32 CFR § 37.855
How should I handle protected data?
July 1, 2020
Prior to releasing or disclosing data marked with a restrictive legend (as described in §37.850) to third parties, you should require those parties to agree in writing that they will:
(a) Use the data only for governmental purposes; and
(b) Not release or disclose the data without the permission of the licensor (i.e., the recipient).