Stopping the Bleeding on an Unknown Data Liability

Executive Order 14117 was signed in February 2024. The Department of Justice published the Final Rule implementing it in January 2025. Compliance phased in through the year.

The rule restricts covered transactions that give countries of concern access to bulk sensitive personal data on U.S. persons. Six countries are named. China is one of them.

Covered Data spans several categories: personal identifiers, precise geolocation, biometric identifiers, human genomic data and biospecimens, other human ‘omic data, personal health data, and personal financial data. Each has its own threshold. Human genomic data crosses into bulk at just 100 U.S. persons.

A global biotech operating commercial and research across both the United States and China is squarely in scope. When they engaged Data Sentinel, the compliance liability was, in the client's own words, of “unknown volume and severity.” They did not know how much Covered Data they held. They did not know where it sat. They did not know which cross-border flows carried it.

The default playbook for a compliance obligation of this shape is a discovery project. A consulting firm scopes the assessment, interviews stakeholders, samples systems, produces a classification report, delivers a remediation roadmap, and closes the engagement. Remediation gets scoped later, budgeted later, staffed later.

That model has two problems, and both hit exactly where this regulation lives.

The report is out of date the day it ships. Data keeps entering the environment after the sample window closes. Retention decisions get made or not. Regulatory definitions evolve. The classification snapshot describes an environment that no longer exists.

Worse, a classification report tells the company how much Covered Data was there. It does not reduce how much is there today. The exposure sits in a binder waiting for a project to be funded and staffed. Every day of that gap is a day the enforcement risk continues at its measured level, not below it.

Data Sentinel does not run discovery projects. The platform is deployed inside the client's own environment on day one and starts classifying immediately. Classification is continuous, not a snapshot. Risk reduction starts the moment the classifier is on.

Prove It Live, Then Scale

The client did not want a multi-year commitment before they saw the platform work inside their own environment. That constraint shaped how the engagement was designed.

Data Sentinel proposed a proof-gated deployment. The platform would run inside the client's actual production estate, not a sandbox. It would run against three sources chosen to span the environment's diversity: one structured enterprise data warehouse, one unstructured collaboration platform, and one analytics lakehouse. Each source type presents a different classification challenge. Getting all three right meant the platform could handle the rest.

Before any scan touched production data, the label taxonomy had to be aligned with the client's data classification governance and privacy office. Data-owner sign-off was required. Automated classification at scale, without governed labels, would have created expensive reclassification rework months later. Governance sequencing wasn't a design preference. It was the only way the automation would hold up.

The proof-gate had specific success criteria. Classification accuracy across the four DOJ Covered Data categories had to clear a threshold. The platform had to run inside production without disrupting normal operations. Data-owner sign-off had to be maintained through the scan cycle. Three sources. Three success criteria per source.

Every one cleared.

The proof also carried a second effect. While the POC ran, aggregate risk on net-new Covered Data started dropping, because the classifier was already flagging what was in-scope as it arrived. The reduction was real, not projected. Scaling was no longer a bet on whether the platform would work. It was extending something that already was.