Tools / Regulatory tracker / DOJ bulk sensitive data rule (28 CFR part 202)
Regulatory tracker · United States · Data security
DOJ bulk sensitive data rule (28 CFR part 202)
Restricts vendor, employment and investment agreements giving countries of concern access to bulk US data; cloud services are vendor agreements.
In force Effective 8 April 2025.
What it does
The rule in brief
The Department of Justice rule prohibits some, and restricts other, transactions that could give countries of concern or covered persons access to bulk US sensitive personal data or government-related data. Restricted transactions include vendor, employment and investment agreements, which must meet CISA security requirements. The rule's preamble states that the provision of cloud-computing services falls squarely within the definition of a vendor agreement.
Timeline
Key dates
| Date | What happens |
|---|---|
| 8 April 2025 | Rule takes effect |
Primary sources
Read it at source
- Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern, 90 FR 1636 (8 Jan 2025) Federal Register
Cite as: InfraCompute regulatory tracker, “DOJ bulk sensitive data rule (28 CFR part 202)”, checked 27 October 2026, https://www.infracompute.co.uk/tools/regulatory-tracker/us-bulk-data-rule.
Related
Also on the tracker
US export controls on advanced AI chips
Licences for advanced GPUs to most of the world outside close allies; China moved to case-by-case for H200-class chips.
United States · Export controlsAI Diffusion rule (rescinded)
The January 2025 country-tier rule was rescinded in May 2025; BIS said a replacement rule would follow.
United States · Export controlsData Center Validated End User authorisation
Pre-approved data centres abroad can receive controlled chips without a licence for each shipment.
United States · Export controlsUAE moved to Country Group A:5
Licence-free access to advanced computing items for the UAE Government and approved UAE entities.
Method
Each entry is written from the official text and the government, regulator or legislature pages listed above, never from secondary commentary. New documents on the Federal Register are picked up automatically and listed here. Status and dates can change after the review date, so check the source before relying on it. General information drawn from public filings. It is not legal advice on any transaction, and using this page does not create a lawyer-client relationship. Views are personal.
