On this page
Who receives access?
Identify the U.S. person providing access as well as the foreign recipient, data and agreement.
Part 202 can reach reading, viewing, editing or otherwise receiving data through a system or cloud platform. A foreign address alone does not establish a prohibited transaction.
Apply the actual covered-person and countries-of-concern definitions, including relevant ownership, organisation, employment, primary residence and designation. The recorded list names China, Cuba, Iran, North Korea, Russia and Venezuela, with China’s stated Hong Kong/Macau scope. Citizenship or an OFAC name result is not the complete test; an unlisted entity can qualify.
The data and count matter
Government-related data has specified regardless-of-volume criteria. Bulk sensitive U.S. personal data uses the following more-than thresholds under the category conditions. Aggregate over the preceding 12 months with the prescribed same-party rules; a new invoice does not restart the count. Mixed datasets have their own rule.
| Data category | Bulk threshold under the category conditions |
|---|---|
| Human genomic | More than 100 U.S. persons |
| Other human-omic or biometric | More than 1,000 U.S. persons |
| Precise geolocation | More than 1,000 U.S. devices |
| Health or financial | More than 10,000 U.S. persons |
| Covered identifiers | More than 100,000 U.S. persons |
What arrangement gives the access?
Data brokerage and specified human-omic transactions have prohibitions. Relevant vendor, employment and investment transactions can be restricted, subject to actual security and other conditions, including the required diligence programme and annual audit.
The corporate-group administrative/ancillary exemption is bounded. An independent franchise or licence partner is not automatically a subsidiary or affiliate. Prescribed security requirements cannot simply be replaced with controls the business regards as equivalent.
A restricted transaction needs controls at two levels
The Cybersecurity and Infrastructure Security Agency (CISA) requires organizational and covered-system controls, plus a combination of data safeguards that fully and effectively prevents covered persons or countries of concern accessing covered data that is linkable, identifiable, unencrypted or decryptable using commonly available technology. Masking names can be insufficient if the recipient can reconnect records using other data.
The six-page requirements include monthly IT-asset inventory updates, remediation of known exploited vulnerabilities in internet-facing systems within 45 calendar days (with compensating requirements if patching is infeasible), and access/security logs stored centrally for at least 12 months. They require multifactor authentication; where technically infeasible or not enforced, passwords must have sufficient strength, including at least 15 characters.
Choose and justify the data safeguards through an internal risk assessment. The encryption option covers transit and storage: keys must not be co-located with the data, stored in a country of concern or accessible to covered persons. These are examples, not the full control list. Applying a security control does not turn a prohibited transaction into a permitted restricted transaction.
The earlier grace policy has ended
The programme began April 8, 2025. The cited operative diligence/audit provisions use October 6, 2025; the Department of Justice (DOJ) overview’s October 5 wording is the recorded source difference. The old good-faith enforcement-priority period ended July 8, 2025 and is not continuing grace.
Scope
- These thresholds are not a general privacy safe harbour. No exemption, access authorisation or security attestation is supplied; origin-country, sector and other privacy duties remain separate.
Next step
Establish the actual recipient, accessible data and transaction before assuming the helpdesk account is permitted or exempt.
Sources & review notes
U.S. Department of Justice
Passage, dates and research notes
primary · §§ 202.201,205–211,222,301–303,401,506,601,1001–1002; scoped 1101
more than 100 U.S. persons
Read selected actual definitions/thresholds, access/party/transaction gates, prohibitions/restrictions, corporate-group exemption, countries, due diligence/audits and retention context; not every282KB example or exemption. Bulk uses exact more-than category counts and preceding 12-month aggregation; government-related data has separate regardless-of-volume criteria. Operative1001/1002 text saysOctober 6,2025; DOJ overview says October 5, a recorded one-day discrepancy. No technical CISA-controls implementation review or transaction clearance.
U.S. Department of Justice, National Security Division
Passage, dates and research notes
official-guidance · Complete main overview, current resources and historical-document status
went into effect on April 8, 2025
Read full main page updatedOctober8,2026. Separates actual final program from historical NPRM and enforcement period. Overview’s October 5 affirmative-phase wording differs from operative CFR/policy October 6; the guide follows actual CFR for1001/1002.
U.S. Department of Justice, National Security Division
Passage, dates and research notes
official-guidance · Complete three-page policy and time limit
At the end of this 90-day period
Read complete policy. Good-faith initial civil-enforcement prioritisation applied April 8–July 8,2025, not continuing grace; egregious/willful matters were not covered. It expressly creates no enforceable rights and identifiesOctober 6 affirmative requirements.
U.S. Department of Justice
Passage, dates and research notes
primary · II(A), IV(A)–(B), guidance limitations
October 6,
Official guidance corroborates operative date and explains that guidance compliance is no safe harbour. It refers to CISA requirements rather than reproducing the full controls. Detailed CISA access remains blocked. Review is limited to II(A), IV(A)–(B), guidance limitations. No human or professional legal review is claimed.
Cybersecurity and Infrastructure Security Agency
Passage, dates and research notes
primary · Complete six-page document; definitions; I(A)–(C), II(A)–(D)
For any restricted transaction, implement a combination
Complete 278-line official PDF reader representation read. Initial direct requests403; fresh official search-result open recovered all six pages. Hash identifies the retained reader JSON, not downloaded PDF bytes. All organization/system controls apply to covered systems; select sufficient data-level mitigations together, including stated qualified alternatives and conditions. NIST/CPG references aid understanding, not mandatory adoption of every separate framework. No transaction or implementation attestation.
Detailed rule records (1)
28CFRPart 202 prohibits or restricts defined transactions involving access by countries of concern/covered persons to government-related data or bulk U.S. sensitive personal data. Restricted transactions have actual security, diligence and audit conditions; foreign access alone is not the complete test.
28 CFR Part 202: Data Security Program scope and duties DOJ Data Security Program: current overview and resources DSP implementation/enforcement policy through July 8, 2025 CISA Security Requirements for Restricted Transactions: final January 2025 textKeep this reading in your learning library.
Progress privacy
Off by default. Without remembering, changes last on this page. If enabled, only public content identifiers and self-reported progress are stored in this browser profile. Anyone using the same profile could see them. No plan inputs or contact details are included. Reset or export in learning settings.
This is a reading aid, not evidence of disclosure delivery, expertise or legal approval.