The United States has introduced new restrictions on international access to sensitive personal data, creating important compliance considerations for pharmaceutical companies, biotechnology organizations, and clinical research partners operating globally.
The U.S. Department of Justice (DOJ) Data Security Program establishes rules governing certain transactions involving sensitive U.S. personal data and countries of concern. For Life Sciences organizations managing clinical trials, patient information, and AI-powered regulatory workflows, the regulation adds another dimension to data governance: not only how sensitive data is protected, but who can access it and under what circumstances.
As clinical operations become increasingly interconnected, organizations must ensure that international collaboration does not expose sensitive patient information to unauthorized access.
What is the DOJ Data Security Program?
The DOJ Data Security Program was established under Executive Order 14117 and implemented through 28 CFR Part 202. Its purpose is to prevent certain countries of concern and covered persons from accessing bulk U.S. sensitive personal data and U.S. government-related data through covered transactions.
The final rule took effect on April 8, 2025, with additional compliance obligations becoming applicable on October 6, 2025.
The regulation addresses several categories of sensitive personal information, including health data, human genomic data, and other types of personal information that may be relevant to clinical research.
The DOJ identifies six countries of concern: China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela.
However, the regulation does not prohibit every international transfer of U.S. patient data. Instead, it establishes a framework distinguishing among:
- Prohibited transactions: Certain covered transactions involving access to sensitive data that are not permitted.
- Restricted transactions: Certain transactions that may proceed only when applicable security and compliance requirements are satisfied.
- Exempt transactions: Activities that qualify for specific regulatory exceptions, including certain clinical investigations and regulatory approval activities.
The applicability of the rule depends on factors such as the type and volume of data, the parties involved, and the nature of the transaction.
For Life Sciences companies, this means that international data access must be assessed within the context of the specific research or business activity.
What does the DOJ rule mean for pharmaceutical and biotech companies?
Clinical research is inherently international. Pharmaceutical sponsors frequently collaborate with CROs, research institutions, medical writers, and technology providers operating across multiple jurisdictions.
These relationships often require access to sensitive clinical information, including patient-level datasets, laboratory results, and clinical documentation.
Under the DOJ Data Security Program, organizations must evaluate whether certain international data transactions fall within the scope of the regulation and whether additional restrictions apply.
Consider a multinational clinical trial in which a U.S. pharmaceutical sponsor works with external teams responsible for clinical data analysis, medical writing, and regulatory submissions.
If a covered person can access qualifying sensitive U.S. patient data, the sponsor may need to assess whether the arrangement is prohibited, restricted, or exempt.
Importantly, remote access can be relevant even when the data remains stored on U.S. infrastructure. Physical data location alone does not determine whether a transaction falls within the rule.
The regulation also contains specific exemptions relevant to certain clinical investigations and regulatory approval activities. Organizations must assess these exemptions carefully rather than assuming that all clinical research activities are automatically covered or excluded.
For companies deploying AI in clinical and regulatory workflows, these considerations extend to the systems and external providers that process sensitive information.
Why data segregation and access controls are essential
The DOJ Data Security Program reinforces the importance of maintaining control over sensitive information throughout its lifecycle.
In global clinical operations, data may be collected in one jurisdiction, processed in another, and reviewed by teams across several countries. Without appropriate controls, organizations may struggle to determine which individuals or systems can access particular datasets.
Data segregation provides a practical foundation for managing these risks.
By separating sensitive U.S. patient data from other information, organizations can apply access policies appropriate to different regulatory requirements and operational needs.
Effective data governance also requires:
- Granular access controls: Limiting access to authorized individuals according to their responsibilities and applicable restrictions.
- Traceability: Maintaining records of relevant data access and processing activities.
- Security safeguards: Protecting sensitive information during storage, processing, and authorized transfer.
- Controlled collaboration: Enabling international teams to work together without unnecessarily exposing protected datasets.
For restricted transactions, the DOJ framework also incorporates applicable security requirements developed by the Cybersecurity and Infrastructure Security Agency (CISA).
Data segregation and access management therefore form part of a broader compliance strategy that includes transaction assessments, organizational policies, and appropriate technical safeguards.
How Narrativa supports DOJ-aligned data security requirements
For pharmaceutical and biotechnology companies operating internationally, complying with the DOJ Data Security Program requires more than protecting sensitive information. Organizations must also control how patient data is separated, who can access it, and under which conditions.
