Directs the Secretary of Defense to identify and prioritize categories of personal data that could harm operational security and to limit how that data is collected, used, shared, and stored. Requires a review of existing guidance by June 1, 2026, restricts storage of covered data on non-Department servers except for narrow exceptions with written waivers, and establishes notification rules to Congress, standards, training, and regular security debriefings for system owners.