The Justice Department’s Data Security Program is in effect, but it does not ban every sale or transfer of Americans’ personal data overseas. It restricts certain transactions that could give designated foreign countries or covered persons access to government-related data or bulk U.S. sensitive personal data. The result depends on the data, the amount, the recipient and the transaction—not simply whether information crosses a border.
What the rule prohibits, restricts and leaves alone
Codified at 28 C.F.R. Part 202, the Data Security Program implements Executive Order 14117. It is a national-security regime for specified data transactions, not a comprehensive consumer privacy law or a general data-localization mandate.
- Prohibited: Certain data-brokerage transactions that give a country of concern or covered person access to government-related data or bulk U.S. sensitive personal data.
- Restricted: Certain vendor, employment and investment agreements involving access to covered data. They may proceed only if they meet the rule’s security and compliance requirements.
- Not automatically prohibited: Every overseas transfer, foreign cloud service, foreign buyer or transaction involving a company in a named country. The rule’s definitions, conditions, exemptions and any applicable license matter.
Why DOJ adopted the program
DOJ says adversaries could obtain sensitive U.S. datasets through commercial channels and use them for espionage, surveillance, coercion, blackmail, targeting government personnel, foreign influence or repression, and military or artificial-intelligence development. The department also identifies risks to journalists, activists, dissidents, political opponents and marginalized groups. These are the government’s stated national-security concerns; they do not mean every covered transaction produces those harms.
The order was signed February 28, 2024. DOJ issued the final rule December 27, 2024; it was published January 8, 2025, at 90 FR 1636–1752, and took effect April 8, 2025. DOJ’s initial implementation announcement described a good-faith enforcement period through July 8, 2025, not a permanent exemption. See DOJ’s final-rule announcement and its implementation announcement.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
- SHIELD YOUR PRIVACY WITH THE ID DEFENDER ROLLER STAMP: Tired of worrying about your personal information falling into the wrong hands? The ID Defender Roller Stamp offers a simple yet effective solution. With a unique wide camouflage pattern, it quickly and easily conceals sensitive data on a variety of surfaces.
- PRIVACY PROTECTION: useful not only as an ADDRESS BLOCKER or ID POLICE, but also keeps away preying eyes from invoices, authority documents, checks, bank statements and many more.
- SIMPLE TO USE: Just remove the cover and swipe. The wide swipe makes it easy to cover sensitive information.
- VERSATILE APPLICATION: Ideal for a variety of documents, including contracts, court documents, shipping labels, tax returns and more.
- LONG-LASTING INK: The high-quality ink works on both glossy and standard paper and provides up to 330 feet of coverage.
Which countries and people are covered?
The six countries of concern are China, including Hong Kong and Macau; Cuba; Iran; North Korea; Russia; and Venezuela. The program can also apply to a “covered person” connected to a country of concern through the rule’s ownership, control, jurisdiction or direction tests. A counterparty’s place of incorporation alone may not settle the question. DOJ’s fact sheet and compliance guide explain the categories.
The rules generally impose obligations on U.S. persons engaging in covered transactions. That can include U.S. companies, citizens and residents, and U.S.-organized entities. Foreign branches or operations may also be relevant depending on jurisdiction and the transaction. A company therefore needs to assess both what data is involved and who may access it—not just where its vendor is headquartered.
Which data thresholds count as “bulk”?
The regulation sets thresholds measured over the preceding 12 months. It can aggregate covered transactions involving the same U.S. person and foreign person or covered person. The figures below are regulatory triggers under 28 C.F.R. § 202.205, not safe harbors from other privacy, security, sanctions or contractual rules.
Rank #2
- WHAT DOES IT COVER: Roll once over names, addresses, account numbers, barcodes, and prescription details on mail, statements, shipping labels, and boxes before recycling. The patented 0.5" masking pattern hides 3 lines of text in one pass.
- HOW MANY USES DO YOU GET: Each pre-inked Guard Your ID Advanced Roller delivers about 1,000 impressions (roughly 100 feet of coverage), so the 3-pack gives you around 3,000. A twist-on cap keeps the ink fresh for a 2-year shelf life.
- DOES IT WORK ON GLOSSY LABELS: Yes, on most glossy and coated surfaces, plus paper, envelopes, junk mail, and prescription labels. Give the ink 10 to 15 seconds to dry on slick surfaces; it is instant on paper. Results vary by coating.
- IS IT REFILLABLE: No, and that is the point. The Advanced Roller is pre-inked and sealed, so there are no refill cartridges to buy, no ink bottles to handle, and nothing to dry out on the shelf. When one runs out, reach for the next roller.
