Bulk sensitive personal data
By Gareth HoyleLast updated How we research
Bulk sensitive personal data is a set of sensitive data about Americans above the volume thresholds in the Justice Department's 28 CFR Part 202 rule.
Bulk sensitive personal data is a collection of sensitive personal data about US persons that meets the volume thresholds in the Justice Department's Data Security Program, 28 CFR Part 202, in effect since April 8, 2025. Section 202.206 counts data in any format "regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted".
What are the thresholds?
Section 202.205 sets thresholds over the preceding 12 months: human genomic data on more than 100 US persons, biometric identifiers or other 'omic data on more than 1,000, precise geolocation from more than 1,000 devices, health or financial data on more than 10,000, and covered personal identifiers on more than 100,000.
What does the rule prohibit?
The rule prohibits US persons from data brokerage involving bulk sensitive personal data with the countries of concern listed in section 202.601, China, Cuba, Iran, North Korea, Russia and Venezuela, or with covered persons linked to them. Licensing access to data counts as brokerage, so a single AI data license can be caught.
Check the ownership of every foreign buyer before sharing samples. See do you need to register as a data broker for the related federal rules.