The Department of Justice’s biggest headline this week centers on its sweeping new Data Security Program, or DSP, which officially took effect on April 8. This landmark rule aims to block sensitive U.S. personal and government data from falling into the hands of foreign adversaries, specifically targeting six “countries of concern” including China, Russia, and Iran. The DOJ’s National Security Division rolled out key guidance and FAQs, along with a 90-day grace period for companies to get their compliance programs up to speed—ending July 8. While willful violations will still be met with enforcement, companies showing good-faith efforts won’t face penalties during this transition.
The new program means U.S. organizations—whether running websites, hiring vendors, or negotiating investments—must now scrutinize how bulk data might be accessed or transferred. Even seemingly innocuous tech like tracking pixels or third-party software in apps is on the DOJ’s radar if it could expose Americans’ data overseas. The compliance guide spells out clear steps: review data flows, vet vendors, tighten internal security, and revise contracts where needed. Notably, reporting requirements are robust: firms engaged in relevant data transactions will be expected to file annual reports, document rejected prohibited offers, and swiftly flag suspicious activity involving foreign actors.
For American citizens, this initiative promises stronger privacy and enhanced protection against foreign misuse of personal information. For businesses, especially those in tech, finance, healthcare, and cloud services, there’s a pressing need to adapt internal processes and, in some cases, rethink international partnerships. State and local governments, particularly those managing large datasets or running digital public services, must likewise ensure their operations comply with the new rules.
DOJ officials stress the gravity and intent behind these changes. One spokesperson emphasized, “Protecting Americans’ sensitive personal data is a national security imperative.” Legal experts note the stakes: civil fines for violations can reach over $360,000 per infraction, and criminal penalties include fines up to $1 million and 20 years in prison for willful misconduct.
Looking ahead, the 90-day grace period represents a critical compliance window. By October 6, certain ongoing compliance obligations will kick in, expanding enforcement teeth. The DOJ has yet to publish its official list of "covered persons"—those entities specifically restricted—which is another milestone to watch for.
Citizens and organizations can learn more by visiting the DOJ’s Data Security Program web hub. For businesses, now is the time to audit your data practices, consult qualified counsel, and start documenting your compliance steps. As the DOJ continues to roll out updates and enforcement actions, staying engaged—and prepared—remains the best defense. If you have concerns or wish to comment, DOJ will be opening a public feedback portal in the coming weeks. Stay tuned for further guidance, and make sure your organization is ready for this new era of digital security.