Privacy Act Compliance Form

PRIVACY ACT COMPLIANCE FORM

This Privacy Act Compliance Form is executed by the parties listed below to record and confirm obligations for the protection, use, disclosure, retention and disposition of personally identifiable information. Agency Name:    Entity Type: Individual Corporation Government Other

Recipient Name:    Entity Type: Individual Corporation Government Other

Effective Date:

RECITALS

WHEREAS, the Agency maintains records that contain personally identifiable information and must ensure that collection, maintenance, use and dissemination of such records comply with applicable privacy obligations; and

WHEREAS, the Recipient will receive, access, or process certain records or data on behalf of the Agency and is required to adhere to standards for safeguarding, access, amendment, retention and disposal of those records; and

WHEREAS, the parties desire to set forth the compliance obligations, reporting requirements, and remedies applicable to the Recipient's handling of personally identifiable information.

NOW THEREFORE

In consideration of the mutual covenants set forth in this Privacy Act Compliance Form, the parties agree as follows:

1. DEFINITIONS

For purposes of this Form, the following terms have the meanings set forth below: "Personally Identifiable Information" or "PII" means any information that permits the identity of an individual to be reasonably inferred, whether maintained in paper, electronic or other media. "Use" and "Disclosure" mean any access, transmission, release or other communication of PII to any person or system.

2. PURPOSE AND SCOPE

The Recipient shall access or receive only such PII as is necessary for the Recipient's authorized performance under the relationship with the Agency and only for the specific administrative or operational purpose described below. Records covered by this Form:

3. COMPLIANCE REQUIREMENTS

(a) Authorized Use and Disclosure. Recipient shall use or disclose PII only to carry out the authorized purpose and only to personnel who have a need to know. Recipient shall not use PII to engage in any activity that would constitute an unauthorized disclosure under applicable privacy law.

(b) Safeguards. Recipient shall implement and maintain administrative, physical and technical safeguards reasonably designed to protect PII from unauthorized access, alteration, destruction or disclosure. Describe the security measures to be employed:

(c) Access Controls. Recipient shall restrict access to PII to authorized personnel and shall maintain logs or other records sufficient to demonstrate compliance with access limitations.

(d) Retention and Disposal. Recipient shall retain PII only for the period necessary to accomplish the authorized purpose and shall dispose of PII in a secure manner when no longer required. Retention period:

4. ACCESS, AMENDMENT AND ACCOUNTING

Recipient shall assist the Agency in responding to any individual requests for access, correction or amendment of PII, and shall promptly notify the Agency upon receipt of any such request or any administrative or judicial demand for disclosure of PII.

5. BREACH NOTIFICATION

In the event of an actual or suspected unauthorized access, disclosure, loss or breach of PII, Recipient shall notify the Agency without unreasonable delay and in no event later than after discovery, and shall cooperate in mitigation, investigation and notice to affected individuals if required.

6. TRAINING AND PERSONNEL

Recipient shall ensure that all personnel with access to PII receive initial and periodic training on privacy obligations and safeguards. Recipient attests that training will be provided: Yes No

7. AUDITS AND INSPECTIONS

The Agency reserves the right to inspect, audit or otherwise review Recipient's compliance with this Form. Recipient shall make relevant records, systems and personnel available for review upon reasonable notice. Audit notice period:

8. REMEDIES, LIABILITY AND INDEMNIFICATION

Recipient acknowledges that violation of this Form may cause irreparable harm for which monetary damages may be inadequate. The Agency is entitled to equitable relief, including injunctive relief and specific performance, in addition to any other remedies available at law or in equity.

Recipient shall indemnify and hold harmless the Agency from and against any third-party claims, losses or liabilities arising from Recipient's unauthorized use or disclosure of PII, except to the extent such claim arises solely from the Agency's gross negligence or willful misconduct.

Liquidated damages (if applicable):

9. CONFIDENTIALITY

Recipient shall treat PII and nonpublic records as Confidential Information. Recipient shall not disclose Confidential Information to any third party except as expressly authorized in writing by the Agency or as required by law, and then only after providing notice to the Agency to the extent legally permissible.

10. NOTICES

Agency Notice Contact

Recipient Notice Contact

11. AMENDMENTS; WAIVER; COUNTERPARTS

This Form may be amended only by a written instrument signed by authorized representatives of both parties. No failure or delay by either party in exercising any right shall operate as a waiver of that right. This Form may be executed in counterparts, each of which shall be an original and all of which together shall constitute one instrument.

12. GOVERNING LAW; ENTIRE AGREEMENT; SEVERABILITY

This Form shall be governed by and construed in accordance with the laws of without regard to conflict of law principles. This Form constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior communications and understandings. If any provision of this Form is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

CERTIFICATION

Each party certifies that the individual signing below is authorized to bind the respective party, that the party has read and understands its obligations under this Form, and that the party will comply with the requirements herein.

Sign Now