Each contract entered into by the Department of Defense on or after the date of the enactment of this section shall include a provision prohibiting the contractor and each subcontractor under such contract from selling, licensing, or otherwise transferring covered individually identifiable Department employee data to any individual or entity other than the Federal Government, except to the extent required to perform such contract or a subcontract under such contract and that would be permissible pursuant to statute or guidance from the Director of the Office of Management and Budget.

The Secretary of Defense may waive the requirements of subsection (a) with respect to a sale, licensing, or other transfer of covered individually identifiable Department employee data if the Secretary determines that such waiver is appropriate.