The DOJ's new data security rule requires U.S. companies to comply by July 8, 2025, limiting sharing sensitive personal data with certain foreign countries like China, Russia, and Iran.
Enforcement actions after July 8 can result in fines up to $1 million and potential prison sentences of up to 20 years.
The rule covers sensitive data types such as human genomic and biometric data, precise geolocation, health information, financial data, logs from fitness apps, and government-related location data.
Businesses need to audit data, review contracts, evaluate foreign partnerships, assess vendor exposure, and build a compliance program to meet the new requirements before the deadline.