Legal DC PIA Agreement

LEGAL DC PIA AGREEMENT

THIS PRIVACY IMPACT ASSESSMENT AGREEMENT (this Agreement) is entered into as of Effective Date: , by and between Agency Name: , a party responsible for collection and oversight of Covered Data, and Processor Name: , responsible for processing Covered Data on behalf of the Agency. The parties are sometimes referred to individually as a Party and collectively as the Parties.

RECITALS

WHEREAS, the Agency conducts operations that require collection, use and sharing of personal data and has determined that a Privacy Impact Assessment (PIA) is necessary to evaluate privacy risks and mitigation measures for systems and programs that process personal data; and

WHEREAS, the Processor provides services that will involve access to or processing of Covered Data on behalf of the Agency and is required to implement and attest to technical, administrative, and physical safeguards to protect such data; and

WHEREAS, the Parties wish to set forth their respective responsibilities with respect to the PIA, required safeguards, incident response, and compliance monitoring.

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

1. DEFINITIONS

1.1 "Covered Data" means any information, whether stored or transmitted, that identifies or can be used to identify an individual, including but not limited to names, addresses, unique identifiers, biometric data, and any other data elements described in the Data Inventory.

1.2 "Assessment" means the Privacy Impact Assessment documentation created to identify privacy risks, data flows, data categories, and mitigation measures for systems or services provided under this Agreement.

1.3 "Personal Data" is synonymous with Covered Data and includes any information subject to applicable privacy laws and regulations of the District of Columbia.

2. PURPOSE AND SCOPE

The purpose of this Agreement is to document the Parties' obligations regarding the Assessment, identify Covered Data to be processed, and establish required safeguards, notification procedures, and audit rights. This Agreement applies to all systems, services, and subcontractors that process Covered Data on behalf of the Agency under any statement of work or contract referenced below.

3. DATA INVENTORY AND DESCRIPTION

The Processor shall maintain and provide a Data Inventory that identifies: (a) categories of Covered Data processed; (b) sources of data; (c) recipients and recipients' purposes; (d) systems and storage locations; and (e) retention schedule. The Data Inventory is incorporated by reference and must be kept current.

4. SECURITY, PRIVACY AND SAFEGUARDS

4.1 The Processor shall implement, maintain and document administrative, technical, and physical safeguards appropriate to the sensitivity of the Covered Data, including but not limited to access controls, authentication, encryption of data at rest and in transit, logging and monitoring, vulnerability management, and periodic testing. Safeguards shall meet or exceed industry-standard practices for similarly situated processors.

4.2 The Processor shall ensure that access to Covered Data is granted only on a need-to-know basis and that personnel with access are trained, bound by confidentiality obligations, and subject to background checks as required by the Agency.

5. DATA MINIMIZATION AND RETENTION

5.1 The Processor shall limit collection, retention, and access to Covered Data to the minimum necessary to perform the services specified by the Agency. Any use beyond the agreed purpose is prohibited without the Agency's prior written consent.

6. INCIDENT RESPONSE AND NOTIFICATION

6.1 The Processor shall notify the Agency without unreasonable delay and, in any event, within hours of discovery of an actual or suspected data breach affecting Covered Data. Notification shall include a description of the incident, the Covered Data impacted, remediation steps taken and planned, and contact information for the Processor's incident commander.

7. AUDIT, INSPECTION AND RECORDS

7.1 The Agency or its authorized representative shall have the right to audit and inspect Processor policies, procedures, records, and systems relevant to Covered Data and compliance with this Agreement on reasonable notice. The Processor shall cooperate and provide access to logs, configurations, and documentation necessary to demonstrate compliance.

8. SUBPROCESSORS

8.1 The Processor shall not engage any subcontractor to process Covered Data without the Agency's prior written consent. Where consent is granted, the Processor shall impose obligations on subcontractors consistent with this Agreement and remain fully responsible for subcontractor performance.

9. CONFIDENTIALITY

9.1 The Processor shall treat all Covered Data and Assessment materials as Confidential Information and shall not disclose such information except as required to perform the services or as compelled by law, provided that, to the extent permitted, the Processor provides the Agency prior notice and an opportunity to seek protective relief.

10. INDEMNIFICATION AND LIMITATION OF LIABILITY

10.1 The Processor shall indemnify, defend and hold harmless the Agency from and against any third-party claims, losses, liabilities, costs and expenses (including reasonable attorneys' fees) arising out of Processor's breach of this Agreement or Processor's negligent or intentional acts or omissions in connection with processing Covered Data. The Parties' liability shall be subject to any limitations agreed in the governing prime contract, except for liability arising from willful misconduct or gross negligence.

11. TERM AND TERMINATION

11.1 This Agreement shall commence on the Effective Date and shall continue for the duration of the services requiring the Assessment, unless earlier terminated in accordance with the governing contract. Upon termination or expiration, the Processor shall return or securely destroy all Covered Data as directed by the Agency, certify completion of destruction, and purge backups in accordance with the retention schedule.

12. NOTICES

12.1 All notices required or permitted under this Agreement shall be in writing and delivered to the addresses set forth below or to such other address as either Party may provide by written notice in accordance with this Section.

13. AMENDMENTS, WAIVER AND COUNTERPARTS

13.1 No amendment to this Agreement shall be effective unless in writing and signed by authorized representatives of both Parties. A waiver of any provision is effective only if in writing. This Agreement may be executed in counterparts and delivered by electronic means, each of which shall be deemed an original and all of which constitute one instrument.

14. GOVERNING LAW, ENTIRE AGREEMENT, SEVERABILITY

14.1 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the District of Columbia without regard to conflict of law principles.

14.2 Entire Agreement. This Agreement, together with any referenced Data Inventory and applicable statements of work or contracts, constitutes the entire agreement between the Parties with respect to the subject matter and supersedes all prior oral or written agreements and understandings.

14.3 Severability. If any provision of this Agreement is found unenforceable, the remaining provisions shall remain in full force and effect and the Parties shall negotiate in good faith a substitute provision to effect the original intent.

15. MISCELLANEOUS

15.1 Survival. The Parties' obligations with respect to Confidentiality, Indemnification, Records, and Data Disposal shall survive expiration or termination of this Agreement for so long as necessary to satisfy applicable legal obligations or the retention schedule.

Sign Now