This bill directs the Department of Defense to strengthen protections for sensitive personal data of military personnel and DOD civilian employees that could affect operational security. The Secretary of Defense must identify and prioritize safeguarding this data and issue new or updated guidance by June 1, 2026, based on privacy standards that were in effect before the bill's enactment. The legislation restricts storage of operational security-related personal data on non-Department servers or cloud services unless authorized by contract or with the individual's permission, though the Secretary can issue waivers in limited national security circumstances. The bill requires the DOD to notify Congress within 30 days of any policy changes related to protecting this data, any security incidents involving such data, or any waivers issued—with these notification requirements expiring five years after enactment. Additionally, the DOD must develop training standards and security debriefing requirements for personnel who manage sensitive data across multiple DOD information systems.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.