- SHREDDER OR ROLLER: No jams, no paper dust, no noise, and the page stays intact and recyclable. Covers boxes and shipping labels a shredder cannot. Faster than a redacting marker, fits in a drawer. Turquoise, Green, White: mail, office, parent.
| Data category | Bulk threshold |
|---|---|
| Human genomic data | More than 100 U.S. persons |
| Other human “omic” data | More than 1,000 U.S. persons |
| Biometric identifiers | More than 1,000 U.S. persons |
| Precise geolocation data | More than 1,000 U.S. devices |
| Personal health data | More than 10,000 U.S. persons |
| Personal financial data | More than 10,000 U.S. persons |
| Covered personal identifiers | More than 100,000 U.S. persons |
| Combined datasets | The lowest applicable threshold for a category included in the dataset |
The definition of bulk U.S. sensitive personal data is addressed in § 202.206. Data can still meet that definition if it is encrypted, pseudonymized, anonymized or de-identified. Advertising IDs, IP addresses, pixels and SDK data may also warrant review where they enable access to large datasets.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteGovernment-related data is a separate trigger
Government-related data is not simply another bulk-data category. It can trigger the program without the personal-data thresholds being met. Companies should identify it separately rather than assume that a dataset falls outside the rule because it contains too few people. DOJ describes the scope in its program overview; the final rule supplies the operative definitions.
How prohibited data brokerage can arise
The rule prohibits certain data-brokerage transactions that provide a country of concern or covered person access to government-related data or bulk U.S. sensitive personal data. Brokerage can include commercial arrangements such as licensing or subscription access; it is not limited to a one-time sale of a file. The transaction’s details and the recipient’s status determine whether the prohibition applies.
Rank #3
- Protect Your Privacy Effectively: you can use this identity protection roller stamp to flip personal information in under 2 seconds and save time and effort, effectively hiding and protecting your personal information, such as phone numbers, social security numbers, bank statements, shipping addresses, tax documents,data, billing addresses and many more
- Ideal Replacement for Shredder: if you are still using a shredder to shred cards or papers that are printed with your personal information, this security stamper roller will be an alternative tool to block out your privacy effectively and easily
- Refillable and Long Term Use: this confidential stamp can cover a total length of up to 100 meter/ 109 yards, approximately 3,200 prints are covered, pattern width is about 0.78 inches; When ink runs out, you can refill the security stamp with ink
- Easy to Use: just continuous roll the address blocker roller stamp to conceal information, and roll on a second layer for maximum protection, works on paper, envelopes, folders, address labels, etc., please note that may not work on smooth surfaces
- How to Refill the Ink: there are 4 pieces of ID stamp refills, each is about 1.5 ml, you just need to unscrew the cap of the ink bottle (not disposable, you can close the cap for next time of use), then insert it into the hole on the side of the stamp, then turn it upside down, about 5 minutes later, the most of the ink will be replenished to the security roller stamp
Advertising technology is one practical example. DOJ’s rule discusses a U.S. company providing identifiers, such as IP addresses or advertising IDs associated with more than 100,000 U.S. users’ devices, to an advertising exchange based in a country of concern. That example does not make every ad-tech transfer unlawful, but it shows why a company should examine identifiers, audience scale, exchange access and onward sharing. See § 202.214.
Restricted agreements require safeguards
Certain vendor, employment and investment agreements are restricted when they give a country of concern or covered person access to covered data. Rather than prohibiting every such arrangement, the rule allows qualifying transactions subject to specified security requirements. These include organizational and technical controls, data minimization, masking or other privacy-preserving methods, encryption, and appropriate control of decryption keys.
Encryption is not a blanket exemption. Depending on the arrangement, due diligence, audits, reporting and recordkeeping may still be required. DOJ’s CISA security requirements describe relevant safeguards, while the rule and DOJ guidance explain the compliance obligations.
Rank #4
- GREAT ALTERNATIVE TO A SHREDDER: Paper can be recycled after using the roller stamp, no need for a shredder
- SIZE AND WIDE COVERAGE: Length 2.36 INCH * width 1.26 INCH * height 2.36 INCH; Miseyo 1.5 inches wide Coverage roller stamp is perfect for covering large swaths of private information in a quick and clean way
- PROTECT PRIVACY IDENTITY THEFT: Easily use Miseyo's Roller Stamp to hide your business confidentiality contracts, court documents, barcodes on shipping labels, tax documents, bank statements, social security numbers, credit card statements and offers including your name and address private information, preventing identity theft, reject the harassment of privacy disclosure.NOT recommended to use on glossy surface
- UNLIMITED RE-INK: Miseyo roller stamp comes with an ink hole on the side, do not have to worry about the ink running out when you have to throw away the roller stamps, it can be refilled with ink for repeated use, no need to replace the roller, and permanently hide private identity information
- GOOD TIME SAVER: Are you still shredding private paper the old way? Trouble with pen scribbling 100 times? Burning danger and worry? Use miseyo stamp simple scroll to solve your worries and quickly hide your private and important information
Access matters, not just where data is stored
A server in the United States does not by itself resolve the issue. A company assessing access should consider:
- Who can view, retrieve or administer the data, including foreign affiliates and support personnel.
