New DOJ guidance helps companies understand their obligations under the DSP, which
could severely impact investment agreements and ordinary commercial data transactions.
By Jennifer Archie, Heather B. Deixler, Clayton Northouse, Michael Rubin, Max Mazzelli, Brianna Gordon, and Kiara Vaughn
On April 11, 2025, the US Department of Justice (DOJ) released new guidance on its final rule, known as the “Data Security Program” (DSP), which went into effect on April 8, 2025. The DSP prevents foreign access to sensitive US data, which includes bulk sensitive personal data and government-related data (“covered data”). The guidance includes a Compliance Guide, extensive FAQs, and an Implementation and Enforcement Policy, resulting in a package of explanatory guidance materials to spur attention and compliance with the DSP.
This Client Alert provides initial enforcement considerations, top takeaways, and an Appendix summarizing the DSP.