28 CFR 202.206 Bulk U.S. sensitive personal data (28 CFR 202.206)
De-identification does not take data out of the rule: bulk US sensitive personal data is covered whether or not it is anonymised, pseudonymised, de-identified or encrypted.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“The term bulk U.S. sensitive personal data means a collection or set of sensitive personal data relating to U.S. persons, in any format, regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted, where such data meets or exceeds the applicable threshold set forth in § 202.205.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide