PRIA Logo™
119-s-3161119th Congress

Protecting DOD Data Act of 2025

Sponsored By: Senator Slotkin, Elissa [D-MI]

Introduced

Summary

Protecting DoD personal data tied to operational security. This bill would require the Department of Defense to identify and prioritize personal data that could affect military or civilian operational security and to limit its collection, use, sharing, and storage.

Show full summary
  • Members of the Armed Forces and civilian DoD personnel would get tighter limits on collection, use, dissemination, and retention of personal data tied to operational security. The bill generally bars storing that data on non-DoD servers unless under a DoD contract or with the individual's permission.
  • DoD system owners and staff with read or write access would face new standards, training, reporting, and regular security debriefings, including a debriefing after departure. The Secretary must send details of these requirements to Congress within 30 days after they are developed.
  • Contractors and cloud providers could host this data only under a DoD contract unless the Secretary issues a written waiver that certifies operational security risks were considered and national security is not at risk.
  • Congress would receive notifications within 30 days of changes to related departmental policy, waivers, noncompliant storage or data exfiltration, unauthorized storage on non-DoD servers, or exposure of personal data in a cyber incident. The notification requirement sunsets after five years.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

1 provisions identified: 0 benefits, 0 costs, 1 mixed.

Stronger DoD data protections and rules

If enacted, the bill would require the Secretary of Defense to identify personal data that could affect operational security and protect it. The Secretary would review guidance and, if needed, issue new guidance by June 1, 2026. DoD personal data could not be stored on non-DoD servers or cloud services unless under a contract. Personnel data could be stored off-platform if the person gives permission. The Secretary could waive the ban with a written certification for national security that addresses operational risks. The Secretary would notify Congress within 30 days after issuance changes (this notice ends five years after enactment). The Secretary would also notify Congress within 30 days after events like waivers, data exfiltration, unapproved storage, or data exposure. The bill would require training and reporting rules for staff who have system owner access across multiple DoD platforms. These staff would get regular security debriefings, including after they leave. The Secretary would send Congress the developed training and debriefing details within 30 days after completion.

Sponsors & CoSponsors

Sponsor

Slotkin, Elissa [D-MI]

MI • D

Cosponsors

  • Sen. Ernst, Joni [R-IA]

    IA • R

    Sponsored 11/7/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation