Technology and cybersecurity

Executive Order 14117: Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern

President: Joseph R. Biden Jr.

Directed Justice to restrict transactions that give countries of concern access to bulk sensitive personal data or United States Government-related data.

Status: In effect.

Is Executive Order 14117 still in effect? Yes. Active; Justice Department Data Security Program in force.

What does Executive Order 14117 do?

Justice was assigned transaction rules, CISA security requirements for restricted deals, and agencies licensing and enforcement coordination.

Administration position: The order’s findings and policy rationale were the Biden administration’s positions. This guide distinguishes them from implementation records and judicial rulings.
SignedFebruary 28, 2024
Lead officialsJustice, Homeland Security/CISA and other national-security agencies
Express timingProposed and final rules after public process; program effective April 8, 2025

Before and after

Before the order

Privacy, export-control and investment-review laws addressed pieces of the risk but did not comprehensively regulate commercial transfers of sensitive data.

After the order

Justice issued 28 CFR part 202 and CISA issued security requirements. The program took effect April 8, 2025, with specified due-diligence, audit and reporting duties effective October 5, 2025; no express revocation was located.

Who had to do what

Agency / officeActionTiming / position
JusticeDefine countries, covered persons and prohibited or restricted transactionsRulemaking completed
CISAIssue security requirements for restricted transactionsCompleted
AgenciesCoordinate licensing and enforcementOngoing

What happened next

EO 14117 signed.

Justice issued the final rule.

The Data Security Program took effect.

Deferred compliance and reporting requirements took effect.