Covered Persons – DOJ

The Department of Justice provides examples and defines Covered Persons (28 CFR § 202.211) in relation to: Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons

“What is a covered person?
A covered person is an individual or entity that either falls into one of the Data Security Program’s (DSP) categories of covered persons, or that the National Security Division (NSD) has designated as a covered person.

Under § 202.211(a), there are four categories of covered persons, which exclude U.S. persons:

Under § 202.211(a) of the DOJ Data Security Protection Rule, there are four categories of covered persons, which exclude U.S. persons.

These include any foreign entities and/or individuals :

  • headquartered in or organized under the laws of a country of concern;
  • 50% or more owned by a country of concern or covered person;
  •  primarily resident in a country of concern; and
  • who are employees or contractors of a covered person entity or a country-of-concern government.

Any person falling into one or more of these categories is automatically a covered person without further action by NSD…The NSD may also designate any person (including a U.S. person) as a covered person… NSD will add any designated covered persons to the Covered Persons List. Designated covered persons remain covered persons even when located in the United States.”

From Sept. 2025 National Security Division (NSD) Data Security Program FAQs

Resources