Cross-Border Data Transfers From the US: OFAC, Export Control and the Bulk-Data Rule

For years, the only cross-border data question US firms modelled was privacy: could this personal data lawfully leave the country, and under what contract. There is now a second question, and it behaves like export control, not privacy.

The Department of Justice’s rule on access to US sensitive personal data by countries of concern took effect on 8 April 2025, codified at 28 CFR Part 202 and administered by the National Security Division. It flows from Executive Order 14117, signed on 28 February 2024, and it draws its teeth from the International Emergency Economic Powers Act — the same statute that underpins sanctions. That lineage matters. This is not a privacy regime with a data-protection authority and a remediation letter at the end of it. It is a national-security control with the enforcement posture of an export regime, and it lands on data architecture that was almost never designed with that regime in mind.

Why this is an export-control problem, not a privacy one

Privacy law asks whether you have a lawful basis and adequate safeguards to move personal data across a border. You can usually cure a gap with a contract, a transfer impact assessment, or a consent flow. The DOJ rule asks a different question entirely: does this transaction give a covered person — an entity or individual subject to the jurisdiction of a country of concern — access to bulk US sensitive data, and if so, is that access prohibited outright or merely restricted subject to security conditions.

The six countries of concern are China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela. A “covered person” reaches well beyond entities incorporated there: it captures foreign entities majority-owned by such countries or persons, employees and contractors of a country of concern, and individuals primarily resident there. So the analysis is not “where does the data sit” but “who, by nationality, ownership and location, can reach it” — which is exactly how export control treats a controlled technology and a foreign national. Deemed-export thinking, applied to a data lake.

That reframing breaks a common assumption. A firm that has satisfied itself on GDPR and on state privacy law has answered the privacy question, not this one. If you have already worked through cross-border data flows for AI and analytics, you have the flow map you need — but you have been scoring it against the wrong control.

What counts as bulk, and where the thresholds bite

The rule only engages above volume thresholds, calculated over the preceding twelve months. They are lower than most engineers expect, and they vary sharply by category:

• Human genomic data — more than 100 US persons.
• Other human ‘omic data (epigenomic, proteomic, transcriptomic) — more than 1,000 US persons.
• Biometric identifiers — more than 1,000 US persons.
• Precise geolocation data — more than 1,000 US devices.
• Personal health data and personal financial data — more than 10,000 US persons each.
• Covered personal identifiers — more than 100,000 US persons.

A hundred people’s genomic data is nothing to a research pipeline; a thousand devices’ precise location is a rounding error for a mobility app. And these categories combine in ways product teams rarely track together. The thresholds also fall when categories are mixed or linked to identifiers, so a dataset that looks harmless per column can be covered in aggregate. Separately, the rule treats certain “government-related data” — precise geolocation over listed sensitive government sites, and data linked to defined categories of government personnel — as covered regardless of volume. There is no bulk floor for that at all.

Where architectures quietly route covered data

The risk here is not a deliberate sale of data to a sanctioned buyer. Most firms would catch that. The risk is the routing decision nobody flagged as a transfer, because it was made on cost, latency or convenience:

The follow-the-sun support desk. A managed service provider staffs overnight coverage from an office in a country of concern, and those engineers hold standing production access to a database that clears the health-data threshold. That is a restricted transaction — a vendor agreement granting covered persons access — whether or not a single record is ever exported.

The offshore analytics contractor. A data-science team engaged through an entity majority-owned in a country of concern is given read access to a feature store built from covered identifiers. Same category.

The cheapest region. A pipeline replicates to whichever cloud region minimises egress cost, and administrative access to that region resolves to covered persons. Access, not just storage location, is what the rule scores.

Data brokerage by another name. Selling, licensing or otherwise providing bulk covered data to any foreign person as a data-brokerage transaction is prohibited outright where a country of concern could gain onward access — the harder line, not the conditional one.

Prohibited transactions cannot be engineered around; they must not happen. Restricted transactions — the vendor, employment and investment relationships — are permitted only if you meet the security requirements published by CISA and stand up a compliance programme around them. The additional obligations for restricted transactions, including due-diligence, reporting and the annual independent audit, came into force on 6 October 2025 after the initial good-faith enforcement period. Verify the current requirement set against the DOJ’s published guidance and the CISA security requirements, both of which have been updated since the rule took effect.

The mapping most firms have not done

The control you actually need is a join between two datasets you probably hold separately: a flow map of where each covered data category moves and who can reach it, and an access map of which human and machine identities resolve to a covered person by nationality, residence or ownership. Privacy programmes tend to have the first. Sanctions and export teams tend to have the second. Almost nobody has joined them, and the join is where the exposure lives.

Doing it well is a data-lineage exercise before it is a legal one — you cannot score access you cannot see. Where a covered flow genuinely has to touch a shared or offshore environment, confidential-computing patterns can narrow who holds effective access, though they are a mitigation within the rule, not an exemption from it. And the security conditions on restricted transactions overlap heavily with the engineering controls we have set out for restricted and prohibited data transactions under the Data Security Program; the two readings are meant to sit together.

The firms that will be caught out are not the ones with a bad privacy posture. They are the ones with a good one who assumed it covered this. It does not. A routing decision made on egress cost three years ago can be a prohibited transaction today, and the statute behind it does not do remediation letters.