The Department of Justice's data security rule, 28 CFR Part 202, took effect on 8 April 2025 and restricts one specific thing: giving people tied to six named countries access to bulk sensitive data about Americans. A US agency that subcontracts development offshore can fall inside it, but only through a narrow door. The rule does not care that your sub is offshore. It cares whether anyone with access to bulk data is a "covered person," and for an individual that test is largely about where they primarily live.
This post walks through how the rule reads for an agency owner with a subcontract bench. It is a plain-language reading of the regulation text, not legal advice, and a client with a real exposure should have counsel read it.
What the rule actually prohibits and restricts
The Department of Justice's National Security Division published the final rule in the Federal Register on 8 January 2025, titled "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons." It has two layers. Some transactions are flatly prohibited, such as data brokerage with a covered person. Others are "restricted," meaning allowed only if the US company meets the security requirements in the rule.
Vendor, employment and investment agreements with a country of concern or a covered person that involve access to bulk sensitive data fall into the restricted layer (28 CFR §202.401). A vendor agreement is any agreement other than an employment agreement under which one party supplies products or services to another for payment, cloud services included (§202.258). Your subcontract with an offshore dev shop is a vendor agreement. Whether it is a restricted one depends on the data and the people.
Which countries, and who counts as a covered person
The countries of concern, as listed in 28 CFR §202.601(a) in the October 2026 version of the regulation, are China, Cuba, Iran, North Korea, Russia and Venezuela. Pakistan, India, the Philippines, Poland, Ukraine and Brazil are not on the list.
A covered person (§202.211(a)) is one of four things, plus anyone the Attorney General designates:
- a foreign entity 50% or more owned by a country of concern, or organized under its laws or with its principal place of business there;
- a foreign entity 50% or more owned by other covered persons;
- a foreign individual who is an employee or contractor of a country of concern or of a covered entity;
- a foreign individual who is primarily resident in a country of concern.
That last category is the one an agency owner should circle. A developer sitting in Lahore working for a Lahore company is not a covered person. A developer who actually lives in a country on the list is, whoever employs them. Citizenship alone does not decide it: the Part 202 examples say a citizen of a country of concern who lives in a third country is not a covered person unless they are employed or contracted by a covered entity (§202.211(b)(3)).
The data thresholds that make a transaction "covered"
Nothing is restricted unless the access reaches "bulk" sensitive personal data. Under 28 CFR §202.205, bulk means at or above these counts at any point in the preceding 12 months:
| Data type | Bulk threshold (U.S. persons or devices) |
|---|---|
| Human genomic data | More than 100 persons |
| Other human 'omic data | More than 1,000 persons |
| Biometric identifiers | More than 1,000 persons |
| Precise geolocation | More than 1,000 devices |
| Personal health data | More than 10,000 persons |
| Personal financial data | More than 10,000 persons |
| Covered personal identifiers | More than 100,000 persons |
Counts can aggregate across transactions with the same parties, and a dataset mixing categories is measured against the lowest applicable threshold. Sensitive personal data under §202.249 excludes data lawfully available to the public, data that does not relate to an individual, and personal communications.
The consequence for agency work is blunt. An agency building a marketing site, an internal tool or a B2B dashboard over a few thousand records is nowhere near these numbers. An agency maintaining a patient-facing app, a lending product or a consumer app with a few hundred thousand users can be, if its subcontractors can reach the production database.
A worked example
Picture an 18-person agency that maintains a telehealth scheduling app for a client with 40,000 active patients. The agency subs its backend work to a six-person shop abroad. Three things decide the rule's answer:
- 1.Where do the sub's people live? If all six reside outside the six listed countries and work for a company that is not owned from one, nobody is a covered person and the rule has no restricted transaction to regulate.
- 2.Can they reach production health records? If the sub works only against a staging database with synthetic or masked data, the services do not involve access to bulk sensitive data at all. Part 202's own vendor-agreement example makes the same point: a vendor agreement is not a covered data transaction where the services do not involve access to the bulk data (§202.258(b)(5)).
- 3.Does anyone else sit behind the sub? If the shop quietly hires a seventh engineer who lives in a listed country and gives them a production credential, the agency's exposure depends on what it knew. Part 202's examples treat a non-covered foreign vendor that employs a covered person and grants access without the US person's knowledge as not a restricted transaction absent evasion (§202.401(c)). Notice what that sentence turns on: knowledge. A contract that never asks the question is a weak position to defend later.
What compliance costs, and the cheap way out
If an agency really does need a covered person to touch bulk data, which is rare, the rule allows it only with the security requirements in place and a compliance program. Under §202.1001(a), US persons engaged in restricted transactions had to have a data compliance program running by 6 October 2025. It includes logging, in an auditable manner, the data types and volumes, the parties' ownership or primary residence and the transfer method (§202.1001(b)(1)), written policies certified annually (§202.1001(b)(3) and (4)), and verification of the vendor's identity (§202.1001(b)(2)). Records must be kept for at least ten years (§202.1101(a)).
The penalty side is why this belongs in a subcontract rather than in a hope. Under §202.1301(a), civil penalties under the International Emergency Economic Powers Act reach the greater of $368,136 or twice the transaction amount, and willful violations carry criminal fines up to $1,000,000 and up to 20 years' imprisonment for individuals. Those figures are the October 2026 text and are inflation adjusted from time to time.
My view: most agencies should not build a compliance program for this rule. They should make the question unreachable. Three steps do most of the work.
- Keep bulk production data away from the sub. Staging with synthetic or masked data, production access held by the agency's own people, and break-glass access logged. The same habit helps with the privacy-contract obligations in our CCPA flow-down piece.
- Put three sentences in the subcontract. The sub represents that no personnel with system access are primarily resident in a country listed in 28 CFR §202.601; it will notify you before changing the named people with access; and it will not sub-subcontract access without your written consent.
- Name the individuals. Named engineers with individual accounts, not a shared login the whole shop uses. The same discipline answers the question in who owns code written by an agency subcontractor, because it makes the chain of authorship and access a list instead of a guess.
There is a side benefit. A sub whose people work a contracted evening window from a known city, as in our overlap hours by city table, is easy to attest to. A bench that cannot say where its people sit is the one that fails the diligence question first.
When this doesn't fit
Two honest exclusions. If your client's data is bulk health, genomic, biometric or financial data and your bench cannot attest where each person lives, no offshore partner, including us, is the right answer for that work, and you should staff it domestically until you can. And if the client's contract already bars access by anyone outside the US, the subcontract is a contract-term problem, not a rule-reading one.
For everything else, a subcontract with a named team, a residence representation and a staging-only default is a short document. If you quote work you cannot staff alone, see how our partner program works and how we build dedicated teams, or send us the scope and we will say plainly whether the data in it changes the answer.
Sources
- Federal Register: Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (final rule, published 8 January 2025, effective 8 April 2025)
- Electronic Code of Federal Regulations: 28 CFR Part 202, sections 202.205, 202.211, 202.249, 202.258, 202.401, 202.601, 202.1001, 202.1101 and 202.1301 (October 2026 text)
