# 28 C.F.R. § 202.205 (2026): Bulk

> Federal · Regulations · In force

URL: https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_205

## Section

- **Citation:** 28 C.F.R. § 202.205 (2026)
- **Heading:** Bulk
- **Jurisdiction:** Federal
- **Kind:** Regulations
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** Title 28 CFR: Judicial Administration / Chapter I: DEPARTMENT OF JUSTICE / Part 202: ACCESS TO U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS / Subpart B: Definitions / § 202.205: § 202.205   Bulk.

## Text

The term
bulk
means any amount of sensitive personal data that meets or exceeds the following thresholds at any point in the preceding 12 months, whether through a single covered data transaction or aggregated across covered data transactions involving the same U.S. person and the same foreign person or covered person:
(a) Human `omic data collected about or maintained on more than 1,000 U.S. persons, or, in the case of human genomic data, more than 100 U.S. persons;
(b) Biometric identifiers collected about or maintained on more than 1,000 U.S. persons;
(c) Precise geolocation data collected about or maintained on more than 1,000 U.S. devices;
(d) Personal health data collected about or maintained on more than 10,000 U.S. persons;
(e) Personal financial data collected about or maintained on more than 10,000 U.S. persons;
(f) Covered personal identifiers collected about or maintained on more than 100,000 U.S. persons; or
(g) Combined data, meaning any collection or set of data that contains more than one of the categories in paragraphs (a) through (f) of this section, or that contains any listed identifier linked to categories in paragraphs (a) through (e) of this section, where any individual data type meets the threshold number of persons or devices collected or maintained in the aggregate for the lowest number of U.S. persons or U.S. devices in that category of data.

## Nearby sections

- [28 C.F.R. § 202.201 (2026) § 202.201   Access.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_201.md)
- [28 C.F.R. § 202.202 (2026) § 202.202   Attorney General.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_202.md)
- [28 C.F.R. § 202.203 (2026) § 202.203   Assistant Attorney General.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_203.md)
- [28 C.F.R. § 202.204 (2026) § 202.204   Biometric identifiers.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_204.md)
- [28 C.F.R. § 202.205 (2026) § 202.205   Bulk.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_205.md)
- [28 C.F.R. § 202.206 (2026) § 202.206   Bulk U.S. sensitive personal data.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_206.md)
- [28 C.F.R. § 202.207 (2026) § 202.207   CFIUS action.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_207.md)
- [28 C.F.R. § 202.208 (2026) § 202.208   China.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_208.md)
- [28 C.F.R. § 202.209 (2026) § 202.209   Country of concern.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_209.md)
- [28 C.F.R. § 202.210 (2026) § 202.210   Covered data transaction.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_210.md)
- [28 C.F.R. § 202.211 (2026) § 202.211   Covered person.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_211.md)
- [28 C.F.R. § 202.212 (2026) § 202.212   Covered personal identifiers.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_212.md)
- [28 C.F.R. § 202.213 (2026) § 202.213   Cuba.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_213.md)
- [28 C.F.R. § 202.214 (2026) § 202.214   Data brokerage.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_214.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_205. Check the current official text before relying on it. Not legal advice.