In early 2025, the U.S. Department of Justice finalized its new Data Security Program Rule. This novel U.S. data export rule took effect on April 8, and its implications are likely broader than organizations may anticipate. Enforcement of the Rule commences in July.
This Rule was issued under Executive Order 14117, formally titled “Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons,” and accompanied by security requirements for restricted data transactions published by the U.S. Cybersecurity and Infrastructure Security Agency.
At a high level, the Rule either prohibits or restricts the transfer, access, or storage of specified categories of bulk sensitive personal data, including anonymized sensitive personal data, to or by certain countries of concern or individuals associated with those countries. This webinar will address the practical aspects of the Rule and potential implications. In particular, we will focus on:
- Categories of data covered by the Rule
- Prohibited and restricted transactions
- Evaluating personal data uses to determine compliance obligations
- Essential compliance elements and considerations
- Vendor oversight and customer due diligence under the Rule
- Implementing appropriate security measures to safeguard restricted data transactions
- Potential penalties for non-compliance
1.0 CLE credit hour approved for CA, NY, PA, and TX. Approval pending for CO, DE, IL, GA, FL, OH, NJ, and WA. Other states may be available upon request.
