Overview
The federal government has established requirements intended to protect Americans' sensitive personal data, government-related data, and certain human biospecimens from unauthorized access by foreign adversaries.
These measures include the U.S. Department of Justice (DOJ) Bulk Data Rule and National Institutes of Health (NIH) requirements affecting certain NIH-supported research involving human biospecimens. Depending on the activity, one or both requirements may apply.
Research collaborations, data-sharing arrangements, vendor relationships, material transfers, and other activities involving foreign individuals or entities may be impacted. This webpage provides information on these requirements, UCLA review processes, and available resources.
UCLA Institutional Responsibility
UCLA requires prior institutional review and approval before engaging in any proposed transaction, collaboration, data access arrangement, transfer, or other activity involving a country of concern or covered person.
Countries of Concern
- China (including Hong Kong and Macau)
- Cuba
- Iran
- North Korea
- Russia
- Venezuela
Covered Person: Under the DOJ Bulk Data Rule, a covered person may include individuals and organizations connected to a country of concern. This can include individuals who primarily reside in a country of concern and organizations that are located in, owned by, controlled by, or acting on behalf of a country of concern. Examples may include:
- Universities
- Hospitals and Medical Centers
- Public or Private Research Institutions
- Academic Professional Organizations
- Companies
- Individuals
UCLA frequently manages large datasets, research materials, and human biospecimens that may be subject to federal restrictions when accessed by, transferred to, or shared with certain foreign collaborators, institutions, or other parties. These requirements may affect research collaborations, data access arrangements, transfer agreements, material transfers, vendor relationships, and other outside engagements. Certain restrictions may apply even if data is anonymized, encrypted, deidentified, or pseudonymized.
This requirement applies regardless of whether applicable federal regulatory thresholds are met and reflects UCLA's research security, export control, privacy, contractual, and data governance responsibilities.
Before proceeding with activities that may involve a country of concern or covered person, UCLA personnel must work with the appropriate campus offices to determine whether additional review, approvals, contractual provisions, or other safeguards are required.
What You Need to Do
- Work with appropriate UCLA Offices: Before proceeding with a proposed transaction, collaboration, data access arrangement, transfer, vendor relationship, or other activity, continue to work with the appropriate UCLA office to facilitate institutional review. This may include offices responsible for sponsored research, industry-sponsored projects, clinical trials, procurement, sales and service activity, technology transfer, or other institutional review functions.
- Set up a MTA/DUA: A Material Transfer Agreement (MTA) or Data Use Agreement (DUA) is a written contract between organizations that governs the transfer of research materials, data, databases, or software. For the transfer or receipt of research materials or data involving a country of concern or covered person, work with TDG to establish the appropriate MTA, DUA, or other transfer agreement. TDG reviews and executes incoming and outgoing transfers on behalf of UCLA faculty and helps ensure appropriate legal, regulatory, intellectual property, and institutional requirements are addressed. Certain types of data or materials may require review by other UCLA offices. Additional information is available on the TDG website.
- Consult UCLA Export Control: In addition to any review or approval requirements for activities involving a country of concern or covered person, any activity involving a comprehensively sanctioned country, currently including Cuba, Iran, North Korea, and certain regions of Ukraine, requires export control review prior to UCLA commitment. Contact export.controls@research.ucla.edu.
- Account for review and approval processes: Activities involving a country of concern or covered person may require review of legal, regulatory, compliance, and other institutional considerations, as well as negotiation and execution of appropriate agreements. Account for the time needed to complete any required reviews and agreements.
What Types of Data May Be Covered?
Examples may include:
- Human genomic data and genetic information
- Human biospecimens (such as blood, tissue, cells, saliva, and other human-derived biological specimens used in research)
- Health and medical information
- Biometric identifiers (such as fingerprints, facial recognition data, or voiceprints)
- Financial information
- Precise geolocation data
- Large datasets containing sensitive personal information about individuals
- Certain US government-related data
Whether a particular activity is subject to federal restrictions depends on the nature of the data, the parties involved, and the applicable federal requirements.
DOJ Bulk Data Rule
The U.S. Department of Justice (DOJ) Bulk Data Rule, issued under Executive Order 14117 and codified at 28 C.F.R. Part 202, restricts certain transactions involving Americans' bulk sensitive personal data and government-related data with countries of concern and covered persons. The rule is intended to address national security risks related to foreign access to sensitive U.S. data.
The rule may apply to activities involving human genomic data, biospecimens, health data, biometric data, financial information, geolocation data, and other categories of sensitive personal data. Certain restrictions may apply even when data is anonymized, pseudonymized, or encrypted.
NIH Human Biospecimen Requirements
The National Institutes of Health (NIH) has established requirements affecting certain NIH-supported research involving human biospecimens. These requirements are intended to strengthen research security protections and may restrict the transfer, sharing, distribution, or continued access to covered biospecimens involving countries of concern.
Researchers should carefully evaluate collaborations, access arrangements, and transfers involving human biospecimens and related data, particularly when foreign institutions, collaborators, contractors, or other parties located in countries of concern may be involved.
How These Requirements Relate
The DOJ Bulk Data Rule and NIH biospecimen requirements are separate federal requirements that may apply to the same activity. Depending on the nature of the data, biospecimens, funding source, collaborators, or destination country involved, one or both requirements may apply. UCLA personnel should not assume that compliance with one requirement satisfies the other.