28 CFR 202.301 Prohibited data-brokerage transactions (28 CFR 202.301(a))
A US holder may not license bulk US sensitive data or government-related data to a covered person. No contract clause cures it.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“no U.S. person, on or after the effective date, may knowingly engage in a covered data transaction involving data brokerage with a country of concern or covered person.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide