# 28 C.F.R. § 202.210 (2026): Covered data transaction

> Federal · Regulations · In force

URL: https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_210

## Section

- **Citation:** 28 C.F.R. § 202.210 (2026)
- **Heading:** Covered data transaction
- **Jurisdiction:** Federal
- **Kind:** Regulations
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** Title 28 CFR: Judicial Administration / Chapter I: DEPARTMENT OF JUSTICE / Part 202: ACCESS TO U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS / Subpart B: Definitions / § 202.210: § 202.210   Covered data transaction.

## Text

(a)
Definition.
A
covered data transaction
is any transaction that involves any access by a country of concern or covered person to any government-related data or bulk U.S. sensitive personal data and that involves:
(1) Data brokerage;
(2) A vendor agreement;
(3) An employment agreement; or
(4) An investment agreement.
(b)
Examples
—(1)
Example 1.
A U.S. institution conducts medical research at its own laboratory in a country of concern, including sending several U.S.-citizen employees to that laboratory to perform and assist with the research. The U.S. institution does not engage in data brokerage or a vendor, employment, or investment agreement that gives a covered person or country of concern access to government-related data or bulk U.S. sensitive personal data. Because the U.S. institution does not engage in any data brokerage or enter into a vendor, employment, or investment agreement, the U.S. institution's research activity is not a covered data transaction.
(2)
Example 2.
A U.S. person engages in a vendor agreement with a covered person involving access to bulk U.S. sensitive personal data. The vendor agreement is a restricted transaction. To comply with the CISA security requirements, the U.S. person, among other things, uses data-level requirements to mitigate the risk that the covered person could access the data. The vendor agreement remains a covered data transaction subject to the requirements of this part.
(3)
Example 3.
A covered person engages in a vendor agreement with a U.S. person involving the U.S. person accessing bulk U.S. sensitive personal data already possessed by the covered person. The vendor agreement is not a covered data transaction because the transaction does not involve access by the covered person.

## Nearby sections

- [28 C.F.R. § 202.201 (2026) § 202.201   Access.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_201.md)
- [28 C.F.R. § 202.202 (2026) § 202.202   Attorney General.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_202.md)
- [28 C.F.R. § 202.203 (2026) § 202.203   Assistant Attorney General.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_203.md)
- [28 C.F.R. § 202.204 (2026) § 202.204   Biometric identifiers.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_204.md)
- [28 C.F.R. § 202.205 (2026) § 202.205   Bulk.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_205.md)
- [28 C.F.R. § 202.206 (2026) § 202.206   Bulk U.S. sensitive personal data.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_206.md)
- [28 C.F.R. § 202.207 (2026) § 202.207   CFIUS action.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_207.md)
- [28 C.F.R. § 202.208 (2026) § 202.208   China.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_208.md)
- [28 C.F.R. § 202.209 (2026) § 202.209   Country of concern.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_209.md)
- [28 C.F.R. § 202.210 (2026) § 202.210   Covered data transaction.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_210.md)
- [28 C.F.R. § 202.211 (2026) § 202.211   Covered person.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_211.md)
- [28 C.F.R. § 202.212 (2026) § 202.212   Covered personal identifiers.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_212.md)
- [28 C.F.R. § 202.213 (2026) § 202.213   Cuba.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_213.md)
- [28 C.F.R. § 202.214 (2026) § 202.214   Data brokerage.](https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_214.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/CFR_T28_P202_S202_210. Check the current official text before relying on it. Not legal advice.