28 CFR 202.401(a): vendor agreements with a country of concern or covered person need security requirements (28 CFR 202.401(a))
A US lab that buys services from a holder in China, Cuba, Iran, North Korea, Russia or Venezuela and gives it access to bulk US sensitive personal data must meet the DOJ security requirements first.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“no U.S. person, on or after the effective date, may knowingly engage in a covered data transaction involving a vendor agreement, employment agreement, or investment agreement with a country of concern or covered person unless the U.S. person complies with the security requirements”
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide