Key takeaways
- July 8, 2025 is new enforcement date for most regulations
- Companies must be engaged in good faith compliance efforts to fall under safe harbor
- National Security Division encourages individuals and companies with enforcement-related questions to reach out. Formal advisory opinions will not be reviewed or adjudicated during this timeframe
The Department of Justice (DOJ) announced that it will delay enforcement of the rule regulating bulk transfers of sensitive data to countries of concern, such as China and Russia. On April 11, 2025, the DOJ announced a 90-day delay in the enforcement of this rule and acknowledged how the rule may require affected companies to revise or create new policies, identify data flows, change vendors, or adjust employee roles or responsibilities.1 The DOJ, however, said that while enforcement of the rule will be delayed, companies must be engaged in good faith compliance efforts.
Rule on restricting data to countries of concern
As a reminder, the rule on “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” (Final Rule) is a Biden-era executive order that restricts certain data transfers to countries of concern. Specifically, businesses are prohibited from processing and transferring certain amounts of human ‘omics data, biometric data, precise geolocation data, personal health data, or personal financial data to these key countries unless one of the exceptions applies. In addition, companies engaging in transactions that fall under the Final Rule will need to consider privacy compliance measures and adhere to audit and record retention requirements.