The Coverage Test: Data, Access, and Counterparty Together

The DOJ Data Security Program becomes operationally useful when its separate definitions are tested against one proposed arrangement. This checkpoint connects the data inventory from the previous discussion with counterparty status and the four qualifying transaction forms. The result is a disciplined way to decide whether a proposed activity is a covered data transaction—before asking whether it is prohibited, restricted, exempt, or otherwise authorized.

The doorway has several conditions

Under 28 CFR Part 202, a covered data transaction is not created by one alarming fact. The rule requires a combination: access by a country of concern or covered person; government-related data or bulk U.S. sensitive personal data; and one of four transaction forms—data brokerage, a vendor agreement, an employment agreement, or an investment agreement. If one of those elements is missing, the particular arrangement may not be a covered data transaction on the facts being examined. If all are present, the analysis has crossed the doorway, but it has not yet answered what the company may do next.

That order matters. “The data is sensitive” identifies a data-side concern, not a complete legal result. “The counterparty is foreign” identifies a possible relationship, not necessarily a country-of-concern or covered-person status. “The service is secure” describes a control condition, not whether access exists or whether the transaction is permitted. The coverage test prevents any one of these statements from standing in for the full analysis.

Start with the data record. Is the information government-related data or bulk U.S. sensitive personal data under the definitions already established? What kind of data is it, what amount is represented, and what linkage or description travels with it? The record should identify the data that the transaction actually exposes, not simply the largest dataset the company happens to hold. A transaction may expose a subset of a database, a derived output, or access to a system that can retrieve more information than the first business request describes.

Next identify the access capability. The question is whether the relevant party can obtain, read, copy, decrypt, view, receive, or otherwise affect the data through the system or arrangement. Direct transfer is only one path. A query interface, administrator role, cloud console, tracking technology, or software feature can create access. The regulation says that access is determined without regard to the application or effect of security requirements when deciding whether a transaction is covered. This keeps the coverage question separate from the later question of whether mandated controls authorize a restricted transaction.

Then verify the counterparty. Is the recipient the government of a country of concern, an entity that falls within a covered-person class, an individual primarily resident in a country of concern, an employee or contractor of a covered entity, or a person designated by the Attorney General? A neutral incorporation country or a clean public-list search does not settle every ownership, residence, employment, or designation question. The counterparty record must attach to the person or entity that can actually obtain access, including a relevant intermediary or administrator.

Finally map the commercial relationship. The same data and recipient can raise different questions depending on whether the arrangement sells or licenses access, provides a service, employs a person, or gives an investor a relevant relationship with the company.