S. 3161: Protecting DOD Data Act of 2025

The Protecting DOD Data Act of 2025 aims to enhance the protection of personal data related to the operational security of Department of Defense (DoD) personnel. Here are the key components of the bill:

Enhanced Protection of Personal Data

The bill mandates the Secretary of Defense to prioritize the safeguarding of personal data that impacts the operational security of members of the Armed Forces and civilian employees. This includes:

• Identifying and prioritizing data that needs protection.
• Preventing unauthorized collection, use, dissemination, or retention of such data.

Review and Guidance Issuance

By June 1, 2026, the Secretary of Defense is required to review existing policies regarding the protection of personal data and issue new or revised guidance if needed to enhance protection measures. This must align with privacy laws and practices that were in effect prior to the enactment of this Act.

Data Storage Regulations

The bill includes regulations about where Departmental personal data can be stored:

• Personal data must not be stored on non-Department servers or cloud services unless done through a proper contract or with the data subject’s consent.
• The Secretary may grant waivers for such storage under specific security conditions, ensuring that it does not pose risks to operational or national security.

Notifications to Congress

The Secretary of Defense must notify Congress of any changes to policies or occurrences related to the handling of personal data:

• Notices must be submitted within 30 days of any changes to departmental data protection policies.
• Notifications about specific events, such as data breaches or unauthorized storage, must also be reported to Congress within the same timeframe.

This notification requirement will remain in effect for five years following the law's enactment.

Standards and Training for System Owners

The Secretary is tasked with developing standards, training, reporting, and security debriefing requirements for personnel with access to sensitive data across multiple Department information systems. This includes:

• Providing regular security debriefings to personnel, including those leaving the Department.
• Notifying Congress about the developed standards and training details.

Summary

In summary, the Protecting DOD Data Act of 2025 seeks to reinforce data protection measures for personal information related to the security of DoD personnel. It includes provisions for policy review, data storage regulations, congressional notifications about changes and incidents, and establishing standards and training for personnel handling this sensitive data.

Relevant Companies

• MSFT (Microsoft Corporation): As a major provider of cloud services, changes in DoD data storage regulations could impact Microsoft's contracts with the Department of Defense.
• GOOGL (Alphabet Inc.): Similar to Microsoft, Alphabet's cloud services could also be affected by the bill’s stipulations on data storage and protection.