# 28 CFR § 202.249: Sensitive personal data

> Federal · Regulations · In force

URL: https://www.frixlaw.com/law-library/statutes/ecfr-28-202.249

## Section

- **Citation:** 28 CFR § 202.249
- **Heading:** Sensitive personal data
- **Jurisdiction:** Federal
- **Kind:** Regulations
- **Status:** In force
- **Text as of:** September 22, 2026
- **Source:** Publisher's official text
- **Location:** Title 28—Judicial Administration > CHAPTER I—DEPARTMENT OF JUSTICE > PART 202—ACCESS TO U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS > Subpart B—Definitions

## Text

(a) Definition. The term sensitive personal data means covered personal identifiers, precise geolocation data, biometric identifiers, human `omic data, personal health data, personal financial data, or any combination thereof.
(b) Exclusions. The term sensitive personal data, and each of the categories of sensitive personal data, excludes:
(1) Public or nonpublic data that does not relate to an individual, including such data that meets the definition of a “trade secret” (as defined in 18 U.S.C. 1839(3)) or “proprietary information” (as defined in 50 U.S.C. 1708(d)(7));
(2) Data that is, at the time of the transaction, lawfully available to the public from a Federal, State, or local government record (such as court records) or in widely distributed media (such as sources that are generally available to the public through unrestricted and open-access repositories);
(3) Personal communications; and
(4) Information or informational materials and ordinarily associated metadata or metadata reasonably necessary to enable the transmission or dissemination of such information or informational materials.

## Nearby sections

- [28 CFR § 202.101 § 202.101 Scope.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.101.md)
- [28 CFR § 202.102 § 202.102 Rules of construction and interpretation.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.102.md)
- [28 CFR § 202.103 § 202.103 Relation of this part to other laws and regulations.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.103.md)
- [28 CFR § 202.104 § 202.104 Delegation of authorities.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.104.md)
- [28 CFR § 202.105 § 202.105 Amendment, modification, or revocation.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.105.md)
- [28 CFR § 202.106 § 202.106 Severability.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.106.md)
- [28 CFR § 202.201 § 202.201 Access.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.201.md)
- [28 CFR § 202.202 § 202.202 Attorney General.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.202.md)
- [28 CFR § 202.203 § 202.203 Assistant Attorney General.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.203.md)
- [28 CFR § 202.204 § 202.204 Biometric identifiers.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.204.md)
- [28 CFR § 202.205 § 202.205 Bulk.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.205.md)
- [28 CFR § 202.206 § 202.206 Bulk U.S. sensitive personal data.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.206.md)
- [28 CFR § 202.207 § 202.207 CFIUS action.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.207.md)
- [28 CFR § 202.208 § 202.208 China.](https://www.frixlaw.com/law-library/statutes/ecfr-28-202.208.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/ecfr-28-202.249. Check the current official text before relying on it. Not legal advice.