# Does the DOJ bulk data rule apply to company data? > Searching whether the DOJ bulk data rule covers selling company data? It covers licensing to covered persons and foreign buyers, and counts de-identified data. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/does-the-doj-bulk-data-rule-apply-to-selling-company-data Published: 2026-07-10 Updated: 2026-10-14 ## The short answer It can, when the buyer is foreign. The DOJ rule, 28 CFR Part 202, prohibits transfers to covered persons and requires contract terms against onward transfer for other foreign recipients. Its thresholds count de-identified data. Ask counsel whether your buyer and volumes fall inside it. The [Justice Department's Data Security Program](https://www.justice.gov/nsd/data-security) is a national security rule, and a company-archive license can fall inside it. ## Does the DOJ bulk data rule count a license to an AI lab as data brokerage? [Section 202.214](https://www.law.cornell.edu/cfr/text/28/202.214) of the DOJ bulk data rule defines data brokerage as the sale of data, licensing of access to data, or similar commercial deals. Employment, investment and vendor agreements are excluded. The rule covers transfers where the buyer did not collect the data directly from the people. A license of an archive to a lab fits that wording on its face. ## Who is a covered person? [Section 202.211](https://www.law.cornell.edu/cfr/text/28/202.211) covers two kinds of foreign entity: - One that is 50% or more owned by a country of concern or by covered persons. - One that is organized or based in a country of concern. It also covers two kinds of individual: - Employees or contractors of such entities. - People who live mainly in a country of concern. [Section 202.601](https://www.law.cornell.edu/cfr/text/28/202.601) lists the countries: China, Cuba, Iran, North Korea, Russia and Venezuela. Under the rule's own example, Chinese or Russian citizens in the United States count as US persons. ## What counts as bulk? [Section 202.205](https://www.law.cornell.edu/cfr/text/28/202.205) sets thresholds over any 12 months: - Personal health data on more than 10,000 US persons. - Personal financial data on more than 10,000 US persons. - Covered personal identifiers on more than 100,000 US persons. - Biometric identifiers or precise geolocation on 1,000 persons or devices. [Section 202.212](https://www.law.cornell.edu/cfr/text/28/202.212) excludes demographic or contact data that links only to other demographic or contact data. Names and email addresses alone fall there. Payroll, health or financial data inside HR mail may count toward a threshold. That second point is my reading. ## What if the buyer is a different kind of foreign person? [Section 202.302](https://www.law.cornell.edu/cfr/text/28/202.302) requires a US person to use a contract. The contract must bar the foreign buyer from onward data brokerage with a country of concern or covered person. The US person must also report any known or suspected violation within 14 days. ## What is the penalty? [Section 202.1301](https://www.law.cornell.edu/cfr/text/28/202.1301) applies IEEPA. It sets a civil penalty of up to the greater of $368,136 or twice the transaction amount. Criminal penalties apply to willful violations. Look up a buyer's ownership in public sources and take the legal analysis to your lawyer. Our [rights check](/rights-check) covers your own side: contracts, personal data and who can sign. The [state data broker laws](/answers/are-data-brokers-legal) are a separate set of rules. Figure: comparison of Who receives the data under 28 CFR 202: Covered person (emphasized: The transfer is prohibited, Prohibited), Other foreign person (Contract terms). A transfer to a country of concern or covered person is prohibited, and any other foreign person needs contract terms. Talk to a privacy or commercial lawyer in your state before you sign. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [Justice Department's Data Security Program](https://www.justice.gov/nsd/data-security) - [Section 202.214](https://www.law.cornell.edu/cfr/text/28/202.214) - [Section 202.211](https://www.law.cornell.edu/cfr/text/28/202.211) - [Section 202.601](https://www.law.cornell.edu/cfr/text/28/202.601) - [Section 202.205](https://www.law.cornell.edu/cfr/text/28/202.205) - [Section 202.212](https://www.law.cornell.edu/cfr/text/28/202.212) - [Section 202.302](https://www.law.cornell.edu/cfr/text/28/202.302) - [Section 202.1301](https://www.law.cornell.edu/cfr/text/28/202.1301)