28 CFR 202.210(b)(3): a US person getting data the covered person already holds is not a covered data transaction (28 CFR 202.210(b)(3), Example 3)
The DOJ rule is triggered by access by a country of concern or covered person to US government-related data or bulk US sensitive personal data. A US buyer that only receives a licence from such a holder gives the holder no new access, so the rule's text does not bar the purchase itself.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“A covered person engages in a vendor agreement with a U.S. person involving the U.S. person accessing bulk U.S. sensitive personal data already possessed by the covered person. The vendor agreement is not a covered data transaction because the transaction does not involve access by the covered person.”
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides