Can the appendix be signed electronically?

Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted. Exceptions exist for wills, certain court filings, and some family law orders. Confirm specific exception rules before using e-signatures for those document types.

What personal fields are required?

Required fields depend on purpose but commonly include full legal name, date of birth, address, contact details, and TIN/SSN when tax or identity verification is necessary. Enter data exactly as on government ID to avoid reporting errors and backup withholding triggers.

Is notarization ever required?

Notarization is not typically required for an appendix alone, but may be necessary if the appendix supports a deed, power of attorney, or other document that statutory law requires notarization. Remote online notarization is available in most states but rules vary by jurisdiction.

How long must I keep the appendix?

Retention depends on included data and applicable laws. Follow IRS minimums (three years from filing, IRC §6501(a)), HIPAA six-year rule for PHI (45 CFR §164.530(j)), and longer industry-specific or state mandates; consult counsel when in doubt.

What happens if data is incorrect?

Incorrect personal data can lead to tax reporting errors, backup withholding, failed identity verification, or contractual disputes. Promptly correct errors through documented amendments, notify affected parties, and retain both original and corrected versions per retention policy to support audits and dispute resolution.

How can consent be revoked?

Revocations should follow the method stated in the appendix and be documented. For consumer-facing records, meet ESIGN disclosure requirements for withdrawal of consent. Record the revocation date, notify parties, and maintain records per retention rules to evidence the change.

Electronic Signature
Templates
Miscellaneous
Personal Information Appendix

Personal Information Appendix

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Personal Information Appendix to General Business Agreement

This Personal Information Appendix (the Appendix) is incorporated into and forms part of the General Business Agreement dated , between Client Name: and Service Provider Name: .

Recitals (Whereas)

WHEREAS, the parties expect that the performance of the General Business Agreement will require the collection, processing and temporary retention of certain personal information about individuals who are employees, contractors, agents or representatives of the parties; and

WHEREAS, the parties wish to set out the specific personal information to be provided, the permitted purposes for its use, and the obligations applicable to the receiving party with respect to protection, return or destruction of such personal information.

WHEREAS, this Appendix memorializes the personal information required, consent and authorization for collection and use, and the security and notification obligations of the parties.

Personal Information to Be Provided

The following identifies the individual whose personal information is supplied pursuant to the Agreement and this Appendix.

Full legal name Preferred name / Alias Date of birth

Month: Day: Year:

Social Security Number / Tax Identification Number Government-issued identification (type and number) Residential address Primary telephone Primary email

Emergency Contact

Name Relationship Telephone

Scope of Work

Describe the services, activities or deliverables under the General Business Agreement which require the collection or processing of the personal information set forth above.

Payment Terms

Total payment amount Payment schedule Late payment fee

Term and Termination

This Appendix shall commence on and shall expire on , unless earlier terminated in accordance with the Agreement.

Notice period for termination (days)

Confidentiality and Data Protection

The receiving party shall treat personal information as Confidential Information under the Agreement and, in addition to any other obligations, shall:

(a) process and store personal information only for the purposes set forth in this Appendix; (b) implement and maintain administrative, technical and physical safeguards reasonably designed to protect personal information against unauthorized access, disclosure, alteration or destruction; (c) limit access to personal information to personnel who have a documented need to know and who are bound by confidentiality obligations at least as protective as those in this Appendix; and (d) notify the disclosing party without undue delay and in any event within seventy-two (72) hours of becoming aware of a security breach that results in unauthorized access to personal information, providing all available details and cooperating in any remedial action.

Upon expiration or termination of the Agreement, the receiving party shall, at the election of the disclosing party, promptly return or securely destroy the personal information and certify such return or destruction, except to the extent retention is required by applicable law, regulation, or bona fide archival recordkeeping.

Consent to collection and use

The individual identified in this Appendix authorizes the collection, use and disclosure of the personal information described herein by the parties for the purposes described in this Appendix and the Agreement, including personnel administration, performance of contracted services, invoicing and compliance with legal obligations.

I certify that I have provided the personal information above voluntarily and authorize its use as set forth in this Appendix.

