A.S.H.A. LAW OFFICE PLLC
DOJ DATA SECURITY
PROGRAM (DSP)
The DOJ Data Security Program regulates certain transactions that could provide countries of concern or covered persons access to Americans’ bulk sensitive personal data or U.S. Government-related data.
What Data Is Covered?
The DSP focuses on two types of data when held in bulk.
Bulk Sensitive Personal Data
Certain categories of personal data about
U.S. persons, when the data meets or exceeds
the applicable thresholds.
U.S. GOVERNMENT-RELATED DATA
Any amount of data that the U.S. Government
produces or possesses, or data provided to
the Government under a contract.
Bulk Sensitive Personal Data Thresholds
Human Genomic Data
100
U.S. persons
Epigenomic
Data
1,000
U.S. persons
Proteomic
Data
1,000
U.S. persons
Transcriptomic
Data
1,000
U.S. persons
Biometric
Data
1,000
U.S. persons
Precise Geolocation Data
1,000
U.S. persons
Personal Health
Data
10,000
U.S. persons
Personal Financial Data
10,000
U.S. persons
Covered Personal Identifiers
100,000
U.S. persons
Any amount of U.S. Government-related data is covered.
Section 2 — What Transactions Does the DSP Regulate?
The DSP applies to transactions that may result in access to covered data by countries of concern or covered persons.
Data Brokerage
Buying, selling, or licensing bulk U.S. sensitive personal data or U.S. Government-related data.
VENDOR AGREEMENTS
Providing or obtaining a service involving access to bulk U.S. sensitive personal data or U.S. Government-related data.
Employment Agreements
Employing or contracting with covered persons who may access bulk covered data.
Investment Agreements
Certain investments in U.S. businesses that could result in access to bulk covered data.
Transactions may be PROHIBITED, RESTRICTED, or EXEMPT depending on the facts and applicable requirements.
3. WHO CREATES THE FOREIGN NEXUS?
COUNTRIES OF CONCERN
Foreign countries, including the People’s Republic of China, Russia, Iran, and North Korea.
Covered Persons
Individuals or entities subject to the jurisdiction or direction of a country of concern.
Not all foreign persons create a nexus.
The DSP turns on countries of concern and covered persons.
4. WHAT HAPPENS IF THE DSP APPLIES?
Prohibited
The transaction is generally not permitted unless an applicable authorization or exception applies.
RESTRICTED
The transaction may proceed only if applicable security and compliance requirements are met.
EXEMPT / NOT COVERED
The transaction may fall outside the DSP’s prohibition or restriction framework.