This is the first in a three-part series distinguishing existing privacy laws from the emerging area of national security data laws. Part Two will examine the real-world threat environment that motivated these regulations. Part Three will outline practical steps organizations can take to assess and address their exposure.
By Asha S. Geire (originally published via the he Traveling Privacy Lawyer in Substack).
This week I want to highlight an area of law that is generating significant compliance activity at large companies but has not yet reached the mid-size and smaller organizations it also covers. As someone who has spent a long time working in the national security space, I think smaller companies are not yet tracking these risks — and thinking about commercial activity in national security terms does not come naturally outside the Defense Industrial Base. This series is intended to help change that.
Let’s start with what most organizations already know: privacy laws.
Privacy Laws — The Familiar Framework
Most companies are familiar with privacy laws, including HIPAA, CCPA, COPPA, GDPR, and FTC Section 5 enforcement. These frameworks are organized around the relationship between an organization and the individuals whose data it handles. Regulators ask: were people given appropriate notice? Was consent obtained where required? Is the data being used for the purpose it was collected? Is it adequately protected against unauthorized access? When something goes wrong, the harm privacy law addresses is primarily to the individual whose information was misused or exposed.
National Security Data Laws — A Different Question Entirely
National security data laws are organized around the national security interests of the United States. These frameworks ask: is U.S. sensitive personal data, or data related to U.S. government activities, flowing to foreign adversaries in ways that could enable espionage, surveillance, coercion, disinformation, or military targeting?
This distinction matters practically. An organization can satisfy every privacy obligation it has and still be in violation of national security data law. These are different legal regimes, enforced by different agencies, with different compliance requirements. A privacy policy does not substitute for a national security data compliance program.
The Two Primary Frameworks
The two national security data frameworks currently in force are the Department of Justice’s Data Security Program (DSP) and the Protecting Americans’ Data from Foreign Adversaries Act.
The Data Security Program
The DSP was finalized under Executive Order 14117, codified at 28 C.F.R. Part 202, and administered by the Foreign Investment Review Section of DOJ’s National Security Division. Its core prohibitions and restrictions took effect April 8, 2025. Affirmative compliance obligations — including due diligence, audit, and reporting requirements — took effect October 6, 2025. Full civil enforcement began July 9, 2025.
DOJ has described the DSP as establishing what are effectively export controls on data — i.e. restricting transfers of covered data to entities and individuals connected to Countries of Concern: China, Russia, Iran, North Korea, Cuba, and Venezuela.
Protecting Americans’ Data from Foreign Adversaries Act
PADFAA was enacted in 2024 and is enforced by the FTC. It is narrower in scope than the DSP — it applies specifically to data brokers and restricts them from transferring sensitive data about U.S. persons to entities under the control of foreign adversaries. The FTC sent letters to thirteen data brokers in February 2026 reminding them of their PADFAA obligations, and current FTC leadership has indicated enforcement is a priority.
These two frameworks are related but distinct. A company can be subject to one and not the other, or to both simultaneously. Understanding which applies requires a facts-and-circumstances analysis specific to your organization’s data practices and counterparty relationships.
What Data the DSP Covers
The DSP covers bulk U.S. sensitive personal data and U.S. government-related data. Sensitive personal data includes precise geolocation data, biometric identifiers, human genomic data, personal health data, personal financial data, and certain device-based identifiers. Government-related data includes data linked to sensitive government facilities or personnel.
Three features of these definitions are worth noting. First, the DSP covers anonymized, pseudonymized, and de-identified data — a broader scope than most privacy frameworks. Second, the bulk thresholds that trigger coverage are relatively modest: for most categories, data on more than one thousand U.S. persons in a calendar year; for geolocation data, one thousand or more U.S. devices. Third, coverage extends to a company that knowingly installs or approves advertising technologies — such as tracking pixels or software development kits — that enable the transfer of covered data to third parties who qualify as Covered Persons. A company that does not collect or sell data as its primary business may nonetheless have covered transaction obligations if it integrates a third-party SDK or analytics tool that collects location or device identifier data from more than one thousand U.S. users and transfers that data to an entity headquartered in or controlled by a Country of Concern. The obligation arises from the integration decision, not from any intent to transfer data internationally.
What Transactions Are Covered
A covered data transaction is one that involves access by a Country of Concern or a Covered Person to covered data, and that takes the form of a data brokerage arrangement, a vendor agreement, an employment agreement, or an investment agreement.
Covered Persons include foreign entities headquartered in or majority-owned by a Country of Concern; foreign individuals who are employees or contractors of such entities; foreign individuals who are primarily residents of a Country of Concern; and persons designated by the National Security Division on its published Covered Persons List.
The regulation distinguishes between prohibited transactions — which may not occur under any circumstances absent a specific license — and restricted transactions, which may occur if the organization implements required compliance measures. Prohibited transactions include the transfer of bulk genomic data to a Country of Concern or Covered Person. Restricted transactions include most other categories of covered data transfers and are subject to the compliance program requirements described below.
What Compliance Requires
For organizations engaged in restricted transactions, the DSP requires a written, annually certified Data Compliance Program. This is a structured compliance document — not a privacy policy — that describes an organization’s policies and procedures for identifying and managing covered transaction risk. It must include a designated compliance officer, risk-based due diligence procedures for assessing counterparties, employee training, and recordkeeping maintained for a minimum of ten years.
The DSP Compliance Guide issued by NSD in April 2025 frames the core expectation as requiring organizations to know their data: to understand what they collect, where it flows, who has access to it, and whether any of those access points involves a Country of Concern or Covered Person. Annual audits of the compliance program are required, and organizations must certify the program’s adequacy on an annual basis.
The Enforcement Picture
Civil penalties under the DSP reach the greater of $368,136 per violation or twice the value of the transaction. Willful violations carry potential criminal penalties of up to $1,000,000 and twenty years imprisonment.
For organizations that discover potential compliance gaps, voluntary self-disclosure is a meaningful option. DOJ’s Corporate Enforcement Policy creates incentives for organizations that promptly self-disclose, cooperate fully, and remediate — and the general experience from analogous regimes including OFAC sanctions and export controls is that organizations that come forward proactively are treated meaningfully differently than those discovered through enforcement. It is also worth noting that FinCEN has established a whistleblower program under which individuals who report DSP violations may be eligible for financial awards if the information leads to an enforcement action resulting in penalties exceeding one million dollars — adding an insider reporting dimension that organizations should factor into their compliance posture.
Three Threshold Questions
For organizations uncertain about their exposure, three questions can help frame the initial analysis.
First, does your organization collect, store, or transfer bulk sensitive personal data — including geolocation, health, financial, biometric, or device data — on more than one thousand U.S. persons or devices in a calendar year?
Second, does your organization have any vendor relationship, investment relationship, employment relationship, or counterparty arrangement that could involve a Country of Concern or a Covered Person — including foreign cloud service providers, foreign-developed software tools, foreign investors, or foreign national employees with access to covered data?
Third, if your organization aggregates and sells or transfers data about individuals with whom you do not have a direct relationship, PADFAA may apply independently of the DSP.
These are starting points, not a complete compliance assessment. But they are useful for identifying whether a more detailed analysis is warranted.
In Part Two, I will examine the real-world incidents that illustrate why these regulations exist — and what the threat environment looks like for organizations that have not yet thought of themselves as national security actors.
**Disclaimer: This newsletter is for informational purposes only. It is not legal advice, and reading it does not create an attorney-client relationship. Consult a qualified attorney before making decisions based on anything published here.**