Navigating the DOJ final rule on bulk sensitive personal data: What does it mean for your business?

Why it matters

The DOJ rule is fundamentally different from existing privacy regimes like the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). Its unique definitions, low thresholds, and security requirements necessitate a strategic approach that combines legal, operational and cybersecurity capabilities. I believe organisations should take immediate action in three key areas:

• Establish holistic data inventories: Understand where sensitive data resides, how it's used and who has access to it.
• Modernise business processes: Review and update operations to eliminate or isolate in-scope data transfers.
• Implement targeted security controls: Align with the Cybersecurity and Infrastructure Security Agency’s (CISA) mandated controls for restricted transactions, including data minimisation, encryption, access management and ongoing audits.

What they say 

Todd Blanche, United States Deputy Attorney General

“If you’re a foreign adversary, why would you go through the trouble of complicated cyber intrusions and theft to get Americans’ data when you can just buy it on the open market or force a company under your jurisdiction to give you access? The Data Security Programme makes getting that data a lot harder.”

What we say

The rule’s scope means organisations will need to enhance their data classification and processing inventories, especially for U.S.-based operations where such capabilities have lagged international counterparts. To avoid costly missteps, companies should prioritise business process-level assessments before diving into system-level discovery; leverage automation and multiple discovery tools to surface hidden data flows; and expand third-party due diligence to include country-specific metadata. In addition, businesses should consider redesigning U.S. record of processing activities to include DOJ-specific data types and thresholds as well as data de-identification strategies to enable compliant restricted transactions.

The bottom line

In a climate where data can be a national security asset or liability, it is important companies have the clarity, tools and foresight to respond with purpose and precision. Organisations should start by conducting a readiness assessment to identify impacted systems, data sets, vendors and business processes. Transactions falling under prohibited categories, such as data brokerage involving genomic data, must cease. For restricted transactions, security controls and due diligence must meet CISA's high standards. Exemptions provide limited relief for routine business functions, but companies must document and justify their applicability.