Data Security Program (EO 14117)
The DSP restricts/prohibits transactions giving countries of concern access to bulk sensitive personal data or government-related data. The initial 90-day enforcement grace period expired July 8, 2025; full requirements (due diligence, audit, reporting) became mandatory October 6, 2025, with civil penalties exceeding $368,000 per transaction and criminal exposure.
