What the DOJ bulk sensitive data rule means for companies licensing US data

The short answer

The DOJ bulk sensitive data rule, codified at 28 CFR Part 202, can reach a data license, but only when the dataset holds bulk US sensitive personal data or government-related data and the deal involves a country of concern, a covered person or, for contract terms, another foreign person. Whether it applies turns on three facts: what remains in the dataset after scoping, who receives it, and what the contract lets the recipient do next.

For most companies licensing operational records, the honest answer is that the rule rarely bites. The records AI buyers value describe work rather than people: tickets and their resolutions, project histories, code reviews, approvals and SOPs. The categories the rule targets, such as health, financial, location and biometric data, sit mostly in HR, payroll, benefits and device systems that a well-scoped license leaves out. That conclusion still needs a documented check, not an assumption.

What does 28 CFR Part 202 cover?

The rule is administered by the National Security Division of the Department of Justice and implements a presidential executive order on Americans' bulk sensitive personal data. It is a national security rule rather than a privacy law: it gives individuals no new rights and focuses on who can gain access to data, not on how the data was collected. This page links no primary text for the rule, so read the current regulation on the eCFR and the Division's own guidance before relying on any summary, including this one.

Two definitions deserve a second reading. First, data brokerage covers the sale of data and the licensing of access to it where the recipient did not collect the data directly from the people it describes, so a data license is in scope by form; content and counterparty decide whether any obligation follows. Second, the definitions are drafted so that anonymizing, pseudonymizing, de-identifying or encrypting data does not by itself take it out of scope. Excluding the sensitive fields, rather than masking them, is the dependable control. The rule also lists exempt transactions, such as certain intra-company dealings ancillary to business operations; read them with counsel rather than assuming one applies.

Which workplace systems can hold covered data?

Most of the exposure sits in a handful of systems. A data map built for privacy compliance usually answers these questions already.

How does the rule apply in common licensing situations?

The 3C screen: content, counterparty, contract

Run these checks in order before any dataset that touches personal data leaves the company. Even when the first answer is a clear no, record the other two; they cost little and show diligence.

• Content: after the agreed exclusions, does any listed category remain, and could it approach a bulk threshold across all deliveries to this licensee?
• Counterparty: who is the licensee, where is it organized, who owns or controls it, and which people or contractors will touch the data?
• Contract: does the license bar onward transfer to countries of concern and covered persons, limit access to named recipients, and require prompt notice of any suspected breach of those terms?

Which other US rules apply to the same data?

The DOJ rule sits alongside other regimes rather than replacing them. Customer financial information held by a financial institution under the FTC's jurisdiction is also subject to the Gramm-Leach-Bliley Act, whose Privacy Rule requires notices and opt-out rights before sharing with certain nonaffiliated third parties. Accounting and tax firms should also read the guide to the FTC Safeguards Rule for CPA firms. Health information can be protected health information under HIPAA. And if a dataset includes personal data of people in the EU, the General Data Protection Regulation can apply even to a US company that offers goods or services to, or monitors the behavior of, people there.

How the SourceX process keeps the analysis manageable

In a SourceX engagement, no data moves before scope is settled. The company completes a data inventory listing each system and how far back it goes, de-identification and redaction rules are settled with the company before any work starts, and files go out only once an agreement is executed and the company authorizes delivery. Nothing binds the company until it accepts price and terms and signs, which gives its counsel time to review the licensee and the transfer terms against the rule. The how it works page lays out the full sequence.

Referral partners stay outside this entirely. A partner makes the introduction and shares basic fit information; a partner never exports, uploads or describes the company's records, so a partner never has custody of the data the rule regulates.

Questions to ask your counsel

1. Which of the rule's categories, if any, remain in the dataset after our exclusions, and how close are we to a bulk threshold?
2. Have we screened the licensee, its owners and everyone who will access the data for covered-person status?
3. Does the license prohibit onward transfer to countries of concern and covered persons, and who reports a suspected violation?
4. Do any of our customers or projects create government-related data?
5. Do separate federal or state laws on data brokers add obligations for this dataset?
6. What written record of this analysis should we keep, and for how long?

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting, and check the rule's current text, because designations and guidance can change.

Next step

If you advise an owner whose company holds years of operational records, run a quick screen with the company fit checker and note which systems hold HR, financial, health or location data so they can be excluded early. The guide on how to explain company data licensing to a founder helps with the first conversation. Then register as a partner to make the introduction, or have the company apply directly at sourcex.si/apply.