On April 8, 2025, the Data Security Program (DSP) issued by the U.S. Department of Justice (DOJ) took effect, establishing national security safeguards around the handling of certain categories of sensitive U.S. personal data and human biospecimens (such as blood and tissue samples). These regulations, developed under Executive Order 14117, place specific restrictions on how large datasets and collections of human biospecimens containing sensitive information about U.S. persons (or from which such information could be derived) may be accessed, stored, shipped, or transferred when entities or individuals from or associated with foreign countries of concern are involved.
The purpose of the DSP is to reduce the risk that large-scale datasets and sample collections could be exploited for surveillance, targeting, or other activities that could compromise individual privacy or national security. As a result, universities and research institutions must carefully assess when research datasets and research samples fall within the scope of these regulations and ensure they are managed in compliance with federal requirements.
The tabs below provide guidance to help faculty and administrators understand the regulations, identify when they may apply, and determine the appropriate next steps.
Important: this is not just about data. The DSP also covers human biospecimens, meaning physical samples such as blood, tissue, urine, hair, cells, and cell cultures, when bulk human 'omic data (for example, genomic data) could be derived from them. Whether you are sending a data file or shipping a sample, what matters is the number of people from whom the samples were obtained. See the charts and questions below, and please contact ORP before shipping or sharing human samples or datasets with anyone outside the U.S. or with anyone inside the U.S. who is associated with a foreign country of concern.
- What is considered "Bulk Sensitive Personal Data" under the DSP?
“Bulk Sensitive Personal Data” (Bulk SPD) refers to large datasets that contain detailed or sensitive information about U.S. persons. These datasets may present national security risks if accessed, stored, processed, or transferred in ways that allow foreign governments of concern, or entities they control, to obtain or analyze them.
Bulk SPD includes several specific categories of sensitive personal information, in any format. A dataset is considered bulk when it involves more than the number of U.S. persons (or U.S. devices) listed for that data category in 28 CFR § 202.205. For human genomic and other human 'omic data, the DSP also reaches human biospecimens from which bulk human 'omic data could be derived (see the biospecimen questions below).- Does the DSP apply to samples (biospecimens), or only to data?
It applies to both. Under 28 CFR § 202.303, a U.S. person may not knowingly engage in a covered data transaction with a country of concern or covered person that gives that country or person access to bulk human 'omic data, or to human biospecimens from which bulk human 'omic data could be derived.
A “human biospecimen” is a quantity of tissue, blood, urine, or other human-derived material, including hair, plasma, sera, cell cultures, and human specimens and parts thereof (28 CFR § 202.223). This means that sending, sharing, or providing access to physical samples can raise the same issues as sending the data generated from them.
Because the genomic threshold is low (less than 100 people), even a relatively small collection of samples can be significant. Please contact us before shipping samples to, or giving access to samples to, any collaborator, core facility, biobank, or contract laboratory outside the U.S. or to a facility inside the U.S. associated with a foreign country of concern.
One exclusion: biospecimens that the recipient intends solely for use in diagnosing, treating, or preventing a disease or medical condition are not “human biospecimens” under the rule (28 CFR § 202.223(b)).- How are biospecimens counted toward the thresholds?
The DSP does not set a separate number for samples. Instead, it uses the same people-based thresholds that apply to the data that could be derived from the samples. Count the number of different U.S. persons the samples were collected from (not the number of tubes, vials, slides, or aliquots).
Three counting rules apply:- 12-month look-back. Count at any point in the preceding 12 months, whether in a single shipment or across several.
- Same recipient. Transactions are added together when they involve the same U.S. person or entity and the same foreign person/entity or covered person/entity. Three shipments of 40 samples each to the same recipient within 12 months count as 120 people.
- Identifiability does not matter. Coded, de-identified, or encrypted data are still counted (see below).
Because genomic data can generally be derived from most human tissue, blood, and cell samples, ORP recommends treating any collection of such samples from more than 100 U.S. persons as potentially bulk and contacting us for review.
