Can a CDP Request be e-signed?

Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA, electronic signatures are generally enforceable in the United States when intent, consent, attribution, and record retention requirements are satisfied. Certain exceptions (wills, court orders) may still require wet signatures.

What if the form collects HIPAA-protected data?

If the CDP Request collects protected health information, ensure a Business Associate Agreement (BAA) with your eSignature provider and follow HIPAA safeguards. Maintain HIPAA records for six years as required by 45 CFR §164.530(j) and follow breach notification standards when applicable.

Is notarization usually required?

Not typically. Most CDP Requests do not require notarization. If a contract or state rule demands notarized acknowledgement, consider Remote Online Notarization (RON) where available and verify identity-proofing and recording requirements.

How long must I keep completed requests?

Retention depends on applicable law: IRS baseline is three years (IRC §6501(a)), HIPAA six years (45 CFR §164.530(j)), and Sarbanes-Oxley seven years (15 U.S.C. §7245) where relevant. State laws can extend these periods.

What common submission errors slow review?

Frequent issues include mismatched legal names, missing supporting evidence, vague security descriptions, unsigned fields, and incorrect date formats. Validate fields and attachments before submission to prevent rework.

Is signNow suitable for collecting signatures?

signNow supports legally binding eSignatures under ESIGN and UETA, provides audit trails, TLS 1.2/1.3 transport security, AES-256 at-rest encryption, SOC 2 Type II and ISO 27001 certifications, and offers HIPAA-compliant configurations when a BAA is executed.

Client CDP Request

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

CLIENT CDP REQUEST

Request Summary

Client Name:

Client Address:

Matter Reference / Account No.: Date of Notice / Action:

Recitals

WHEREAS, Client Name: (the "Client") has received a collection notice or proposed enforcement action relating to the matter identified above; and

WHEREAS, Service Provider Name: (the "Representative") is authorized by the Client to prepare, file and prosecute on the Client's behalf a Collection Due Process request or equivalent administrative review seeking hearing and review of the proposed collection action; and

WHEREAS, the parties desire to set forth the scope of the Representative's engagement, the fees and terms applicable to the work, and the Client's authorizations and certifications.

Scope of Work

Describe actions to be taken by Representative

Supporting Documents and Authorizations

Check all documents that will accompany the CDP request or are being supplied to Representative:

Power of Attorney or representation authorization provided

Collection notice / levy notice attached

Account transcript / account history attached

Copies of relevant returns and filings attached

Payment Terms

Fee Amount Payment Schedule Late Payment

Fees charged for additional appeals, litigation, or subsequent proceedings will be billed separately at rates described in the Representative's engagement letter or as otherwise agreed in writing.

Term and Termination

Engagement Start Date:

Anticipated Completion Date:

Termination Notice

Either party may terminate this engagement for material breach or for convenience upon the notice period above. Termination does not relieve the Client of the obligation to pay for work performed and documented costs incurred prior to termination.

Confidentiality

The Representative shall treat all non-public client information as confidential and shall not disclose such information except as necessary for the preparation and prosecution of the CDP request, as authorized by the Client, or as required by applicable law. The Representative will take commercially reasonable measures to safeguard confidential materials and will return or destroy such materials upon termination or at Client's direction.

Certifications and Authorizations

By checking the box below and signing, the Client certifies that the information supplied is true and accurate to the best of the Client's knowledge, that the Client authorizes the Representative to act on the Client's behalf in connection with the CDP request, and that the Representative may receive disclosure of and discuss the Client's matter with the relevant collection authority.

I certify that I am authorized to engage the Representative and that the statements above are true.

Governing Law; Entire Agreement

Governing Law: The validity, interpretation and enforcement of this Request shall be governed by the laws of the state of without regard to conflict of law rules.

Entire Agreement: This Request constitutes the entire agreement between the Client and the Representative with respect to the services described herein. Any modification must be in writing and signed by both parties.

Additional Instructions / Notes

Special instructions or limitations on authority

Client Name:

By:

Date:

Representative Name:

By:

Date:

What the Client CDP Request Is and when it’s used

The Client CDP Request is a standardized form used to collect a client's data processing profile, compliance attestations, and supporting documentation during onboarding, vendor review, or periodic audit. It typically asks for organizational details, data categories handled, processing locations, security controls, subcontractor lists, retention schedules, and applicable certifications or regulatory regimes. Organizations use it to assess privacy risk, determine contractual safeguards, and document responsibilities for data handling. The form can be delivered on paper or electronically; when signed digitally it must meet ESIGN/UETA standards for enforceability and retention.

