{"data":{"id":"us/28-cfr-202.210","jurisdiction":"us","citation":"28 CFR 202.210","heading":"Covered data transaction.","body":"(a) Definition. A covered data transaction is any transaction that involves any access by a country of concern or covered person to any government-related data or bulk U.S. sensitive personal data and that involves:\n(1) Data brokerage;\n(2) A vendor agreement;\n(3) An employment agreement; or\n(4) An investment agreement.\n(b) Examples—(1) Example 1. A U.S. institution conducts medical research at its own laboratory in a country of concern, including sending several U.S.-citizen employees to that laboratory to perform and assist with the research. The U.S. institution does not engage in data brokerage or a vendor, employment, or investment agreement that gives a covered person or country of concern access to government-related data or bulk U.S. sensitive personal data. Because the U.S. institution does not engage in any data brokerage or enter into a vendor, employment, or investment agreement, the U.S. institution's research activity is not a covered data transaction.\n(2) Example 2. A U.S. person engages in a vendor agreement with a covered person involving access to bulk U.S. sensitive personal data. The vendor agreement is a restricted transaction. To comply with the CISA security requirements, the U.S. person, among other things, uses data-level requirements to mitigate the risk that the covered person could access the data. The vendor agreement remains a covered data transaction subject to the requirements of this part.\n(3) Example 3. A covered person engages in a vendor agreement with a U.S. person involving the U.S. person accessing bulk U.S. sensitive personal data already possessed by the covered person. The vendor agreement is not a covered data transaction because the transaction does not involve access by the covered person.","path":["Title 28—Judicial Administration","CHAPTER I—DEPARTMENT OF JUSTICE","PART 202—ACCESS TO U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS","Subpart B—Definitions"],"source_url":"https://www.ecfr.gov/api/versioner/v1/full/2026-08-25/title-28.xml","current_through":"2026-08-25","vintage":"","retrieved_at":"2026-08-27T02:25:14Z","sha256":"249951ce0777e6ff3a63f60a6217e661296e908da4c7fc4410ddf9605366f3c1","source_id":"us-cfr","stale":true,"prev":"us/28-cfr-202.209","next":"us/28-cfr-202.211"},"notice":"GroundRules: Original legal text. Not legal advice."}