{"id":21432,"date":"2026-04-01T11:42:59","date_gmt":"2026-04-01T15:42:59","guid":{"rendered":"https:\/\/www.rochester.edu\/university-research\/?page_id=21432"},"modified":"2026-04-01T11:56:55","modified_gmt":"2026-04-01T15:56:55","slug":"doj-regulations-access-bulk-us-sensitive-data","status":"publish","type":"page","link":"https:\/\/www.rochester.edu\/university-research\/compliance\/research-security\/doj-regulations-access-bulk-us-sensitive-data\/","title":{"rendered":"DOJ Regulations Regarding Access to Bulk U.S. Sensitive Data"},"content":{"rendered":"","protected":false},"excerpt":{"rendered":"","protected":false},"author":6,"featured_media":0,"parent":3082,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-21432","page","type-page","status-publish","hentry"],"acf":{"lead_in":"","display_title":"","subtitle":"","call_to_action":"","hero_image_placement":"no_image","hero_media":"images","hero_pattern_option":"","hero_video":"","hero_image_landing":"","hero_image_landing_two":"","hero_image_landing_three":"","content_modules":[{"acf_fc_layout":"text","anchor":"","css_class":"","title":"

Overview<\/h2>","content":"The Department of Justice (DOJ) has issued a Final Rule<\/a> titled \u201cAccess to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons\u201d (the Final Rule). Below are FAQs that explain how the Final Rule impacts the sharing of U.S. sensitive personal data or U.S. government-related data with certain countries outside of the U.S., particularly in the University of Rochester research context. Researchers handling the sensitive data described in the Final Rule must ensure compliance with its requirements.<\/strong>\r\n\r\nFor a brief overview of the Final Rule, see IAPP\u2019s \u201cCheat Sheet<\/a>\u201d overview. More information can also be found in FAQs issued by the DOJ<\/a>.\r\n\r\nIn implementing the Final Rule, the National Institutes of Health (NIH) has also issued a Policy on Enhancing Security Measures for Human Biospecimens<\/a> that prohibits institutions and researchers that hold human biospecimens of U.S. persons<\/strong> collected, obtained, stored, used, or distributed using on-going or new NIH funds from distributing<\/strong> the human biospecimens to institutions or parties located in countries of concern<\/strong>.","background_color":"#ffffff","width":"width-medium"},{"acf_fc_layout":"accordion_new","anchor_id":"","classes":"","title":"

Frequently asked questions<\/h2>","description":"","background":"plain","background_color":"#ffffff","style":"row_blank","expand":"yes","accordions":[{"acf_fc_layout":"accordion","accordion_title":"What data and transactions does the Final Rule regulate?","icon":"","row_content":"The Final Rules imposes requirements on U.S. persons and entities that provide access to bulk U.S. sensitive personal data<\/strong><\/a> or U.S. government-related data<\/strong><\/a> to countries of concern<\/strong><\/a> or covered persons<\/strong><\/a> that involves (1) data brokerage<\/strong><\/a>, (2) a vendor agreement<\/strong><\/a>, (3) an employment agreement<\/strong><\/a>, or (4) an investment agreement<\/strong><\/a>.","accordion_anchor":""},{"acf_fc_layout":"accordion","accordion_title":"What are the countries of concern?","icon":"","row_content":"The Final Rule identifies China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela as countries of concern.","accordion_anchor":""},{"acf_fc_layout":"accordion","accordion_title":"What is a covered person?","icon":"","row_content":"\u201cCovered persons<\/a>\u201d include entities<\/strong> that are organized or chartered under the laws of, or have their principal place of business in, a country of concern<\/strong>, individuals who are employees or contractor of a country of concern or covered person<\/strong>, or non-U.S. persons who are primarily a resident of a country of concern<\/strong>. Covered persons also include any individuals specifically designated by the DOJ.\r\n\r\nFor purposes of the Rule, an individual is a U.S. person (and not a covered person) if the individual is located in the United States, regardless of whether they are a citizen of a country of concern, unless specifically designated by DOJ.","accordion_anchor":""},{"acf_fc_layout":"accordion","accordion_title":"What is considered bulk U.S. sensitive personal data?","icon":"","row_content":"The Final Rules define six categories of U.S. sensitive personal data that have defined \u201cbulk\u201d thresholds detailed below.\r\n