Scope
Define who is covered (employees, contractors, applicants), which systems and data categories are included, and the template's effective geographic scope.
A concise template reduces legal risk, clarifies expectations for data handling, and supports consistent compliance with federal and state privacy obligations such as HIPAA and state consumer privacy laws.
Use a central record to track acknowledgements and maintain copies for audit and retention obligations.
Define who is covered (employees, contractors, applicants), which systems and data categories are included, and the template's effective geographic scope.
State the legal bases for processing (consent, contract necessity, legitimate interest, legal obligation) and note any special categories like health data.
List specific purposes such as payroll, benefits administration, background checks, performance management, and security monitoring with sufficient detail.
Identify categories of third‑party recipients (payroll providers, benefits administrators, IT vendors) and whether transfers are international.
Explain access, correction, deletion, portability, objection, and how to exercise those rights including expected response timeframes.
Describe technical and organizational safeguards, retention periods, and procedures for reporting breaches and policy updates.
| Field | Configuration |
|---|---|
| Signer Order | Employee signs first, then HR or authorized manager. |
| Authentication | Email link with optional SMS code for added assurance. |
| Notifications | Auto reminders at 3, 7, and 14 days for outstanding signatures. |
| Archival | Save signed PDFs with audit trail to secure storage. |
Ensure the platform provides appropriate encryption, access controls, and retention capabilities to meet legal and internal requirements.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | Yes, 7‑day trial | No | No | Yes, limited | Yes, limited |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
Deliver privacy notice at hire or before collecting data when practicable.
Respond to employee data access requests within 45 days where state laws apply.
Issue required breach notices within statutory periods such as HIPAA or state breach laws.
Review and update the template annually or when laws change.
Reassess retention schedules every 2–3 years or on legal change.