- Which countries are considered "foreign countries of concern?"
The DSP restricts certain activities involving China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela. These restrictions apply to entities owned or controlled by these governments, including universities, research institutes, and private companies—even those located in the U.S.
- Which categories of Sensitive Personal Data may become Bulk Sensitive Personal Data?
Bulk thresholds are counted across any 12-month period, meaning that multiple smaller datasets or sample shipments may together constitute a bulk dataset when they involve the same U.S. person and the same recipient or covered person. Any dataset or sample collection from U.S. persons should be reviewed if it approaches the bulk thresholds, even if it is coded or de-identified.
Categories include:- Personal Identifiers: Includes data that can identify an individual directly or indirectly. Examples include names linked to Social Security numbers, driver’s license numbers, passport numbers, or combinations of identifiers that could reasonably be used to identify a person when aggregated.
- Health and Medical Information: Includes electronic health records, medical histories, diagnostic codes, treatment data, lab results, and other individually associated health details.
- Human Genomic Data: Encompasses whole genome sequences, exome data, targeted or partial sequence data, results of genetic tests, and other genetic information tied to human subjects, as well as the human biospecimens (such as blood or tissue) from which such data could be derived. Genomic data has the lowest bulk threshold of any category (100 U.S. persons) due to its highly sensitive and uniquely identifying nature.
- Other Human “Omics” Data: Includes epigenomic, proteomic, and transcriptomic data (the DSP’s definition of human ’omic data also includes genomic data, listed above). Pathogen-specific data embedded in human ’omic datasets is excluded. The threshold is 1,000 U.S. persons.
- Biometric Identifiers: Includes fingerprints, facial recognition data, iris scans, voiceprints, gait patterns, or other physiological traits used for identification.
- Human Biospecimens: Physical samples such as blood, tissue, urine, hair, cells, and cell cultures, when bulk human ’omic data (for example, genomic data) could be derived from them. Samples are counted by the number of U.S. persons from whom they came, using the same thresholds as the ’omic data (more than 100 for genomic; more than 1,000 for other ’omic data).
- Precise Geolocation Data: Refers to location information tied to specific devices or individuals, typically at GPS accuracy. This includes location history from mobile devices, vehicle telematics, or wearable technology.
- Financial Information: Covers bank account details, credit or debit card numbers, transaction patterns, income information, or other personal financial data.
- Are de-identified datasets excluded from the definition of Bulk Sensitive Personal Data?
No. Even if a dataset is “de-identified,” it may still meet the regulatory definition of Bulk SPD if it exceeds bulk thresholds. The DSP applies whether data are anonymized, pseudonymized, de-identified, coded, or encrypted. The same is true for samples: biospecimens are counted whether or not they carry names or other identifiers.
- Are there specific thresholds for when sensitive personal data become "bulk?"
Yes. The DOJ defines numerical thresholds for different categories of personal data. When these thresholds are exceeded, the dataset or sample collection is treated as “bulk,” even if coded or de-identified. If a dataset contains more than one category of data, the lowest applicable threshold controls. For example, a dataset that pairs genomic data with health records is measured against the 100-person genomic threshold, not the 10,000-person health threshold. Because thresholds vary and may change, investigators should consult the Office of Research Protections if they believe their work may involve large datasets of sensitive personal or genomic data, or collections of human samples.
- What are the Bulk SPD thresholds?
Bulk Sensitive Personal Data Parameters (DOJ Thresholds)
Datasets or sample collections involving more than these numbers of U.S. persons or devices within any 12-month period may be regulated as “Bulk Sensitive Personal Data.”