Permitted Disclosures

Personal information may be disclosed by the receiving party only (i) to its employees, agents or subcontractors to the extent necessary to perform the Agreement and subject to equivalent confidentiality obligations; (ii) where required by law, subpoena, or government authority, provided that the receiving party gives prior notice to the disclosing party unless prohibited by law; and (iii) as otherwise expressly authorized in writing by the disclosing party.

Governing Law

This Appendix shall be governed by and construed in accordance with the laws of the state specified below without regard to its conflict of law principles.

Governing law state

Entire Agreement

This Appendix, together with the General Business Agreement, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings concerning the collection, processing and protection of personal information in connection with the Agreement. To the extent of any inconsistency between this Appendix and the General Business Agreement, the terms of this Appendix shall control with respect to personal information.

Acknowledgment and Accuracy

The undersigned certify that the personal information provided in this Appendix is complete and accurate to the best of their knowledge and agree to promptly notify the other party of any changes. The parties acknowledge that inaccuracies in key personal information may hinder performance under the Agreement.

Client Name:

By:

Date:

Service Provider Name:

By:

Date:

What a Personal Information Appendix Is and When It Applies

The Personal Information Appendix is a supplemental document attached to agreements or enrollment forms that lists and categorizes individuals' personal data used in the transaction. It identifies required data fields, applicable consent and disclosure provisions, and any restrictions on use, storage, or sharing. Organizations use the appendix to standardize data collection, ensure accurate recordkeeping, and document handling practices for compliance with U.S. laws such as ESIGN, UETA, and HIPAA when health information is present. It supports clear responsibilities and retention controls across parties.

Why including a Personal Information Appendix matters

A Personal Information Appendix reduces ambiguity about what personal data is collected, how it will be used, and who has access. It aids compliance with U.S. legal requirements, clarifies consent, and simplifies audits and records management for organizations handling personal or sensitive information.

Who typically completes and relies on this appendix

Typical users include HR teams, legal departments, vendors, and institutions that collect or process personal or regulated information during transactions.

HR and onboarding teams: collect employee identifiers, emergency contacts, and background-check authorizations.
Legal and compliance: document consent, retention requirements, and transfer or disclosure limitations.
Vendors and service providers: maintain required data fields for billing, support, and contractual obligations.

Use the appendix to reduce disputes, speed audits, and ensure consistent data handling across parties.

Essential elements to include in a professional appendix

Core components define what personal data is collected, how it is classified, permitted uses, retention schedules, security controls, and signatory responsibilities between parties.

Data Inventory

List each personal data element collected (name, DOB, SSN/TIN, contact details), who provides it, and the data's classification level to support minimal collection and downstream handling rules.

Purpose and Use

Describe specific business or legal purposes for processing each data type, including whether use is for billing, identification, benefits administration, or regulatory reporting and any permitted secondary uses.

Consent

Record the consent mechanism used, the consent text summary, whether opt-in or implied applies, and how revocation requests are handled and logged for auditability and retention.

Retention

Specify retention periods per data type, criteria for deletion or anonymization, and references to applicable legal standards or internal record schedules to support audits and legal holds.

Security Controls

Identify encryption, access control, audit trail, and handling procedures for sensitive fields; note any required Business Associate Agreement or vendor safeguards including multi-factor authentication, key management, and incident response responsibilities.

Signatures & Authority

Name authorized signers, confirm authority levels, include signature blocks for each party, and document whether electronic or notarized signatures are required for validation with cross-references to governing law or corporate resolutions.

Key security and compliance features to document

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest.

Access Controls: Role-based permissions and SSO support.

Audit Trail: Timestamped events, IP, and action history.

BAA: HIPAA Business Associate Agreement available.

Retention: Configurable retention and legal hold options.

Authentication: Multi-factor and advanced signer authentication.

Step-by-step: completing and attaching the appendix

Follow this sequence to complete and attach the Personal Information Appendix to the primary agreement correctly.

01

Prepare Appendix: Gather required personal data and supporting documents.
02

Insert Fields: List each data element and required format.
03

Review Consent: Confirm consent language and opt-in selections.
04

Attach and Sign: Attach appendix, sign, and distribute copies.

Digital workflow settings to configure for eSubmission

Configure digital workflows so the appendix fields validate input, route for signature in order, and log audit data for compliance reviews.

