Skip to main content
Office of Ethics & Compliance OEC
  1. HOME
  2. Compliance Program
  3. DOJ Bulk Data Rule
  4. Contract Language

Contract Language

Use the contract language below to incorporate DOJ Bulk Data Rule requirements into contracts and agreeements.

Version 1: Default Language

Data Transaction Restrictions and Compliance (28 CFR § 202.302(a)(1)) 

  1. Definitions. For the purposes of this Section, the terms "Bulk U.S. Sensitive Personal Data," "Country of Concern," "Covered Data Transaction," "Covered Person," "Data Brokerage," and "Government-Related Data" have the same definition as in 28 CFR Part 202. The term “human biospecimens” has the same definition as in NIH Notice NOT-OD-25-160.
  2. Certification. Receiving Party certifies that they are not a “Covered Person” as defined in 28 CFR Part 202. Should Receiving Party become a Covered Person under 28 CFR Part 202, Receiving Party shall immediately notify UC San Diego of this status and UC San Diego shall have the right to terminate this contract. Additionally, should UC San Diego determine that Receiving Party is or becomes a Covered Person under 28 CFR Part 202.211, UC San Diego shall have the right to terminate this contract.
  3. Prohibition on Onward Transfer. Receiving Party acknowledges that any data provided by University to Receiving Party to store, use, or access pursuant to this Agreement may constitute "Bulk U.S. Sensitive Personal Data" or "Government-Related Data," and may alone or in aggregate with data provided to Receiving Party under prior or subsequent agreements, become subject to federal regulations concerning data access by countries of concern or covered persons. Receiving Party shall not engage in a subsequent Covered Data Transaction involving Data Brokerage of the data received under this Agreement which is "Bulk U.S. Sensitive Personal Data" or "Government-Related Data" with any Country of Concern or Covered Person. If this Agreement involves human biospecimens subject to NIH Notice NOT-OD-25-160, Receiving Party shall not directly or indirectly distribute those biospecimens to an institution or party located in a Country of Concern without University’s prior written approval under a documented exception permitted by NIH. Notwithstanding any ambiguity or uncertainty regarding whether the volume, nature, or specific characteristics of the data received, processed, or accessed by the Receiving Party meet the precise thresholds or definitions established by 28 CFR 202 (or any successor regulation), the Receiving Party hereby unconditionally agrees to comply with all requirements set forth in 28 CFR 202 with respect to all data received, processed, or accessed by the Receiving Party pursuant to this Agreement.
  4. Reporting Obligations. Receiving Party agrees to report any known or suspected violations of the contractual prohibition outlined above (in Prohibition on Onward Transfer) to University within seven calendar (7) days of becoming aware of or suspecting such violation. University reserves the right to report such violations to the U.S. Department of Justice in accordance with 28 CFR § 202.
  5. Breach. Receiving Party shall be responsible for any and all claims, liabilities, penalties, fines, or damages against University arising out of Receiving Party's failure to comply with 28 CFR § 202. Failure to comply with the provisions of this Section shall constitute a material breach of this Subcontract.

Version 2: Language where all parties are U.S. Persons

Data Transaction Restrictions and Compliance (28 CFR § 202.302(a)(1)) 

The Parties represent and warrant that the activities contemplated under this Agreement are limited to U.S. Persons as defined under 28 C.F.R. Part 202, participants are not covered persons as defined under 28 C.F.R. Part 202 and do not intend or authorize access to, or transfer of, Data or human biospecimens outside the United States. 

The Parties agree that Data or human biospecimens subject to this Agreement shall not be transferred, disclosed, or made accessible to entities or persons located in countries of concern as defined under 28 C.F.R. Part 202, absent prior written agreement of the Parties and compliance with applicable law and institutional policy. 

If any Party becomes aware of proposed foreign-located access or participation involving a country of concern in connection with this Agreement, that Party shall promptly notify the other Parties so that appropriate compliance review may occur and shall not transfer, disclose, or make accessible Data without prior written approval.