Department of Justice Data Rule
If you are traveling abroad and need to access sensitive data on U.S. persons, you should consult with Science and Security before sending, or accessing, the data abroad.
If you are prompted to contact Science and Security on a proposal, you should consult with their team before beginning work.
Effective April 8, 2025, the Data Security Program (DSP) issued by the U.S. Department of Justice (DOJ) established national security safeguards around the handling of certain categories of sensitive U.S. personal data, as mandated by Executive Order 14117. This ruleset places specific restrictions on how large datasets that contain specific information regarding U.S. persons may be accessed, stored, or transferred when entities or individuals from or associated with foreign countries of concern are involved.
The Data Security Program is designed to reduce the risk that large-scale datasets could be exploited for surveillance, targeting, or other activities that could compromise individual privacy or national security. UNC Research works carefully to ensure that these datasets are managed in compliance with federal data security requirements.
Proposal FAQs
When do you need to contact Science and Security on a proposal?
If your project may:
- involve U.S. Government-Related Data or Bulk U.S. Sensitive Personal Data meeting or exceeding the bulk thresholds and
- involve a foreign person or entity
Then, when you complete your Internal Processing Form (IPF), you will be prompted to contact the Science and Security Office.
Science and Security will review to determine the scope is permissibility and/or if additional support is required.
What information should you provide to Science and Security?
Provide the:
- Foreign country involved
- Scope of the work
- Nature and type of data
Questions: Contact the Science and Security Office
What is “Bulk Sensitive Personal Data” as defined by the DSP?
“Bulk Sensitive Personal Data” refers to large datasets that contain sensitive or detailed information about U.S. persons. If these datasets are accessed, stored, processed, or transferred in ways that allow federally-defined foreign government of concerns, or entities they control, national security risks may occur.
What is included in “Bulk Sensitive Personal Data”?
- Personal identifiers: Data that can identify an individual either directly or indirectly. These include names linked to Social Security numbers, driver’s license numbers, passport numbers, or other identifiable information.
- Health and Medical Information: Including electronic health records, medical histories, treatment data, lab results, and other individual health information.
- Human Genomic Data: Including whole genome sequences, exome data, and other genetic information tied to human subjects.
- Biometric Identifiers: Including fingerprints, facial recognition data, iris scans, voiceprints, gait patterns, or other physiological traits that are personally identifiable.
- Precise Geolocation Data: Location information that is tied to specific devices or individuals, including location history from mobile devices.
- Financial Information: Including bank account details, credit or debit card numbers, income information, or other personal financial data.
What are the thresholds of “Bulk Sensitive Personal Data”?
The thresholds are defined in 28 CFR 202.205 Bulk.
| Covered Personal Identifiers | 100,000 U.S. persons |
| Personal Financial Data | 10,000 U.S. persons |
| Personal Health Data | 10,000 U.S. persons |
| Precise Geolocation Data | 1,000 U.S. persons |
| Biometric Identifiers | 1,000 U.S. persons |
| Human Genomic Data | 100 U.S. persons |
What is Government-related data?
“Government-related data” entails precise geolocation data, regardless of volume, for:
- Any place within the Government-Related Location Data List, or
- Any Sensitive Personal Data related to current or former U.S. federal employees or contractors.
- In this case, any amount qualifies and the above threshold do not apply.
What is your responsibility as a researcher?
- It is your responsibility to seek prior approval before transferring any data in these categories to a country of concern.
- Request travel and telework pre-authorization through campus processes for travel and telework abroad.
- Additionally, there are specific restrictions on exporting data to Russia, Venezuela, and China.
- Please consult with Research Compliance Services prior to conducting research in these countries.