The DOJ Data Security Program: Govern Document Access and Transfers

For U.S. organisations with document workflows in scope of the DOJ Data Security Program, a transfer decision needs to connect the data, recipient, permitted use, and actual outcome. A claims team preparing a vendor package should be able to show which document versions it selected, whose information they contain, why the recipient was eligible, and whether access was granted or blocked. Make that decision before releasing the files, and retain the evidence afterward.

What the U.S. Data Security Program covers

The U.S. Department of Justice's Data Security Program (DSP) addresses national-security risks from countries of concern accessing Americans' bulk sensitive personal data or U.S. Government-related data through defined transactions. It took effect on April 8, 2025.

The DOJ's compliance guide identifies four transaction categories: data brokerage, vendor agreements, employment agreements, and investment agreements. Countries of concern are China, including Hong Kong and Macau, Cuba, Iran, North Korea, Russia, and Venezuela. “Covered persons” include defined classes, such as foreign entities headquartered in those countries and foreign individuals primarily resident there. Checking the named-person list alone does not establish eligibility.

Relevant sensitive-data categories include health, financial, biometric, precise geolocation, human ’omic data (such as genomic data), and covered personal identifiers. Government-related data has a specific definition, including certain listed-location geolocation data and sensitive data marketed as linked to specified government personnel; it can be covered regardless of volume. A government contract or an ordinary identity document does not, by itself, settle that classification.

The DOJ FAQs distinguish prohibited transactions from restricted transactions that can proceed only under applicable conditions, including CISA security requirements. An internal approval does not replace those conditions. The DSP does not prohibit every foreign data relationship; the parties, agreement, access, and applicable exceptions matter.

Count people and devices, then connect them to documents

Under 28 CFR Part 202, bulk thresholds depend on data category and count U.S. persons or devices, with aggregation across the relevant transactions over the preceding 12 months. For example, personal health data has a threshold of more than 10,000 U.S. persons. The rule also addresses combined data. File count is not the bulk calculation.

An export of 25,000 claim documents could contain repeated records about the same people, or records about several people in each file. Retain the population estimate, deduplication method, related prior transactions, and uncertainty used in the assessment. Route an unresolved population or category to review instead of assuming that a small export is outside scope.

Build the inventory around document classes, relevant data categories, source, business owner, and reviewed classification. Inspect attachments, OCR text, extracted fields, renditions, search data, and AI-processing paths where they may expose the relevant information. Record how classification was produced and corrected so a later reviewer can reproduce the decision.

Map access paths and enforce the decision

Review downloads and remote access: vendor support, shared workspaces, API integrations, inference services, and administrative identities. Use that inventory to identify relationships for legal assessment; an access path or a foreign subprocessor does not automatically make the arrangement a covered transaction. The DOJ FAQs distinguish those cases and address evasion.

Connect each controlled path to a reviewed counterparty record with the relevant agreement, ownership or residence evidence, authorised purpose, and reassessment date. A change in the recipient, ownership, service, or permitted use should reopen the decision. Enforce the result at the service that releases documents or grants access, including alternate routes such as bulk APIs and synchronisation jobs.

1. Assess

   Fix the proposed scope

   Identify the source versions, data population, recipient, agreement, purpose, and legal assessment.

2. Control

   Check the actual access

   Hold unresolved requests, block prohibited ones, and verify required conditions before an authorised release.

3. Reconcile

   Record what happened

   Connect the policy and approval to the manifest, delivery or access result, and any follow-up.

Worked example: a vendor claims package

Suppose a U.S. claims operation creates transfer request EXP-1042 for 25,000 PDFs covering 12,000 distinct U.S. persons. Its compliance team has assessed the proposed vendor arrangement as a restricted transaction involving bulk personal health data. The vendor asks for the original readable claim files.

The configured workflow holds the request. A manager's business approval cannot release that raw package while the assessed security conditions remain unsatisfied. The team may instead assess a redesigned processing arrangement and a separately validated output. The DOJ FAQs explain that restricted-transaction controls are intended to prevent covered persons from accessing linkable, identifiable, unencrypted, or decryptable covered data using commonly available technology, subject to the required risk assessment.

If a revised arrangement is authorised, create a new manifest identifying the exact approved output and record the supporting assessment. A recipient or package change invalidates the earlier release approval. If the original request is rejected, preserve its reason and outcome, and route any applicable reporting obligation to the compliance owner.

Keep an evidence record that survives an audit

For restricted transactions, the regulation calls for auditable verification of data types and volumes, transaction parties, end use, and transfer method, alongside programme and audit requirements. Relevant transaction records must generally be available for at least 10 years. Map the applicable duties to your retention schedule. The following is a proposed implementation record, rather than a prescribed DOJ form.

Protect the evidence according to its sensitivity. Keep controlled references instead of duplicating full claims in general logs. If delivery times out, reconcile the destination and transfer reference before retrying; a timeout is not proof that no files arrived. Include linked access and its revocation in the review, since an export manifest alone does not describe continuing access.

Test one complete transfer path

• Confirm the compliance owner has assessed the data, parties, transaction category, and applicable exceptions.
• Check the person or device calculation and relevant prior transactions, rather than relying on document count.
• Exercise permitted, prohibited, restricted, and unresolved requests using the actual export identity.
• Try a changed recipient, direct storage access, bulk API, and shared link to detect bypasses.
• Verify a rejected request releases no documents and creates reviewable evidence.
• Reconcile a partial delivery or timeout and retrieve the retained assessment, manifest, and outcome together.

Make the access decision provable

A controlled document workflow connects the legal assessment to an enforced operational decision. Start with one representative transfer and demonstrate the whole path: identify the information and recipient, verify the conditions, release only the authorised output, and reconstruct the result from retained evidence.

Sources reviewed: November 12, 2026. Regulatory statements follow the DOJ guidance and current regulation linked above. EXP-1042 and its workflow are illustrative; legal coverage and transaction-specific conditions belong with the organisation's legal/compliance team.