Why a Client CDP Request matters for compliance and contracting

A Client CDP Request centralizes required information for privacy and security assessments, reduces back-and-forth during contracting, and creates an auditable record for compliance reviews. Accurate responses speed risk acceptance and clarify contractual data protection obligations.

Teams and roles that typically complete a Client CDP Request

Procurement, legal, privacy, and security teams use the Client CDP Request to collect standardized vendor or customer processing details during onboarding and audits.

Privacy officers and compliance teams assessing regulatory obligations and contractual safeguards.
Procurement and vendor managers standardizing supplier responses for security and contract negotiations.
Client account managers collecting processing details required for billing, integration, or service delivery.

Smaller teams may use a condensed CDP Request while enterprises often require expanded sections and evidence attachments for audits.

Core sections to include in a professional Client CDP Request

A professional Client CDP Request groups questions into scope, data inventory, controls, subprocessors, retention, and evidence so reviewers can quickly assess risk and confirm contractual commitments.

Scope

Describe the processing activities requested, geographic and jurisdictional boundaries, purpose of processing, and any limitations or exclusions. Clear scope avoids misinterpretation in later contracts.

Data Categories

List personal data and special categories processed, including identifiers, financial, health, or education data. Specify formats, structured/unstructured status, and affected user groups.

Security Controls

Detail administrative, technical, and physical safeguards (encryption, access controls, logging, incident response). Include metrics or certificates such as SOC 2, ISO 27001 where applicable.

Subprocessors

Identify third-party subprocessors, the nature of their processing, locations, and contractual safeguards. Require notification and approval or substitution rights as needed.

Retention

State retention schedules for each data category, criteria for deletion, archival procedures, and conditions triggering extended retention (legal holds, audits).

Evidence List

Specify required supporting documents: security attestations, penetration test summaries, data inventory, data flow diagrams, and signed policies or certifications.

Step-by-step: completing and submitting a Client CDP Request

Follow these steps to complete, validate, and submit a Client CDP Request accurately for onboarding and compliance review.

01

Prepare: Gather legal name, contact, data inventory, and certifications.
02

Complete: Fill each field using required formats and full legal names.
03

Attach: Include supporting evidence: diagrams, certificates, test summaries.
04

Submit: Send via platform or email and obtain signed confirmation.

Typical routing and approval flow for the Client CDP Request

A Client CDP Request commonly flows from the requester to technical and legal reviewers, then to signatories, with each step logged for auditability.

Upload: Sender uploads form to secure portal.
Assign: Route to privacy, security, and legal reviewers.
Review: Reviewers annotate, request clarifications, and approve.
Sign: Obtain signatures and store executed record.

Recommended online workflow settings for Client CDP Requests

Configure online workflow options to enforce required fields, set authentication, and automate reviewer routing for the Client CDP Request.

Field	Configuration
Required Fields	Enable required validation and conditional visibility.
Authentication	Email link, SMS code, or SSO options.
Attachments	Allow file uploads with size limits and accepted types.
Reminders	Auto reminders and escalation after set intervals.

Platform capabilities to support Client CDP Request workflows

Use an eSignature platform that supports PDF/DOCX, audit trails, SSO, and integrations with CRM or document storage to streamline distribution and retention.

Formats: PDF, DOCX, HTML supported.
Integrations: Salesforce, NetSuite, Google Workspace, Microsoft 365.
Security: TLS in transit and AES-256 at rest.

Key timing expectations for issuing and responding

Set clear deadlines for response, internal review SLAs, and signature turnarounds to avoid contract delays and to manage audit readiness.

Response Deadline:

Typical requester deadline 7–21 calendar days.

Review SLA:

Internal security and legal review within 5–10 business days.

Signature Deadline:

Sign and return within agreed term or SLA.

Retention Start:

Retention begins on effective date or signed date.

Audit Response:

Provide requested evidence within 10–30 business days.

Real-world examples of Client CDP Request use

Two brief examples show how organizations used a standardized Client CDP Request to reduce review cycles and improve evidence collection.

Optica Ventures (COO)

Optica Ventures centralized vendor attestations and data inventories to standardize onboarding across partners.

Reduced follow-ups and clarified responsibilities.
Brian Fitzgibbons, COO at Optica Ventures: 'The interface is simple and easy-to-use for our team; more importantly, it is just as easy for our customers.' This reduced onboarding time and improved response completeness across partners.

Martin Properties (Founder)

A regional real estate firm used the Client CDP Request to capture tenant and vendor data consistently across mobile and desktop channels.

Enabled remote closing and faster approvals.
Tim Martin, Founder at Martin Properties: 'I can process and execute all of these documents online with 100% compliance and built-in security. Whether on mobile or working offline, I can get forms back to their necessary parties efficiently.' This improved turnaround and reduced paper storage needs.