Field	Configuration
Full Name Field	Required, auto-capitalize
SSN/TIN Field	Masked, numeric only
Effective Date	Date picker MM/DD/YYYY
Consent Checkbox	Required with timestamp

How the appendix moves through signing and storage

This routing overview explains how the appendix travels from preparer through signers and into secure storage with an audit trail.

Upload Document: Upload appendix to signing platform.
Assign Fields: Place required fields and validation rules.
Send to Signers: Route to parties in designated order.
Store Securely: Save final PDF with audit certificate.

Platform features to check before eSigning

Choose platforms that support eSign, field validation, and secure storage compatible with organizational controls and audit logging.

Document Types: PDF, DOCX, and form templates supported.
Integrations: Salesforce, NetSuite, Microsoft 365, Google Workspace integrations.
Authentication: Email, SMS code, or advanced ID proofing.

Common penalties and compliance risks to avoid

Incorrect TIN: Triggers 24% backup withholding.

Missing Consent: Record may be invalid.

HIPAA Violation: Civil and criminal penalties possible.

Data Breach: Notification and remediation costs.

Notarization Errors: May delay enforcement or recording.

Retention Failures: Regulatory fines or audit findings.

How to update or amend the Personal Information Appendix

Follow this grid to amend the Personal Information Appendix when parties change data fields or consent terms.

01

Request Change:

Submit amendment request in writing.

02

Identify Impact:

Assess privacy, retention, and legal effects.

03

Obtain Consent:

Get signatory consent if required.

04

Document Version:

Record new version number and date.

05

Distribute Update:

Send updated appendix to all parties.

06

Archive Prior:

Retain prior versions per retention policy.

Real-world examples of appendix use

Real-world examples show how organizations use a Personal Information Appendix to streamline compliance and signing workflows.

Optica Ventures LLC

Optica Ventures used a standardized appendix to collect applicant contact and identity data during leasing, reducing manual entry and errors.

They integrated it with their CRM.
The team reported faster processing times and clearer audit trails; the appendix clarified consent and data handling for tenants, and simplified responses to records requests without changing core lease language.

Fertility Centers of Illinois

Fertility Centers standardized patient data collection with an appendix to ensure consistent authorization capture and secure handling across multiple clinics.

They emphasized mobile signing and auditability.
Clinic managers noted improved turnaround and record accuracy; the appendix supported HIPAA-compliant workflows, made patient consent easier to track, and reduced administrative follow-up required for missing authorizations during intake and treatment documentation.

eSignature vendor comparison for handling a Personal Information Appendix

Compare baseline eSignature pricing and capability differences relevant when completing a Personal Information Appendix and managing data-sensitive workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Yes	Yes	Yes	Yes
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Frequently asked questions about the Personal Information Appendix

Common questions on completing, signing, and storing a Personal Information Appendix are answered below for practical guidance and compliance clarity.

Need help? Contact support

Can the appendix be signed electronically?
Yes. Electronic signatures are generally enforceable under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted. Exceptions exist for wills, certain court filings, and some family law orders. Confirm specific exception rules before using e-signatures for those document types.
What personal fields are required?
Required fields depend on purpose but commonly include full legal name, date of birth, address, contact details, and TIN/SSN when tax or identity verification is necessary. Enter data exactly as on government ID to avoid reporting errors and backup withholding triggers.
Is notarization ever required?
Notarization is not typically required for an appendix alone, but may be necessary if the appendix supports a deed, power of attorney, or other document that statutory law requires notarization. Remote online notarization is available in most states but rules vary by jurisdiction.
How long must I keep the appendix?
Retention depends on included data and applicable laws. Follow IRS minimums (three years from filing, IRC §6501(a)), HIPAA six-year rule for PHI (45 CFR §164.530(j)), and longer industry-specific or state mandates; consult counsel when in doubt.
What happens if data is incorrect?
Incorrect personal data can lead to tax reporting errors, backup withholding, failed identity verification, or contractual disputes. Promptly correct errors through documented amendments, notify affected parties, and retain both original and corrected versions per retention policy to support audits and dispute resolution.
How can consent be revoked?
Revocations should follow the method stated in the appendix and be documented. For consumer-facing records, meet ESIGN disclosure requirements for withdrawal of consent. Record the revocation date, notify parties, and maintain records per retention rules to evidence the change.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now