28 CFR 202.302(a) Data brokerage with foreign persons that are not covered persons (28 CFR 202.302(a))
If a US holder licenses in-scope data to any foreign buyer, the licence must bar onward brokerage of the same data to countries of concern or covered persons. The holder must also report known or suspected breaches.
Dated 17 Oct 2026Source checked 17 Oct 2026Not re-read automatically: the site's terms or its robots.txt do not allow itBasis: primary text
Selling a company's data? This is one of the rules a sale has to meet, and the guide beside the button reads it in plain words.
- No data upload
- About two minutes
- No email needed
In the source's own words
“no U.S. person ... may knowingly engage in any transaction that involves any access by a foreign person to government-related data or bulk U.S. sensitive personal data and that involves data brokerage with any foreign person that is not a covered person unless the U.S. person: (1) Contractually requires that the foreign person refrain from engaging in a subsequent covered data transaction”
Where it was read
Also read from the same source
- 28 CFR 202.210 Covered data transaction (28 CFR 202.210(a))
- 28 CFR 202.211 Covered person (28 CFR 202.211(a)(1))
- 28 CFR 202.601 Countries of concern (28 CFR 202.601(a))
- 28 CFR 202.206 Bulk U.S. sensitive personal data (28 CFR 202.206)
- 28 CFR 202.212 Covered personal identifiers (exclusion) (28 CFR 202.212(b)(1))
- 28 CFR 202.301 Prohibited data-brokerage transactions (28 CFR 202.301(a))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 3 guides