On April 25, 2025, the Rule Preventing Access to U.S. Sensitive Personal Data and Government‑Related Data by Countries of Concern or Covered Persons, commonly referred to as the Bulk Data Transfer Rule (“the Rule”), went into effect (28 CFR Part 202). The Rule is designed to restrict persons or organizations from allowing certain foreign jurisdictions to access or receive a bulk transfer of sensitive personal data of U.S. persons.
Who does the Rule cover?
The Rule covers persons and organizations whose transactions may enable access by countries of concern or covered persons to government-related data or bulk U.S. sensitive personal data. The Rule applies broadly across industries and is not limited to data brokers.
What data is impacted?
The term “sensitive data” has an extensive definition which applies to all formats of sensitive data, including anonymized, pseudonymized, de‑identified, or encrypted datasets. Sensitive Personal Data Categories Include:
- Personal identifiers (information that can link to sensitive information)
- Precise geolocation data
- Biometric identifiers
- Human ‘omic data (genetic data)
- Personal health data
- Personal financial data
What constitutes a bulk transfer?
Depending on the type of data, “bulk” transfer thresholds range from 100 to 100,000 individuals.
What are Countries of Concern?
The Rule identifies countries of concern as China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela.
What are recommended next steps for information governance?
- Organizations handling personal data should assess compliance obligations promptly to determine if they are within the scope of the Rule.
- The Rule requires that organizations retain audit and transaction records of restricted transactions for 10 years.
- The Rule requires that organizations subject to the Rule develop and implement written data compliance program, annually certified by a responsible officer or executive, with documentation of security controls.
For assistance in developing or updating compliance programs, please contact:
- Michelle Six (MSix@gunster.com) or
- Lisa Lukaszewski (LLukaszewski@gunster.com)
YES! PLEASE SIGN ME UP TO RECEIVE EMAIL ALERTS FROM OTHER GUNSTER PRACTICE AREAS.
This publication is for general information only. It is not legal advice, and legal counsel should be contacted before any action is taken that might be influenced by this publication.
About Gunster
Gunster, Florida’s law firm for business, provides full-service legal counsel to leading organizations and individuals from its 13 offices statewide. Established in 1925, the firm has expanded, diversified and evolved, but always with a singular focus: Florida and its clients’ stake in it. A magnet for business-savvy attorneys who embrace collaboration for the greatest advantage of clients, Gunster’s growth has not been at the expense of personalized service but because of it. The firm serves clients from its offices in Boca Raton, Coral Gables, Fort Lauderdale, Jacksonville, Miami, Naples, Orlando, Palm Beach, Stuart, Tallahassee, Tampa, Vero Beach, and its headquarters in West Palm Beach. With more than 320 attorneys and consultants, and 300 committed support staff, Gunster is ranked among the top 200 largest law firms by the National Law Journal and has been recognized as one of the Top 100 Diverse Law Firms by Law360. More information about its practices, industries, offices and news is available at www.gunster.com.
