28 CFR § 202.209 - Country of concern.

---
identifier: "/us/cfr/t28/s202.209"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "28 CFR § 202.209 - Country of concern."
title_number: 28
title_name: "Judicial Administration"
section_number: "202.209"
section_name: "Country of concern."
chapter_name: "DEPARTMENT OF JUSTICE"
part_number: "202"
part_name: "ACCESS TO U.S. SENSITIVE PERSONAL DATA AND GOVERNMENT-RELATED DATA BY COUNTRIES OF CONCERN OR COVERED PERSONS"
positive_law: false
currency: "2026-04-05"
last_updated: "2026-04-05"
format_version: "1.1.0"
generator: "[email protected]"
authority: "50 U.S.C. 1701  50 U.S.C. 1601  E.O. 14117, 89 FR 15421."
regulatory_source: "90 FR 1706, Jan. 8, 2025, unless otherwise noted."
cfr_part: "202"
---


# 202.209 Country of concern.

The term *country of concern* means any foreign government that, as determined by the Attorney General with the concurrence of the Secretary of State and the Secretary of Commerce:

(a) Has engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or security and safety of United States persons; and

(b) Poses a significant risk of exploiting government-related data or bulk U.S. sensitive personal data to the detriment of the national security of the United States or security and safety of U.S. persons.