Practical best practices for accurate, auditable CDP Requests

Implement these practices to reduce errors, speed approvals, and preserve legal enforceability of Client CDP Requests.

Confirm legal entity and signatory authority

Verify the legal entity name against formation documents and tax identifiers, and confirm the signer's authority to bind the organization. Obtain supporting documentation when necessary to avoid re-execution or disputes during audits or contract enforcement.

Use structured data and controlled vocabularies

Use predefined lists and dropdowns for data categories and processing activities to reduce ambiguity. Structured inputs simplify comparisons, automate mapping to internal risk categories, and prevent free-text variations that cause manual reconciliation work.

Document security controls with evidence

Require attestations and attach evidence such as SOC 2 reports, ISO certificates, penetration testing summaries, or security questionnaires. Include dates and scope for each item to ensure the evidence matches the required controls and timeframe.

Establish clear retention and disposition rules

State retention schedules tied to specific data categories and include conditions for legal holds or regulatory exceptions. Provide clear deletion procedures, responsible parties, and verification steps to demonstrate compliance during audits.

Common preparation errors to avoid

Leaving fields empty, using abbreviated names, or omitting processing locations leads to repeated follow-up and delays in contract acceptance.
Describing controls as 'industry standard' without specifics (encryption level, access controls) prevents effective risk assessment and may block approvals.
Signatures or legal names that differ from tax IDs cause verification failures and may require re-execution or notarization.
Stating vague retention like 'as needed' conflates legal hold obligations and can create compliance gaps during audits.

Risks and potential consequences of incorrect responses

Regulatory Fines: Possible HIPAA/FTC enforcement.

Breach Liability: Increased legal exposure.

Contractual Delays: Negotiation stalled.

Onboarding Rejection: Service denied due to gaps.

Invalid Signatures: May render consent unenforceable.

Operational Disruption: Integration or billing errors.

Sequential milestones for processing a Client CDP Request

Track these numbered milestones from issuance through archival to maintain accountability and progress visibility.

01

Request Issued

Requester issues form and sets response deadline.

02

Client Response

Client returns completed form and attachments.

03

Internal Review

Privacy, security, and legal reviewers complete assessment.

04

Finalization

Obtain signatures, store executed copy, start retention clock.

Baseline eSignature pricing and capability comparison for CDP workflows

Compare baseline pricing and capabilities for common eSignature vendors useful when sending and signing Client CDP Requests.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes (Business Premium)	Yes	Yes	Yes	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Who can legally sign the Client CDP Request

Authorized Officer — CEO

Typically a chief executive or other officer listed in formation documents may sign to bind the organization. Verify corporate bylaws and any board resolutions that delegate signing authority; obtain proof of delegation when signatory is not a named officer.

Delegated Signatory — Manager

Organizations often delegate signing authority to VPs, directors, or named managers for operational agreements; ensure written delegation, limit scope by dollar amount or topic, and confirm authority before acceptance to prevent disputes.

Frequently asked questions about completing and submitting a Client CDP Request

Answers to common questions about completing, signing, and storing a Client CDP Request, including electronic signature and compliance considerations.

Need help? Contact support

Can a CDP Request be e-signed?
Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA, electronic signatures are generally enforceable in the United States when intent, consent, attribution, and record retention requirements are satisfied. Certain exceptions (wills, court orders) may still require wet signatures.
What if the form collects HIPAA-protected data?
If the CDP Request collects protected health information, ensure a Business Associate Agreement (BAA) with your eSignature provider and follow HIPAA safeguards. Maintain HIPAA records for six years as required by 45 CFR §164.530(j) and follow breach notification standards when applicable.
Is notarization usually required?
Not typically. Most CDP Requests do not require notarization. If a contract or state rule demands notarized acknowledgement, consider Remote Online Notarization (RON) where available and verify identity-proofing and recording requirements.
How long must I keep completed requests?
Retention depends on applicable law: IRS baseline is three years (IRC §6501(a)), HIPAA six years (45 CFR §164.530(j)), and Sarbanes-Oxley seven years (15 U.S.C. §7245) where relevant. State laws can extend these periods.
What common submission errors slow review?
Frequent issues include mismatched legal names, missing supporting evidence, vague security descriptions, unsigned fields, and incorrect date formats. Validate fields and attachments before submission to prevent rework.
Is signNow suitable for collecting signatures?
signNow supports legally binding eSignatures under ESIGN and UETA, provides audit trails, TLS 1.2/1.3 transport security, AES-256 at-rest encryption, SOC 2 Type II and ISO 27001 certifications, and offers HIPAA-compliant configurations when a BAA is executed.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now