PIIAA Compliance Form

PIIAA Compliance Form

Parties and Effective Date

This PIIAA Compliance Form (the "Agreement") is entered into as of Effective Date: by and between Client Name: , Client Address: and Service Provider Name: , Provider Address: .

WHEREAS, Client collects, stores or otherwise maintains personally identifiable information as defined herein ("PII") that requires administrative, technical and physical safeguards; and

WHEREAS, Service Provider will access or process PII on behalf of Client in connection with services described below and agrees to comply with the obligations set forth in this Agreement; and

WHEREAS, the parties desire to set forth the scope, security, and accountability measures applicable to Service Provider's handling of PII and to memorialize payment, term, audit and remedy provisions in relation to such activities.

Scope of Work

Types of PII and Access

Categories of PII to be accessed, processed, or stored (check all that apply and specify if Other):

Identifiers (name, SSN, national ID)
Contact information (email, phone, address)
Financial account information
Health or medical information
Other:

Compliance Obligations and Security Measures

Service Provider shall implement and maintain administrative, technical and physical safeguards appropriate to the risk, including but not limited to those specified below. The measures shall be documented and made available for review under the Audit Rights section.

Encryption of PII at rest and in transit
Role-based access controls and least-privilege principles
Audit logging and retention of access records
Multi-factor authentication for privileged accounts
Regular vulnerability scanning and patch management
Other specific measures:

Payment Terms

Term and Termination

Term Start Date:    Term End Date / Review Date:

Termination for Cause: Either party may terminate immediately upon written notice if the other party materially breaches its obligations related to PII handling, fails to remediate after a cure period of days, or experiences a security incident that materially compromises PII.

Breach Notification and Remediation

Service Provider shall notify Client of any confirmed or reasonably suspected data breach affecting PII without undue delay and in no event later than hours after discovery. Notification shall include a description of the incident, scope of PII affected, remediation steps, and recommended mitigations. Service Provider shall cooperate fully with Client in breach response, regulatory filings and notification to affected individuals where required.

Audit Rights and Recordkeeping

Client may, at reasonable intervals and upon days' prior notice, audit Service Provider's practices, procedures and records relating to PII to confirm compliance. Service Provider shall maintain records sufficient to demonstrate compliance for a period of years.

Confidentiality

Each party shall hold in strict confidence all PII and Confidential Information received from the other party and shall not disclose, use or permit access except as necessary to perform under this Agreement. Confidential Information excludes information independently developed by the receiving party, lawfully obtained from third parties without restriction, or required to be disclosed by law or court order provided that the receiving party gives prompt notice to allow the disclosing party to seek protective measures.

Indemnification

Service Provider shall indemnify, defend and hold Client harmless from and against any third-party claims, damages, losses and expenses arising from Service Provider's negligent or willful breach of this Agreement, including failures in data security or unauthorized disclosure of PII, except to the extent caused by Client's negligent acts or omissions.

Governing Law and Entire Agreement

This Agreement shall be governed by and construed in accordance with the laws chosen by the parties: Governing Jurisdiction: . This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements and understandings, whether written or oral.

Acknowledgments and Certifications

The undersigned certify that they have the authority to bind their respective organizations, have read and understand the obligations set forth in this Agreement, and will ensure that personnel and subcontractors comply with the terms herein.

Sign Now