At a Glance

The Department of Justice (DOJ) has proposed a rule that would regulate certain transactions involving bulk sensitive personal data. Public comments are due in 30 days from the notice date.

The rule would implement a complex regulatory framework, with civil and criminal enforcement, that is similar to sanctions and export licensing regimes. It also implicates federal cybersecurity requirements, government contracting and CFIUS actions.