Data segregation is a central capability of Narrativa® Navigator, enabling Life Sciences organizations to separate sensitive U.S. patient information from other datasets and apply appropriate access restrictions.
This is particularly important for multinational clinical trials and regulatory workflows, where teams, CROs, and technology providers across different jurisdictions may need to collaborate without accessing the same patient information.
By maintaining separation between datasets, Narrativa helps organizations:
- Isolate sensitive U.S. patient data from other clinical information, supporting jurisdiction-specific data governance.
- Restrict access to authorized users, reducing unnecessary exposure of protected information.
- Support international collaboration while maintaining appropriate boundaries between sensitive datasets.
- Maintain traceability and oversight through controlled workflows and audit trails.
This approach allows pharmaceutical companies to benefit from agentic AI in clinical and regulatory documentation while maintaining greater control over how sensitive patient information is accessed and processed.
Beyond data segregation, Narrativa supports role-based access controls, auditability, and secure data processing. The company has also achieved SOC 2 Type 2 attestation covering Security, Availability, and Confidentiality within its audited scope, and does not use client data to train its AI models.
Together, these capabilities help organizations implement technical safeguards relevant to the DOJ Data Security Program. While compliance ultimately depends on each organization’s specific activities and legal obligations, Narrativa provides a foundation for separating sensitive clinical data and managing access within AI-powered Life Sciences workflows.
Building compliant AI workflows for global Life Sciences operations
The DOJ Data Security Program highlights a growing regulatory priority: sensitive patient data must remain subject to appropriate access controls, even when research and technology operations extend across international borders.
For pharmaceutical and biotechnology companies, this requires evaluating not only where data is stored, but also who can access it, how it is processed, and which legal restrictions apply.
As agentic AI becomes more integrated into clinical and regulatory workflows, data segregation, traceability, and access governance are increasingly important elements of responsible deployment.
Narrativa helps organizations address these challenges by combining AI-powered clinical documentation capabilities with controls designed to support secure data management.
Learn how Narrativa® Navigator can support secure, controlled AI workflows for your Life Sciences organization. Book a demo.
Frequently asked questions
What is the DOJ Data Security Program?
The DOJ Data Security Program is a U.S. regulatory framework established under Executive Order 14117 and implemented through 28 CFR Part 202. It restricts certain transactions that provide countries of concern or covered persons access to bulk U.S. sensitive personal data and government-related data.
Does the DOJ restrict access to U.S. clinical trial data?
Yes, certain transactions involving clinical trial data may be restricted or prohibited, depending on the type of data, applicable thresholds, parties involved, and purpose of the transaction. However, specific exemptions exist for qualifying clinical investigations and regulatory activities.
Can international CROs access American patient data?
Yes, international CROs can access U.S. patient data when the transaction is legally permitted. The DOJ rule does not prohibit all international access. Organizations must evaluate whether the CRO or relevant individuals qualify as covered persons, whether the data and transaction fall within the rule, and whether security requirements or exemptions apply.
How can AI platforms support DOJ data security compliance?
AI platforms can help organizations implement data segregation, granular access controls, audit trails, and secure processing environments. These capabilities support the technical aspects of compliance, although organizations remain responsible for assessing their legal obligations and implementing appropriate operational safeguards.
About Narrativa
Narrativa Agentic AI solutions unlock a faster, smarter future for life sciences organizations, helping them to efficiently produce complex, high-volume documentation for regulatory and commercialization workflows. By automating content creation, Narrativa delivers greater speed, accuracy, and consistency—while ensuring full compliance in highly regulated environments.
Narrativa Navigator Platform provides secure and specialized Agentic AI-powered automation features. It includes complementary user-friendly tools such as the Medical Authoring Companion for CSR and Protocol generation, BioStat Developer for AI Agents for TLF generation and SDTM and ADaM dataset generation, Narrative Pathway, and Redaction Scout, which operate cohesively to transform clinical data into submission-ready documents for regulatory and commercialization. From database to delivery, pharmaceutical sponsors, biotech firms, and contract research organizations (CROs) rely on Narrativa to streamline workflows, decrease costs, and reduce time-to-market across the clinical lifecycle and, more broadly, throughout their entire businesses.
Explore www.narrativa.com and follow on LinkedIn, Facebook, Instagram, and X.