; and (B) if exported, reexported, or in-country transferred in a quantity that exceeds the threshold established under paragraph (3), harm the national security of the United States. (2) List required In identifying categories of personal data of covered individuals under paragraph (1), the Secretary, in coordination with the heads of the appropriate Federal agencies, shall— (A) identify an initial list of such categories not later than one year after the date of the enactment of the Protecting Americans' Data From Foreign Surveillance Act of 2023 ; and (B) as appropriate thereafter and not less frequently than every 5 years, add categories to, remove categories from, or modify categories on, that list. (3) Establishment of threshold (A) Establishment Not later than one year after the date of the enactment of the Protecting Americans' Data From Foreign Surveillance Act of 2023 , the Secretary, in coordination with the heads of the appropriate Federal agencies, shall establish a threshold for determining when the export, reexport, or in-country transfer (in the aggregate) of the personal data of covered individuals by one person to or in a restricted country could harm the national security of the United States. (B) Number of covered individuals affected (i) In general Except as provided by clause (ii), the Secretary shall establish the threshold under subparagraph (A) so that the threshold is— (I) not lower than the export, reexport, or in-country transfer (in the aggregate) by one person to or in a restricted country during a calendar year of the personal data of 10,000 covered individuals