Key takeaway
Assess the data, access, recipient and transaction together. A small sample, anonymized label or research description does not replace the rule’s actual scope.
Treat this as a distinct US federal inquiry
The DOJ Data Security Program needs its own review alongside privacy, confidentiality and contract authority. A package can be operational in its business use while containing information relevant to the rule. The decision is whether the actual facts fall within current 28 CFR Part 202, not whether the company considers itself a consumer-data seller.
As checked on 7 October 2026, Part 202 requires category, access, recipient and transaction classification. Covered brokerage can include licensing arrangements. Relevant transactions can aggregate over twelve months. Deidentification does not itself remove scope, and specified government-related data is not volume-limited.
This is an educational US counsel triage agenda. It is not export clearance, an exemption determination or approval to send a sample. Start before any disclosure that gives a recipient access, rather than postponing the question until a license is signed.
Worked example: the fleet archive needs a facts map
A hypothetical US service operator is considering an international evaluation. Its archive combines machine temperatures, precise route coordinates, driver-linked event tags and maintenance notes. The fictional proposed recipient is Example Overseas Evaluation Ltd. Ownership, access personnel and country links have not yet been established.
Part 202 defines precise geolocation within 1,000 meters and the bulk threshold as more than 1,000 US devices. Relevant aggregation covers the preceding twelve months involving the same US person and same foreign or covered person. The illustration enters 1,200 distinct US devices at 50-meter accuracy; counsel must reconcile prior related disclosures before completing the assessment.
| Fact area | Completed illustrative entry | Evidence/decision needed |
|---|---|---|
| Machine-only measurements | Temperature/time series, no identified people in this component | Confirm linkage and category against actual schema |
| Route component | 1,200 distinct US devices; location accuracy entered as 50 meters | Counsel classifies data and verifies counts/12-month aggregation |
| Driver-linked tags | Names removed, link keys retained | Do not assume deidentification removes scope |
| Government relationship | Two service-site flags need factual investigation | Check precise rule definitions; small count cannot settle this |
| Recipient | Foreign entity; owners/personnel not documented | Hold access pending entity/control/location review |
| Transaction | Evaluation proposed; intended onward use undefined | Classify actual arrangement, not its sales label |
Do not classify the recipient from its brand
Covered-person criteria include specified ownership, organization and residence tests, with a relevant aggregate 50 percent ownership threshold. The designated list is nonexhaustive. For review, assemble the legal identity, relevant ownership evidence and the people who can actually access the package.
For the hypothetical recipient, the compliance lead records missing ownership evidence and unknown support locations. The completed action is to pause record access and request company-level diligence through an approved route. No representative’s nationality is guessed from a name, and no country is inferred from a website domain.
An apparently unrelated hosting affiliate or remote evaluator belongs in the access inquiry. Ask the receiving entity to describe who can view, copy or transform the package and where they act. Record the answer as an asserted fact requiring verification rather than as legal clearance.
Identify the arrangement before looking for an exception
Part 202 separates prohibited brokerage, restricted arrangements and specified other-foreign-person duties. Classify the actual proposed relationship before relying on its sales label. In the illustration, the undefined evaluation purpose and access remain unanswered, so the team has no settled transaction description to test.
DOJ’s updated FAQ explains that exemptions are conditional; financial-industry affiliation and non-federally funded research are not blanket exclusions. Record the exact exemption a reviewer believes could apply and the facts supporting each condition. Do not stop at a sector label or a recipient’s assurance.
The example’s completed transaction record is unresolved: proposed access and later use are undefined, recipient facts are missing and the location component is flagged. Counsel needs the proposed agreement and access architecture before determining the route. A confidentiality agreement or metadata-only introduction should not be described as approval of an eventual record transfer.
Preserve a bounded hold and a useful next action
The operator holds the location and linked-event package. It may prepare an internal field map and a synthetic illustration that uses no actual covered records, subject to its own confidentiality review. This does not authorize splitting disclosures to evade an aggregate threshold or treating a smaller sample as automatically permissible.
The legal review file should retain counting methodology, the relevant 12-month disclosure register, recipient evidence, proposed transaction description and identified exemptions or license questions. Each missing input gets an owner. The output can be exclude, continue diligence or seek specialist advice; it should not be a numerical compliance score.
Use due diligence for recipient questions and rights review for parallel authority issues. VOID can help with a permissioned named introduction using approved metadata, without holding the archive or certifying Data Security Program compliance. No sensitive-data price or guaranteed commercial route follows from the triage.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.