The DOJ has solidified a new national security regulatory regime focused on protecting bulk U.S. sensitive personal data and government-related data from countries of concern. On December 27, 2024, the DOJ released final rules (Rules), implementing a February 2024 Executive Order issued by then-President Biden. The Rules take effect on April 6, 2025, except for certain requirements that will take effect in October 2025. Many companies deal with “sensitive data,” as defined in the Rules, and, therefore, most will be affected by prohibited and restricted transaction provisions. This article highlights the key elements of the Rules, with commentary on their practical implications from Hintze Law partner Sam Castic and Morrison Foerster partner Miriam Wugmeister. See “Preparing to Comply With the Protecting Americans’ Data From Foreign Adversaries Act” (Jun. 5, 2024).