Protecting DOD Data Act of 2025

This bill requires the Department of Defense (DOD) to strengthen protections for personal data tied to operational security of military personnel and civilian employees. It prohibits storing such sensitive data on non-DOD servers or cloud services unless under specific contracts or with data subject permission, and mandates strict waiver conditions for exceptions. The DOD must review privacy guidance by June 2026, implement new security standards for system owners, and notify Congress within 30 days of policy changes, data storage violations, or security incidents involving this data. These requirements aim to prevent data breaches that could endanger personnel or national security. The bill applies directly to DOD data handling practices and personnel managing sensitive information.