A New National Framework: Implementing the Data Security Program

In a recent article, James W. Norment and Mayukh Sircar of Ward and Smith explain how the US Department of Justice (DOJ) is now enforcing the Data Security Program (DSP), a regulation designed to counter the “unusual and extraordinary threat” of cybercrime to national security and the US economy. Civil enforcement began on July 8, 2025, with further reporting and audit obligations taking effect on October 6, 2025.

The DSP functions as a set of virtual import and export controls for data, prohibiting or restricting “covered data transactions” that involve “countries of concern” such as China, Russia, and Iran. These rules apply not only to government-related data, such as precise location data around sensitive sites or information tied to federal employees, but also to bulk sensitive personal data, including genomic, health, financial, and biometric information. Thresholds for what constitutes “bulk” vary by data type.

Norment and Sircar emphasize that the DSP’s reach is broad, covering US businesses, foreign entities that handle American data, and companies that indirectly expose data through third-party vendors. Prohibited transactions include data brokerage with covered persons, while restricted transactions—such as vendor, employment, or investment agreements—require compliance programs, due diligence, recordkeeping, and annual audits.

Penalties are significant: civil fines can reach up to $368,136, or twice the value of a transaction, and criminal violations carry a potential sentence of up to 20 years in prison and fines of up to $1 million. Beyond legal risk, companies face reputational damage and business disruptions if found non-compliant.

Every organization should map its data flows, vet business partners, and implement a certified compliance program. The Data Security Program is now a binding part of US data security law, and preparation is no longer optional.