DOJ Bulk Sensitive Data Rule
Regulation
United States (federal)
· 2025
The DOJ Data Security Program prohibits or restricts transfers of bulk US sensitive personal data and government-related data to countries of concern and to covered persons — including through ordinary vendor, employment and investment agreements. It is a national-security regime that operates on the shape of a company's data flows and supply chain, it has been fully in force since October 2025, and it reaches a very large number of companies that have never thought of themselves as export-controlled.
Horizontal regime. It binds companies by what they do with data, software or
customers, not by the sector they sit in. The industries below are where it creates
specific, additional duties — not the limit of who has to comply.
Regions
Industries
Each links to that industry as a scored cohort — so the question "how ready is this sector for the regime that governs it?" becomes one you can actually look at.