The Brain Data Science Platform (BDSP) is a controlled-access research repository. We make data available under a Data Use Agreement to support bona fide noncommercial scientific, clinical, public health, educational, and scholarly research.

Commercial entities are not eligible to receive access through this pathway. Industry-Researcher applications are auto-rejected at intake. Researchers may not sell, license, sublicense, transfer, broker, redistribute, or provide access to BDSP data or record-level derivatives. Researchers may not use the data for product development, product validation, commercialization, marketing, advertising, model training outside the approved research, or any other commercial purpose.

Access is governed by a Data Use Agreement and is limited to approved researchers, approved institutions, and approved research purposes. We charge no fee for access through this pathway.

The U.S. Department of Justice Data Security Program (DSP), enacted under Executive Order 14117 and codified at 28 C.F.R. Part 202, regulates access by a country of concern or a covered person to bulk U.S. sensitive personal data, which includes personal health data, and to U.S. government-related data. The DSP took effect on April 8, 2025 and full enforcement began July 8, 2025.

The countries of concern are China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela. A covered person includes, among others, an individual who primarily resides in a country of concern, an individual who is an employee or contractor of a country of concern or of an organization that is itself a covered person, and an organization that is based in, organized under the laws of, or majority-owned by a country of concern.

BDSP's access pathway is no-fee and noncommercial, as described above, and it remains so. In addition, and at the direction of Stanford University's Office of the General Counsel, BDSP does not make controlled-access (restricted and credentialed) datasets available to covered persons. What changed and what it means for users is explained on the Data Security Program page.

BDSP applies the restriction as follows.

• Credentialing applications ask for the applicant's country of primary residence. An application from someone who primarily resides in a country of concern cannot be approved.
• Data use agreements for restricted datasets ask for the country of primary residence before signing, and every agreement includes a representation that the signer is not a covered person.
• Existing access held by a user who primarily resides in a country of concern is withdrawn. We contact each affected user and ask them to delete the controlled-access data they downloaded.
• Open-access datasets are not affected.

The restriction follows from where a person primarily resides and from the other criteria in the regulation. It is not based on citizenship, nationality, ethnicity, or national origin, and it is not a judgment of anyone's research.

BDSP may also conduct additional review where a proposed access request involves a country of concern or a covered person in another way. Examples include, but are not limited to:

• An applicant whose institution is located in a country of concern.
• A sponsor, funder, or grant condition associated with a country of concern.
• A request to store or process the data on infrastructure located in a country of concern.
• A proposed collaboration, contractor, vendor, or onward-transfer arrangement involving a covered person or institution.

Does the DOJ Data Security Program prevent researchers in certain countries from accessing BDSP data?

For controlled-access (restricted and credentialed) datasets, yes. People who primarily reside in China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, or Venezuela, and others who are covered persons under the rule, cannot be given access. Open-access datasets remain available to everyone. See the Data Security Program page.

I am a citizen of one of those countries but I live somewhere else. Am I affected?

Citizenship alone does not make someone a covered person. We ask for your country of primary residence, meaning where you actually live. A person who lives elsewhere can still be a covered person in other ways, for example as an employee or contractor of an organization based in a country of concern, and the Data Use Agreement asks you to confirm that you are not one.

I already had access and it was withdrawn. What should I do?

Please delete the controlled-access data you downloaded, including copies and record-level derivatives, and confirm using the link in the notice we sent you. If our record of your country of primary residence is wrong, submit a support request and we will review it.

What if my project is funded by a sponsor in a country of concern?

Tell us in your application. We review requests that involve a country of concern through an institution, sponsor, collaborator, or data-storage location, and we may not be able to approve them.

What if I want to use the data in a commercial product?

You may not. Access through this pathway is for bona fide noncommercial research only. Commercial entities are not eligible, and Industry-Researcher applications are auto-rejected at intake. If you have a commercial use in mind, please contact BDSP separately so we can discuss whether a different licensing arrangement is appropriate.

Where is the legal language?

The detailed contractual obligations are in the Credentialed Data Use Agreement (and the corresponding Restricted DUA, where applicable). All credentialed users sign the DUA before being granted access.

• 28 C.F.R. Part 202 (DOJ Data Security Program final rule) — effective 2025-04-08, full enforcement 2025-07-08
• DOJ DSP Compliance Guide and FAQs
• NIH Notice NOT-OD-25-083
• BDSP Data Security Program page

Page last updated 2026-10-13.