Bulk U.S. Sensitive Personal Data – DOJ

The term bulk U.S. sensitive personal data means a collection or set of sensitive personal data relating to U.S. persons, in any format, regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted, where such data meets or exceeds the applicable threshold set forth in § 202.205.

Bulk sensitive personal data categories & thresholds

There are six categories of U.S. sensitive personal data defined in the Department of Justice (DOJ) rule for Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons with the following bulk thresholds:

• Human ‘omic data collected about or maintained on more than 1,000 U.S. persons, or, in the case of human genomic data, more than 100 U.S. persons.
• Biometric identifiers collected about or maintained on more than 1,000 U.S. persons.
• Precise geolocation data collected about or maintained on more than 1,000 U.S. persons.
• Personal health data collected about or maintained on more than 10,000 U.S. persons.
• Personal financial data collected about or maintained on more than 10,000 U.S. persons.
• Covered personal identifiers collected about or maintained on more than 100,000 U.S. persons.

Resources

• Department of Justice Definitions of:
  • Bulk (28 CFR § 202.205) and Bulk Sensitive Data (28 CFR § 202.206)
• Covered Data Transaction
• Covered Person
• Countries of Concern
• Bulk Sensitive Data
• U.S. Government-related Data
• Exempt Data Transactions
• Restricted Data Transactions
• DOJ: Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons
• Sept. 2025 National Security Division (NSD) Data Security Program FAQs