Pentagon must lock down military personnel data, report breaches to Congress
S. 3161 — Protecting DOD Data Act of 2025 · Filed by Elissa Slotkin (D-MI) · 1 cosponsor · Introduced Nov 7, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires the Department of Defense to strengthen protections for personal data of military members and civilian employees that could compromise their operational security. The Secretary of Defense must review and update data-protection policies by June 2026, restrict storage of sensitive personnel data to authorized Department servers unless the data subject consents, and notify Congress within 30 days of policy changes, security waivers, data breaches, or unauthorized storage incidents for five years.
Why we flagged it
The bill's core mechanism is a data-security and privacy mandate for DOD personnel records, with Congressional oversight requirements. It is a protective measure, not a deregulation or carve-out.
What the text implies
- The bill anchors data-protection standards to practices 'in effect on the day before enactment,' which may freeze protections at a specific baseline and complicate future updates to privacy law without explicit amendment.
- Secretary's waiver authority in subsection (c)(2) is broad—requiring only written certification that a waiver 'appropriately considers' operational security risks and is 'necessary in the interest of national security'—potentially allowing exceptions to storage restrictions without detailed justification.
- Congressional notification requirement sunsets after five years, after which DOD policy changes and security incidents may no longer trigger mandatory reporting to Congress.
- The bill does not specify penalties or enforcement mechanisms for violations of storage restrictions or failure to notify Congress, leaving compliance and remedies unclear.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Military members and DOD civilian employees gain stronger legal protections for personal data that could expose them to physical harm or compromise their safety. Congressional notification requirements create accountability for data breaches and security decisions affecting these personnel.
Named in the bill
Department of Defense, Secretary of Defense, Armed Forces, Congress, DOD contractors and subcontractors
Where it stands
1 cosponsor: 1 Republicans.
- Nov 7, 2025 — Introduced · Congress.gov: “Introduced in Senate”
- Nov 7, 2025 — Referred to Senate Committee on Armed Services · Congress.gov: “Read twice and referred to the Committee on Armed Services”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (4,578 characters) on Jun 3, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-20.
“Pentagon must lock down military personnel data, report breaches to Congress” QuorumCivic. https://share.quorumcivic.app/bill/119/s3161 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.