Department of Justice Bulk Data Rule
If you are traveling abroad and need to access sensitive data on U.S. persons, you should consult with Research Security before sending, or accessing, the data abroad.
If you are prompted to contact Research Security on a proposal, you should consult with their team before beginning work.
Effective April 8, 2025, the Data Security Program (DSP) issued by the U.S. Department of Justice (DOJ) to implement Executive Order 14117 established, among other things, national security safeguards around the handling of certain categories of Sensitive Personal Data and Government-Related Data. The DSP, contained in 28 CFR 202, places specific restrictions on how datasets that contain Sensitive Personal Data regarding U.S. persons may be accessed, stored, or transferred when Countries of Concern, or entities or individuals from, associated with, or controlled by Countries of Concern (“Covered Persons”) are involved.
The Data Security Program is designed to reduce the risk that datasets could be exploited for surveillance, targeting, or other activities that could compromise individual privacy or national security. UNC Research works carefully to ensure that these datasets are managed in compliance with federal data security requirements.
Proposal FAQs
When do you need to contact Research Security on a proposal?
If your project may:
- involve U.S. Government-Related Data in any amount, or Bulk U.S. Sensitive Personal Data in amounts approaching, meeting, or exceeding the bulk thresholds and
- involve a foreign country, or individuals or entities associated with or controlled by a foreign country
Then, when you complete your Internal Processing Form (IPF), you will be prompted to contact the Research Security Office.
Research Security will review to determine the scope is permissibility and/or if additional support or review is required.
What information should you provide Research Security?
Provide the:
- Foreign country or individual or entity associated with or controlled by a foreign country involved
- Scope of the work
- Nature and type of data
Questions: Contact the Research Security Office
What is “Bulk Sensitive Personal Data” as defined by the DSP?
“Bulk Sensitive Personal Data” refers to datasets exceeding certain thresholds that contain sensitive or detailed information about U.S. persons. In order to mitigate national security risks, federally-defined Countries of Concern or Covered Persons are prohibited from accessing, storing, processing, or transferring these datasets.
What is included in “Bulk Sensitive Personal Data”?
- Personal Identifiers: Identifying data that is or can be linked to an individual or to other identifying data directly or indirectly. Identifying data includes names, Social Security numbers, driver’s license numbers, passport numbers, financial information, device information, demographic data, account data, or other identifiable information.
- Financial Information: Including bank account details, credit or debit card numbers, income information, or other personal financial data.
- Health and Medical Information: Including electronic health records, medical histories, treatment data, lab results, and other individual health information.
- Precise Geolocation Data: Location information that is tied to specific devices or individuals, including location history from mobile devices.
- Biometric Identifiers: Including fingerprints, facial recognition data, iris scans, voiceprints, gait patterns, or other physiological traits that are personally identifiable.
- Human Genomic Data and other ‘Omic Data: Including whole genome sequences, exome data, epigenomic data, proteomic data, transcriptomic data, and other genetic information tied to human subjects.
What are the thresholds of “Bulk Sensitive Personal Data”?
The thresholds are defined in 28 CFR 202.205 Bulk.
| Covered Personal Identifiers | 100,000 U.S. persons |
| Personal Financial Data | 10,000 U.S. persons |
| Personal Health Data | 10,000 U.S. persons |
| Precise Geolocation Data | 1,000 U.S. persons |
| Biometric Identifiers | 1,000 U.S. persons |
| Human Genomic Data and Other ‘Omnic Data | 100 U.S. persons |
What is “Government-Related Data”?
“Government-related data” entails precise geolocation data, regardless of volume, for:
- Any place within the Government-Related Location Data List, or
- Any Sensitive Personal Data related to current or former U.S. federal employees or contractors.
In this case, any amount is covered by the DSP and the above thresholds do not apply.
What is your responsibility as a researcher?
- It is your responsibility to seek prior approval before transferring any data in these categories to a country of concern.
- Requests do not guarantee that approval will be granted.
- Request travel and telework pre-authorization through campus processes for travel and telework abroad.
- Additionally, there are specific restrictions on exporting data to Russia, Venezuela, and China.
- Please consult with the Research Security Office prior to conducting research in these countries.