On April 8, 2025, the Department of Justice’s final rule implementing Executive Order 14117 (“Final Rule”) went into effect, with the exception of certain due diligence, audit and reporting obligations that will take effect on October 5, 2025. The Final Rule restricts the bulk transfer of sensitive U.S. personal and government data to certain countries and persons of concern.

The Final Rule establishes a national security regulatory regime that either prohibits or restricts “covered data transactions,” which are certain transactions (i.e., data brokerage, employment agreements, investment agreements and vendor agreements) that could result in access to bulk U.S. sensitive personal data or government-related data by (1) a “country of concern” (i.e., China, Cuba, Iran, North Korea, Russia and Venezuela) or (2) a “covered person” (e.g., an entity with 50% or more ownership by a country of concern, an entity organized under the laws of, or with their principal place of business in, a country of concern, or a foreign person that is an employee or contractor of such entity or a primary resident of a country of concern). 

Read our previous coverage of the Final Rule.