Category of Data Definition/Description Bulk Threshold (more than this many U.S. Persons or Devices) Human Genomic Data Whole genome sequences, exome data, or other human genetic information of U.S. persons. Includes results of genetic tests and the human biospecimens (e.g., blood, tissue) from which such data could be derived. Highly sensitive and uniquely identifying. 100 U.S. Persons
Other Human “Omics” Data Proteomic, epigenomic, and transcriptomic data, as defined in 28 CFR § 202.224. Pathogen-specific data embedded in human 'omic datasets is excluded. Also includes human biospecimens from which such data could be derived (see note below the chart). 1,000 U.S. Persons Biometric Identifiers Fingerprints, facial recognition data, voiceprints, iris scans, gait patterns, or other physiological traits used for identification. 1,000 U.S. Persons Precise Geolocation Data GPS-level or otherwise granular geolocation information tied to individuals or devices, including mobile devices, vehicles, or wearable technology. 1,000 U.S. devices Personal Health Data Medical information, electronic health records, diagnostic or treatment data, or other protected health information. 10,000 U.S. Persons Personal Financial Data Bank account details, credit or debit card numbers, income data, financial transaction information, and other identifiable financial data. 10,000 U.S. Persons Covered Personal Identifiers (CPIs) Direct identifiers (e.g., name with SSN, passport number, driver’s license number) or combinations of identifiers that reasonably identify a person. 100,000 U.S. Persons Human Biospecimens Tissue, blood, urine, or other human-derived material (28 CFR § 202.223), when bulk human 'omic data could be derived from it. Excludes specimens the recipient intends solely for diagnosing, treating, or preventing disease. Same as the data that could be derived: 100 U.S. persons (genomic) or 1,000 (other 'omic). Count people, not vials. Combined Data A dataset that contains more than one of the categories above (for example, genomic data plus health records). The lowest threshold among the categories present. Note: Bulk thresholds are “more than” the numbers shown, are counted at any point in the preceding 12 months and are added together across transactions involving the same U.S. person and the same person/entity or covered person/entity (28 CFR § 202.205).
What you are sharing or sending Count the number of… Potentially bulk if more than… Example Human genomic data (whole genome, exome, targeted sequence data, genetic test results) U.S. persons whose data are in the dataset 100 people Exome data from 101 study participants Human biospecimens from which genomic data could be derived (e.g., blood, tissue, hair, cell lines) U.S. persons the samples were collected from (not vials or aliquots) 100 people Blood samples from 101 participants, regardless of how many tubes each gave Epigenomic, proteomic, or transcriptomic data U.S. persons whose data are in the dataset 1,000 people Proteomic profiles for 1,001 participants Biometric identifiers (fingerprints, face, iris, voice, gait) U.S. persons 1,000 people Face images from 1,001 participants Precise geolocation data U.S. devices 1,000 devices GPS tracks from 1,001 phones Personal health data U.S. persons 10,000 people Clinical records for 10,001 patients Personal financial data U.S. persons 10,000 people Account data for 10,001 people Covered personal identifiers U.S. persons 100,000 people Names with SSNs for 100,001 people Combined (e.g., genomic data plus health records, or samples plus linked clinical data) U.S. persons, using the lowest threshold of any category present Lowest threshold present (100 if genomic data or samples are included) Genomic data and health records for 101 participants Reminder: Falling under a threshold today does not help if later shipments to the same recipient within 12 months add up to more than the threshold, and NIH-supported biospecimens are subject to a separate NIH policy (see NIH question below).
- Why does dataset size matter?
A dataset becomes “bulk” not only because of the type of information it contains, but because the volume of records (or the number of people whose samples are included) magnifies the potential harm.
Larger datasets:- Increase the likelihood of profiling or predictive modeling of U.S. persons.
- Enable pattern analysis that reveals sensitive or protected information even when identifiers are removed.
- Facilitate re-identification, because data points may be cross matched with other publicly available or illicitly obtained datasets.
- Elevate national security risk, particularly when aggregated health or genomic datasets could be misused for military, intelligence, or discriminatory purposes by foreign governments.
- Larger sample collections can be analyzed by a recipient to generate genomic or other ’omic data that was never part of the original shipment, which is why the DSP treats samples much like the data they can produce.
