Can this form be signed electronically?

Yes. Under the federal ESIGN Act (15 U.S.C. §7001) and UETA (adopted by most states) electronic signatures are legally valid when intent, consent, attribution, and record retention are satisfied.

Do I need a notary or witnesses?

Most Data Identification Forms do not require notarization. If the form is combined with an affidavit or instrument that requires notarization, follow state notary rules and RON guidance where applicable.

How long should I retain the completed form?

Retention depends on data type and regulation. Follow IRS, HIPAA, and other applicable rules; for HIPAA records retain six years (45 CFR §164.530(j)) and for financial records follow IRC requirements.

What if the dataset contains PHI?

Treat PHI with heightened controls: execute a BAA for processors, apply encryption and access controls, and document handling in the form to support HIPAA compliance.

Who to contact for disputes or corrections?

List the data owner and a privacy or security contact on the form. Corrections should be logged and re-approved following the standard workflow.

How to handle state variations in notarization or RON?

Check the receiving jurisdiction's notary and RON rules before execution. Some states have limited RON frameworks or additional authentication requirements.

Electronic Signature
Templates
Miscellaneous
Data Identification Form

Data Identification Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Data Identification Form

Recitals

WHEREAS, Client Name: (the "Client") seeks identification, classification, transfer, access, or other processing of certain data assets for business purposes; and

WHEREAS, Provider Name: (the "Provider") agrees to identify, catalogue, and describe such data assets, and to provide related services under the terms and conditions set forth in this Data Identification Form and any associated agreement;

WHEREAS, the parties intend this document to identify the data assets, the applicable handling requirements, and the responsibilities of each party in connection with the described work.

Scope of Work

Scope Description

Data Inventory and Identification

Data Asset Name:

Data Attributes Data Source / System Categories (select all that apply)

Personal Data Sensitive Personal Data Non-Personal Data Aggregated/Anonymized Derived Data

Estimated Volume / Size Retention Period Unique Identifiers, Keys, and Linkages

Authorized Use and Purpose

Permitted Purposes

Security and Handling Requirements

Required security controls (encryption, access controls, logging):

Payment Terms

Fee Amount:

Payment Schedule

Late Payment Fee (if applicable):

Term and Termination

Effective Start Date: Termination / End Date:

Termination for convenience requires written notice of days by the terminating party. Termination for material breach is effective upon the non-breaching party's written notice if the breach is not cured within a reasonable cure period as set forth in the primary agreement.

Confidentiality

The parties acknowledge that the data identified herein may constitute Confidential Information. Each party shall maintain the confidentiality of such data, implement reasonable administrative, physical, and technical safeguards appropriate to the sensitivity of the data, and shall not disclose, transfer, or use the data except as expressly permitted in writing. Recipient's obligations shall survive for the longer of five (5) years following termination or for the duration required by applicable law.

Representations and Warranties

Each party represents and warrants that it has the right to disclose and permit the use of the data as contemplated by this form and that the data, to the disclosing party's knowledge, does not violate applicable law or third-party contractual obligations. Client warrants that the data does not contain material that the Client is prohibited from sharing under law or contract.

Governing Law and Entire Agreement

Governing Law: . The parties agree that this Data Identification Form, together with any referenced primary agreement, constitutes the entire understanding between the parties regarding the subject matter hereof and supersedes all prior negotiations and understandings with respect to that subject matter.

Certifications

By signing below, the signatory certifies that the information provided in this form is true and accurate to the best of their knowledge, that they are authorized to execute this document on behalf of the named party, and that they will comply with the terms and obligations set forth herein.

Client Printed Name:

By:

Date:

Provider Printed Name:

By:

Date:

What the Data Identification Form Is and when it's used

A Data Identification Form is a standardized record used to describe, classify, and track datasets, personal information, or system-generated records across an organization. It captures source, data type, sensitivity, retention category, access controls, and any regulatory constraints. Organizations use it for privacy mapping, data inventories, incident response, vendor intake, and audit readiness. Completed forms help legal, compliance, security, and business teams quickly assess risk, determine appropriate safeguards, and document decisions consistent with internal policies and applicable U.S. laws.

Why a Data Identification Form matters for compliance and operations

Collecting consistent metadata reduces regulatory risk, speeds incident triage, and supports accurate retention and access controls. A formal form ensures each dataset is evaluated the same way, which simplifies audits and cross-functional review.

Teams and roles that typically complete the form

The Data Identification Form is routinely completed by cross-functional teams to centralize knowledge about datasets before transfer, processing, or sharing.

Data Protection Officer and Privacy Team — Leads classification, legal review, and ensures regulatory requirements are captured.
IT / Security Administrators — Provide technical source, encryption status, and access controls for the dataset.
Business Data Owners — Confirm business purpose, retention needs, and who should access the data.

When completed jointly, the form becomes a single source of truth that supports vendor assessments, breach response, and records retention decisions.

Core sections to include in a professional Data Identification Form

A well-structured form covers provenance, classification, access, retention, legal constraints, and approval workflow so reviewers can make consistent decisions quickly.

Dataset Identity

Unique name, version, and brief description that differentiates this dataset from others and records expected use cases.

Data Elements

List of fields and data types (PII, PHI, financial), including examples and schema references where available.

Source & Lineage

Original data source, ingestion method, transformation steps, and downstream consumers for traceability.

Classification

Sensitivity level (public, internal, confidential, restricted) and applicable regulatory flags such as HIPAA or FERPA.

Retention & Disposal

Retention period, legal basis, archival location, and disposal method when retention ends.

Approvals & Controls

Authorized approvers, technical access controls, monitoring requirements, and exception notes.

