DOJ Finalizes Rule on Data Transfers to Foreign Entities

On April 8, 2025, the U.S. Department of Justice issued the Final Rule under Executive Order 14117, introducing new limitations on cross-border data transfers. The regulation specifically targets the transfer of sensitive U.S. personal and government-related data, including biometric, genomic, and geolocation data, to foreign entities in countries considered adversarial to U.S. interests, such as China, Russia, and Iran. This move follows growing geopolitical concerns around data misuse and surveillance, signaling a more aggressive stance by the U.S. on national data security. Companies handling high-risk categories of personal information should assess whether their data transfer practices may be subject to these new restrictions.