and may still involve conditions.
Reporting Obligations
The DOJ rule introduces new reporting duties. These include:
On-demand disclosure requirements for any covered transaction.
Annual reporting for cloud computing arrangements classified as restricted.
Disclosure of any rejected offers involving prohibited transactions.
Companies should review their internal controls and reporting procedures to ensure responsiveness to DOJ inquiries.
Enforcement Mechanisms
The DOJ will have wide-ranging enforcement authority, including subpoena power, investigative hearings, and the ability to impose civil and criminal penalties. Violations may result in fines, sanctions, or other corrective actions.
Licensing Framework
The rule also includes a licensing mechanism. Companies may seek a general or specific license from the DOJ for otherwise prohibited or restricted transactions. While the DOJ has indicated these licenses will be rare, they offer a formal pathway for companies to manage high-risk arrangements without breaching the rule.
Preparing for Implementation
Companies that handle U.S. personal data and engage in cross-border transactions should immediately begin evaluating their data flows, vendor relationships, and internal governance. Consider the following next steps:
Review all international agreements and partnerships involving data access.
Conduct data mapping exercises to determine whether sensitive or government-related data is being processed.
Establish or update due diligence procedures for foreign counterparties.
Implement contractual safeguards to reduce indirect exposure to countries of concern.
How Apex Legal Can Support
At Apex Legal, we assist technology companies in managing complex regulatory risks, including compliance with evolving U.S. data privacy and national security regulations. We help clients:
Interpret new rules and assess applicability.
Draft and negotiate compliant agreements.
Develop internal data governance and cybersecurity protocols.
Manage reporting obligations and enforcement exposure.
If your company operates across borders and handles U.S. data, now is the time to assess your risk. Reach out to our team to discuss how we can help you navigate this new regulatory landscape with clarity and confidence.