Data Security Confirmation Form

Data Security Confirmation Form

Parties

Client Name:

Service Provider Name:

Recitals

WHEREAS, Client and Service Provider have entered into a business relationship under which Service Provider will perform information technology, data processing, hosting, or other services that require access to Client data;

WHEREAS, in connection with those services Service Provider may collect, receive, store, or otherwise process Confidential Data of Client; and

WHEREAS, the Parties desire to document the security measures, breach notification obligations, and related assurances regarding the handling of such data.

Effective Date

Effective Date:

Scope of Work

Describe services to be provided by Service Provider and the types of Client data to be accessed, processed, or stored:

Security Measures and Controls

Service Provider represents that, at a minimum, the following administrative, technical, and physical safeguards are implemented for Client data (check all that apply and provide details where requested):

Encryption in transit (TLS/HTTPS)

Encryption at rest for stored data

Role-based access controls and least-privilege enforcement

Multi-factor authentication for privileged accounts

Documented incident response plan

Regular vulnerability scanning and remediation

Periodic penetration testing

Employee security awareness training

Subcontractor security controls and written agreements

Secure data disposal and media sanitization

Audit Rights

Client may reasonably audit or assess Service Provider's security controls applicable to Client data. Service Provider shall provide evidence of controls including, but not limited to, third-party audit reports, certifications, or agreed-upon assessment materials.

Service Provider confirms Client audit rights

Breach Notification and Incident Response

Service Provider shall notify Client of any confirmed or reasonably suspected data breach affecting Client data without undue delay and in no event later than:

Notification Timeframe:

Security Contact Name:

Data Return and Destruction

Upon termination or expiration of services, Service Provider shall, at Client's direction, return all Client data or securely destroy such data and certify destruction in writing within:

Payment Terms

Payment Amount:

Late Fee:

Term and Termination

Term Start Date:

Term End Date:

Termination Notice Period (days):

Either party may terminate for material breach if the breach remains uncured after the notice period above or as otherwise provided in the parties' service agreement.

Confidentiality and Data Protection

Service Provider shall treat all Client data as Confidential Information and shall not disclose, use, or permit access to such data except as necessary to perform the Scope of Work and in accordance with written instructions from Client. Service Provider shall implement and maintain reasonable administrative, technical and physical safeguards to protect data against unauthorized access, disclosure, alteration or destruction.

Service Provider will ensure any personnel with access to Client data are subject to confidentiality obligations and receive appropriate security training. Any authorized subcontractor must be bound by written obligations at least as protective as those set forth herein.

Limitation of Liability and Indemnification

Each party's liability for claims arising from a breach of the security or confidentiality obligations shall be governed by the parties' underlying agreement. Service Provider agrees to indemnify and defend Client from third-party claims arising from Service Provider's negligent acts or willful misconduct in handling Client data, except to the extent such claims result from Client's breach or negligent instructions.

Governing Law

This Data Security Confirmation Form shall be governed by the laws of the state of:

Entire Agreement

This form, together with any referenced service agreement between the Parties, constitutes the entire agreement with respect to the subject matter herein and supersedes any prior or contemporaneous agreements, understandings, or communications relating to data security obligations, unless expressly stated otherwise in writing signed by both Parties.

Certifications and Acknowledgments

By signing below, Service Provider hereby confirms that the statements and selections made in this form are true, accurate, and a current representation of its security controls. Service Provider agrees to notify Client promptly of any material change to the controls described herein.

Service Provider Representative Name:

Title:

Sign Now