Data Security Program: changes to access to controlled-access datasets

---

Brain Data Science Platform has changed who may access its controlled-access datasets in order to comply with the U.S. Department of Justice (DOJ) Data Security Program, issued under Executive Order 14117 and codified at 28 C.F.R. Part 202. The rule took effect on April 8, 2025, and has been enforced since July 8, 2025. We are applying it at the direction of Stanford University's Office of the General Counsel, received on October 13, 2026.

What the rule does

The Data Security Program restricts making bulk U.S. sensitive personal data, which includes personal health data, available to “countries of concern” and to “covered persons.” The countries of concern are China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela.

A covered person includes, among others, an individual who primarily resides in a country of concern, an individual who is an employee or contractor of a country of concern or of an organization that is itself a covered person, and an organization that is based in, organized under the laws of, or majority-owned by a country of concern. The full definitions are in the DOJ compliance guide.

What has changed on Brain Data Science Platform

• Controlled-access datasets, meaning those with restricted or credentialed access, are no longer available to users who primarily reside in a country of concern or who are otherwise covered persons.
• Credentialing applications ask for your country of primary residence. Applications from people who primarily reside in a country of concern are declined.
• Data use agreements for restricted datasets ask for your country of primary residence before you sign, and include a statement that you are not a covered person.
• Existing access held by affected users is being withdrawn. We are contacting each of them directly and asking them to delete the controlled-access data they have downloaded.
• Open-access datasets are not affected. They remain available to everyone, and affected users keep their Brain Data Science Platform accounts.

This is not a judgment of anyone's research

The restriction follows from a U.S. federal regulation about where a person lives or works. It says nothing about the integrity, quality, or value of any researcher's work. We are sorry for the disruption it causes to colleagues who have used these data responsibly, and we will revisit the policy if the regulation or the guidance we receive changes.

If you are affected

• If you received a notice from us, please delete the controlled-access data you downloaded from Brain Data Science Platform, including copies and record-level derivatives, and confirm using the link in the notice.
• If our record of your country of primary residence is wrong, or your circumstances have changed, please submit a support request.
• If you hold access and you move to a country of concern, or otherwise become a covered person, you must tell us and stop using the data.

More information

• DOJ Data Security Program: Compliance Guide
• DOJ National Security Division: Data Security Program
• NIH notice NOT-OD-25-083, on how the program applies to NIH controlled-access data repositories
• Brain Data Science Platform Noncommercial Research Access Policy

Questions? Please submit a support request.