Proposed Transaction/Agreement Assessment

Use the decision trees below to assess a proposed transaction or agreement for compliance with the DOJ Bulk Data Rule.

Note: The following decision trees are not intended to precisely summarize the Bulk Data Rule, which you are encouraged to review in full. In case of any discrepancies between the information on this page and the Bulk Data Rule, the Bulk Data Rule controls. The information on this page is a tool to help you determine whether your project may be subject to the Bulk Data Rule. Please reach out to ethicsandcompliance@ucsd.edu with questions.

Phase 1: Parties Involved

Assess the receiving party before the transaction.

Step 1: Entities Involved - U.S. Person

Is the receiving party a U.S. Person? 

YES: The rule does not apply; proceed with the transaction using Contract Language Version 2, unless you complete the Phase 2 Decision Tree and determine that the agreement does not involve the transfer of human biospecimens, U.S. Sensitive Personal Data, or U.S. Government-related Data. 

NO: Proceed to step 2 

U.S. Person: Any U.S. citizen, national, or lawful permanent resident; any individual admitted as a refugee or granted asylum; any entity organized under U.S. laws (including foreign branches); or any person located within the United States, regardless of citizenship (including foreign visitors physically present on campus). 

Step 2: Restricted Party Screening

Screen the receiving party (including any known aliases) through Visual Compliance, are there any potential hits? 

YES: Contact the Export Control Office for further review; the transaction cannot proceed until the review is complete. 

NO: Proceed to step 3 

Step 3: Entities Involved - Covered Person or Country of Concern

Is the receiving party the government of a Country of Concern, a person located in a Country of Concern, or an entity organized in a Country of Concern? Do you otherwise have reason to believe the receiving party is a Covered Person? 

YES: Transaction is prohibited unless you complete the Phase 2 Decision Tree and determine that the agreement does not involve the transfer of human biospecimens, U.S. Sensitive Personal Data, or U.S. Government-related Data; or if in consultation with the office of Ethics and Compliance it is determined that the transaction fits within an exemption or license.

NO: Can proceed with transaction, must include Contract Language Version 1. 

Country of Concern: Foreign governments designated by the U.S. Attorney General as posing a significant risk to national security. These currently include: China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela.

Covered Person:  

• A foreign person that is: 

• An entity 50% or more owned, directly or indirectly, individually or in aggregate, by Countries of Concern or Covered Persons. 

• An entity organized or chartered under the laws of, or having its principal place of business in, a Country of Concern. 

• An individual who is an employee or contractor of a Country of Concern or a Covered Entity. 

• A foreign individual primarily resident in a Country of Concern. 

• Any person specially designated by the U.S. Attorney General on the Covered Persons List.

Phase 2: Transaction Type

Analysis under this phase is only required if receiving parties were determined to be Covered Persons or Countries of Concern under Phase 1. It may also be utilized to determine that contractual language is not needed.

Step 4: Type of Transaction

Does the agreement involve outgoing data or shipment of human biospecimens? 

YES - data: Proceed to step 5  

YES – human biospecimen: If receiving party is a Covered Person or Country of Concern this transaction is prohibited unless it falls into an exemption or license. Please notify the Office of Ethics and Compliance ethicsandcompliance@ucsd.edu of the details of the proposed transaction and whether you believe an exemption may apply. 

NO: This rule does not apply to your data transaction. 

Human Biospecimens: A quantity of tissue, blood, urine, or other human-derived material. 

Step 5: Type of Data

Is the data U.S. Sensitive Personal Data or U.S. Government-related data? 

YES: If receiving party is a Covered Person or Country of Concern this transaction is prohibited unless it falls into an exemption or license. Please notify the Office of Ethics and Compliance ethicsandcompliance@ucsd.edu of the details of the proposed transaction and whether you believe an exemption may apply. 

NO: This rule does not apply to your data transaction. 

• U.S. Sensitive Personal Data: Any one or combination of the following (regardless of the technical state of the data, including data that has been anonymized, pseudonymized, de-identified, or encrypted), that is linked or linkable to any identifiable U.S. individual or to a discrete and identifiable group of U.S. persons – 
  1. Covered Personal Identifiers: Listed identifiers (e.g., SSN, driver's license, device IDs) linked to a specific person. 
  2. Personal Financial Data: Data related to credit, bank accounts, or financial liabilities. 
  3. Personal Health Data: Health status, medical records, or treatment history. 
  4. Precise Geolocation Data: Real-time or historical location data for U.S. persons or devices. 
  5. Biometric Identifiers: Physical characteristics (facial images, prints, voice) used for identity. 
  6. Human ‘Omic Data: Proteomic, transcriptomic, or epigenomic data, or human biospecimens from which such data could be derived. 
  7. Human Genomic Data: DNA sequences, or human biospecimens (e.g., blood, tissue) from which sequences are derived.

• U.S. Government-related Data: Includes the following: 
  1. Any precise geolocation data, regardless of volume, for any location within any area enumerated  on the Government-related Location Data List in § 202.1401 which the Attorney General has determined poses a heightened risk of being exploited by a country of concern to reveal insights about locations controlled by the Federal Government, including insights about facilities, activities, or populations in those locations, to the detriment of national security, because of the nature of those locations or the personnel who work there. Such locations may include: 
     1. The worksite or duty station of Federal Government employees or contractors who occupy a national security position 
     2. A military installation 
     3. Facilities or locations that otherwise support the Federal Government’s national security, defense, intelligence, law enforcement, or foreign policy missions.  
  2. Any sensitive personal data, regardless of volume, that a transacting party markets as linked or linkable to current or recent former employees or contractors, or former senior officials, of the United States Government, including the military and Intelligence Community.