§202.1001. Due diligence for restricted transactions.
28 C.F.R. § 202.1001
Data compliance program. By no later than October 6, 2025, U.S. persons engaging in any restricted transactions shall develop and implement a data compliance program.
Requirements. The data compliance program shall include, at a minimum, each of the following requirements:
Risk-based procedures for verifying data flows involved in any restricted transaction, including procedures to verify and log, in an auditable manner, the following:
The types and volumes of government-related data or bulk U.S. sensitive personal data involved in the transaction;
The identity of the transaction parties, including any ownership of entities or citizenship or primary residence of individuals; and
The end-use of the data and the method of data transfer;
For restricted transactions that involve vendors, risk-based procedures for verifying the identity of vendors;
A written policy that describes the data compliance program and that is annually certified by an officer, executive, or other employee responsible for compliance;
A written policy that describes the implementation of the security requirements as defined in § 202.248 and that is annually certified by an officer, executive, or other employee responsible for compliance; and
Any other information that the Attorney General may require.
Notes, amendments, and revision history
Authority
Authority: 50 U.S.C. 1701 et seq.; 50 U.S.C. 1601 et seq.; E.O. 14117, 89 FR 15421.
Source
Source: 90 FR 1706, Jan. 8, 2025, unless otherwise noted.