- Increase the likelihood of profiling or predictive modeling of U.S. persons.
- How might the DSP affect research activities at Pitt?
The DSP may affect any project that collects, analyzes, stores, or shares Bulk SPD, human ’omic data, or human biospecimens. Activities that involve foreign collaborators, external cloud services, data-processing tools, or service providers linked to a country of concern may require additional review.
Examples include shipping or providing samples to collaborators, core facilities, biobanks, or contract laboratories outside the U.S. (or those inside the U.S. that are associated with foreign countries of concern); giving anyone outside the U.S. (or anyone inside the U.S. associated with foreign countries of concern) remote access to a research database; and using vendors that store or process data or samples abroad.
- Do these rules apply to all foreign collaborations?
No. The DSP applies specifically to transfers of or access to Bulk SPD, human ’omic data, and human biospecimens by countries of concern and covered persons/entities (including those inside the U.S. associated with foreign countries of concern). Collaborations with researchers or institutions in other countries are not restricted under this rule unless data storage, processing, or access involves companies or infrastructure tied to a foreign country of concern.
- What research activities may be prohibited or require authorization?
The DSP prohibits the transfer of Bulk SPD or genomic data to covered entities affiliated with countries of concern; contracting with cloud or data processing services under their control; or transferring large U.S. datasets to these countries. Some activities may be permissible with appropriate safeguards or approvals, but prior institutional review is essential.
- How does this relate to HIPAA, FERPA, or NIH Data Policies?
The DSP augments existing federal requirements rather than replacing them. Research involving human subjects, medical information, student records, or genomic data must still comply with HIPAA, FERPA, NIH policies, and Pitt’s internal standards. The DOJ rule adds further scrutiny related specifically to foreign access and national security risks.
- Does NIH have separate requirements for human biospecimens?
Yes, if your samples are NIH-supported. NIH Guide notice NOT-OD-25-160, effective October 24, 2025, sets security expectations for human biospecimens from U.S. persons that are collected, stored, used, or distributed with NIH funding of any kind and at any funding level, regardless of whether the samples are identifiable. In general, entities holding NIH-supported biospecimens may not directly or indirectly distribute them to institutions or parties located in countries of concern or associated with parties located in countries of concern.
Because the NIH policy is separate from the DOJ rule, please do not assume that a collection falling below the DOJ “bulk” numbers is automatically acceptable to share if it is NIH-supported. In fact, the University of Pittsburgh has determined that since NIH funding has contributed to the majority of available human biospecimens on campus, no biospecimens may be sent to or shared with an individual or entity in a foreign country of concern.- What should faculty do if their research uses or may use Bulk Sensitive Personal Data?
Faculty should contact the Office of Research Protections early in the planning stage of any project that may involve the transfer of Bulk SPD, human ’omic data, or human biospecimens to a foreign country of concern or covered entity affiliated with a foreign country of concern. ORP can help determine whether the project falls under the DSP and identify any required controls, approvals, or documentation. Researchers should also seek guidance when engaging foreign collaborators or using external platforms or vendors.
- Who should I contact if I have questions?
Questions regarding how the DSP applies to research at Pitt should be directed to the Office of Research Protections (ORP). ORP will coordinate with other relevant university offices to ensure appropriate compliance.
- Additional Information
This guidance provides an overview of the DSP. More information can also be found on the following websites:
- U.S. Department of Justice Data Security Program FAQ
- U.S. Department of Justice Compliance Guide (Data Security Program: Compliance Guide, April 11, 2025: https://www.justice.gov/opa/media/1396356/dl)
- 28 CFR Part 202 (Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons): https://www.ecfr.gov/current/title-28/chapter-I/part-202
- NIH Policy on Enhancing Security Measures for Human Biospecimens (NOT-OD-25-160): https://grants.nih.gov/grants/guide/notice-files/NOT-OD-25-160.html