WHAT THE DSP DOES

UNDERSTANDING THE DOJ DATA SECURITY PROGRAM

The DSP establishes prohibitions and restrictions on certain covered data transactions involving access by countries of concern or covered persons to U.S. Government-related data or Americans’ bulk sensitive personal data.

prohibited transactions exempt transactions restricted transactions data brokerage vendor agreements employment agreements investment agreements relevant access concept bulk sensitive personal data U.S. Government-related data countries of concern covered persons

Add Your Heading Text Here

What data does the company have?

Is the data within a regulated category?

Does the data meet the applicable bulk threshold?

Is it government-related data?

Who can access it?

Who are the parties to the transaction?

Where are those parties located?

Is a country of concern or covered person involved?

What type of transaction is being contemplated?

Is the transaction prohibited, restricted, exempt, or outside the rule?

THE FIRST QUESTION IS NOT “WHAT INDUSTRY ARE YOU IN?”

01

What data does the company have?

02

Is the data within a regulated category?

03

Does the data meet the applicable bulk threshold?

04

Is it government-related data?

05

Who can access it?

06

Who are the parties to the transaction?

07

Where are those parties located?

08

Is a country of concern or covered person involved?

09

What type of transaction is being contemplated?

10

Is the transaction prohibited, restricted, exempt, or outside the rule?

WHEN SHOULD A COMPANY CALL A.S.H.A. LAW?

signing a vendor agreement

hiring abroad

granting remote access

entering a foreign investment

entering a joint venture

transferring or sharing data

acquiring a business

licensing data

changing a cloud/data architecture involving foreign access

entering another transaction that may give a foreign party access to sensitive data