Alerts9.29.25
DOJ’s New Data Security Program: What Companies Must Do Before October 6 Deadline
Highlights
- The U.S. Department of Justice’s (DOJ) new Data Security Program (DSP) restricts sensitive U.S. data transactions involving foreign access and “countries of concern.”
- Beginning October 6, 2025, companies must comply with new due diligence, audit, and reporting obligations tied to restricted transactions.
- Violations carry serious civil and criminal penalties, making it essential to assess applicability, close compliance gaps, and document efforts now.
Earlier this year, DOJ’s National Security Division (NSD) introduced the DSP, a program designed to ensure that companies and individuals handling sensitive U.S. data adopt “best-in-class safeguards” to protect national security interests. This initiative reflects a significant shift in the federal government’s approach to cybersecurity and data protection. With additional compliance obligations beginning next week, companies should evaluate whether the DSP could impact operations and consider proactive steps.
Keep Up to Date in a Changing World
Do you want to receive more valuable insights directly in your inbox? Visit our subscription center and let us know what you’re interested in learning more about.