- Whether vendors, subcontractors or cloud administrators can reach production systems.
- Where maintenance, analytics and technical support take place.
- Who controls encryption keys and can decrypt the information.
- Whether employment, vendor, investment or corporate arrangements provide a foreign person with access.
The program does not require all covered data to be stored or processed in the United States. Its focus is on covered transactions and access under the rule’s terms, not a universal requirement to localize data.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Exemptions are specific, not sector-wide passes
The final rule includes exemptions, subject to their definitions and conditions, for certain personal communications; some financial-services transactions; certain corporate-group transactions; transactions authorized by federal law or international agreements; specified CFIUS-related investment agreements; telecommunications services; certain biological-product and medical-device authorizations; and some clinical investigations and health research. DOJ’s fact sheet and the final rule set out the scope. Being a healthcare, research or financial company does not automatically exempt every transfer or agreement.
Recommended Free Tools
Best Value
- [Fully Protect Your Privacy] The identity theft protection roller stamp is the perfect choice to protect your private information. With a gentle scroll, you can cover personal details perfectly. You don't have to worry about spending too much time covering courier information and tearing up old documents. More convenient and faster than a shredder
- [Wide Scope of Application] The roller protection stamp can hide confidential information and prevent identity theft, such as courier bills, bank statements, utility bills, medicine labels, and contract documents. It covers any information you want to hide
- [Time-saving] 0.98-inch wide roller, you can quickly cover a large piece of personal information without scrolling many times, bringing convenience to your work life; with no need to worry about privacy leakage
- [How to open the lid] Open the guard your id stamp roller by gently squeezing the top on both sides. Note: After using this security stamp, let it sit for a few minutes and wait for the ink to dry to cover the message more perfectly
- [Refill Ink Provided] The confidential roller stamp includes four refills (5 ml per refill bottle); when the ink runs out, you can refill it at the privacy stamp roller side without replacing the roller. Add 10-15 drops of ink when the impression is not clear
When compliance obligations applied
The program took effect April 8, 2025. DOJ’s current overview says affirmative due-diligence, audit, reporting and related obligations for restricted transactions took effect October 5, 2025. However, § 202.1001 says a data-compliance program was required “by no later than October 6, 2025.” Because those dates differ by one day, companies facing a filing or compliance deadline should check the operative regulation and consult counsel rather than assume the discrepancy has been resolved.
A practical review for companies
The following steps help identify issues for legal and security review; they are not a substitute for interpreting the rule for a specific transaction.
- Inventory the data. Identify genomic and other omic, biometric, geolocation, health, financial and covered-identifier datasets, as well as combinations and government-related data.
- Measure the rolling period. Quantify people or devices for the preceding 12 months and account for aggregation across covered transactions.
- Map access pathways. Include affiliates, vendors, subcontractors, cloud administrators, support staff and encryption-key custodians—not just storage locations.
- Screen counterparties. Assess whether a country of concern or covered person is involved, including relevant ownership, control, jurisdiction or direction.
- Classify the transaction. Determine whether it is data brokerage, a vendor, employment or investment agreement, or another covered transaction under § 202.210.
- Test any exemption or license. Check the exact regulatory conditions instead of relying on a sector label or general understanding of the business relationship.
- Build evidence and controls. For applicable restricted transactions, establish documented risk-based procedures, data-flow and party records, transfer and end-use records, required security measures, due diligence, audits, reporting and record retention.
- Review contracts and changes. Address onward access, subcontracting, key management, audit rights, deletion, incident response and changes in ownership or control.
Common mistakes include counting only one database instead of aggregating transactions, ignoring ad identifiers because they are not names, assuming encryption or U.S. hosting resolves access, and treating de-identified information as categorically outside the rule. DOJ’s FAQs and compliance guide provide additional implementation detail.
What consumers and businesses should expect
Most consumers do not have a direct compliance obligation. The rule does not create a private right of action allowing an individual to sue simply because personal data crossed a border. People may nevertheless see indirect effects: companies could change data-sharing contracts, limit some foreign-linked analytics or advertising arrangements, or use more data minimization, masking and encryption.
For businesses, the rule operates alongside state privacy laws, sector-specific health and financial requirements, federal consumer-protection law, CFIUS measures, telecommunications national-security controls, and contractual and cybersecurity duties. Compliance with Part 202 does not replace those regimes, and falling below its bulk thresholds does not establish that a data practice is lawful under other rules.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