Essential security and compliance fields

Encryption: AES-256 at rest

In-Transit: TLS 1.2/1.3

Regulatory Flags: HIPAA, FERPA, PCI

Access Controls: Role-based lists

Audit Trail: Logging enabled

BAA Required: Yes / No

Step-by-step: complete and approve a Data Identification Form

Follow these steps to collect, review, and record dataset metadata consistently across teams.

01

Prepare: Gather schema, samples, and source details before starting the form.
02

Classify: Identify sensitivity and regulatory flags.
03

Validate: Confirm technical controls and retention with IT/security.
04

Approve: Route to data owner and compliance for signatures.

Configuring the online workflow for the form

Set up fields, routing, and authentication once and reuse the template to reduce errors and speed processing.

Field	Configuration
Authentication	Email link or SMS code; use MFA for restricted data
File Format	Use PDF or DOCX for archivable records
Conditional Logic	Show PHI fields only when flagged as applicable
Routing Order	Data Owner → Security → Legal → Final Approver

Where completed forms are sent and how they are processed

Define the destination systems and expected downstream actions so form recipients know the next steps.

Destination: Records repository or data inventory catalog
Notification: Automated email to owner and approvers
Integration: Sync metadata to CMDB or data catalog
Audit: Audit trail stored with the signed form

Digital signing and platform needs

Choose a platform that supports secure eSignature, audit trails, conditional fields, and integration with your records system.

Formats Supported: PDF, DOCX, HTML
Integrations: Salesforce, NetSuite, Google Workspace
Authentication: Email, SMS code, SSO

Ensure the vendor provides AES-256 at rest and TLS 1.2/1.3 in transit, supports audit logging, and offers a Business Associate Agreement when handling PHI.

Timelines and expected processing targets

Establish internal SLAs so requestors and approvers know when to expect completion and reviews.

Initial Completion Target:

Complete form within 7 business days of intake

Security Review Window:

Security should respond within 5 business days

Legal Review Window:

Legal review completed within 10 business days

Annual Revalidation:

Revalidate metadata and access annually

Ad-hoc Updates:

Update within 5 business days of material change

Common mistakes to avoid when preparing the form

Incomplete owner information, which stalls approvals and complicates incident response and data subject requests.
Listing vague data types like 'customer info' instead of specific fields such as 'email' or 'SSN', reducing usefulness.
Missing retention dates or legal basis, which leads to inconsistent deletion and potential regulatory exposure.
Not updating the access list after personnel changes, which creates stale privileges and audit findings.

Risks and potential consequences of incorrect or missing information

Privacy Breach Fines: Regulatory fines and remediation costs

HIPAA Exposure: Civil and corrective actions for PHI mishandling

Operational Delay: Project holds and lost productivity

Contractual Liability: Vendor breach or indemnity claims

Reputational Harm: Customer trust erosion

Legal Discovery Risk: Failure to produce records in litigation

Real-world examples of form use

Illustrative examples show how teams structure forms to speed approvals and support compliance tasks.

Optica Ventures

Data intake standardized across projects to reduce confusion.

One central owner per dataset improved accountability.
The company used the form to accelerate due diligence and simplified auditor requests by having consistent metadata on every dataset.

Martin Properties

Real estate team mapped tenant and lease data before migrations.

Centralized classification prevented PHI exposure.
The approach reduced manual reviews during property closings and provided a clear retention schedule for lease documents and tenant records.

Who may sign or authorize the completed form

Data Protection Officer

DPO or primary privacy lead signs to confirm classification and regulatory flags. This signer certifies the legal review and that appropriate safeguards have been identified for sensitive data.

Authorized Officer

Business owner or authorized corporate officer approves purpose and access. This signature indicates acceptance of operational responsibilities and confirms retention and disposal decisions.

Practical tips for accurate, efficient completion

Follow these practices to reduce review cycles and ensure forms are actionable for security and legal teams.

Use controlled vocabularies and templates

Standardize field values (classification, retention categories) so automated systems can parse and apply policies consistently across datasets.

Attach sample records or schema references

Include representative data samples or schema links to help technical reviewers validate field definitions and confirm transformation rules.

Automate routing and reminders

Configure the workflow to notify reviewers and escalate after SLAs lapse to maintain processing timeliness and accountability.

Log every update and signer

Keep an immutable audit trail of changes, signer identity, and timestamps to support audits and incident investigations.

eSignature vendor pricing and capability snapshot for form signing

Compare common pricing and feature considerations for high-volume form signing; signNow is listed first per vendor comparison convention.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes (Business Premium)	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes (BAA available)	Yes	Yes	No	No

Frequently asked questions about the Data Identification Form

Answers to common questions about completion, eSignature validity, retention, and state-specific concerns for the Data Identification Form.

Need help? Contact support

Can this form be signed electronically?
Yes. Under the federal ESIGN Act (15 U.S.C. §7001) and UETA (adopted by most states) electronic signatures are legally valid when intent, consent, attribution, and record retention are satisfied.
Do I need a notary or witnesses?
Most Data Identification Forms do not require notarization. If the form is combined with an affidavit or instrument that requires notarization, follow state notary rules and RON guidance where applicable.
How long should I retain the completed form?
Retention depends on data type and regulation. Follow IRS, HIPAA, and other applicable rules; for HIPAA records retain six years (45 CFR §164.530(j)) and for financial records follow IRC requirements.
What if the dataset contains PHI?
Treat PHI with heightened controls: execute a BAA for processors, apply encryption and access controls, and document handling in the form to support HIPAA compliance.
Who to contact for disputes or corrections?
List the data owner and a privacy or security contact on the form. Corrections should be logged and re-approved following the standard workflow.
How to handle state variations in notarization or RON?
Check the receiving jurisdiction's notary and RON rules before execution. Some states have limited RON frameworks or additional authentication requirements.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now