Common use of Data Handling Clause in Contracts

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS, Contractor may provide customer service operations in the performance of this Agreement for any Contractor facility. B. Except as stated above Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to and in possession of the Contractor, Contractor shall guarantee maintain the confidentiality of all State Records provided by the State to Contractor Records, and will not actively process such data anymoreexcept as required by the Agreement. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data.Contractor i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract. All audits shall be subject to any reasonable conditions and restrictions Contractor may impose to protect the confidentiality, availability, and integrity of its data and systems, shall be conducted at the State’s sole expense, and shall be conducted during Contractor’s regular business hours after reasonable advance written notice to Contractor with minimal disruption to Contractor’s business. Audits shall be limited to once each year unless the State has credible evidence that a violation of this Agreement has occurred. E. If Contractor processes, handles, or transmits information provided to a state agency by the Social Security Administration (SSA) or has authority to perform on the state agency’s behalf, the state agency should clearly state the specific roles and functions of the Contractor within the agreement. Any Order placed with the Contractor must contain non-disclosure language as it pertains to SSA-provided information.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. i. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. Notwithstanding the above, the Contractor is permitted to provide remote technical support, and general Order administration. The Contractor may provide technical user support on a 24/7 basis using a follow the sun model. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State datadata maintained by Contractor in the ordinary course of business. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format.transformation ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract. All audits shall be subject to any reasonable conditions and restrictions Contractor may impose to protect the confidentiality, availability, and integrity of its data and systems, shall be conducted at the State’s sole expense, and shall be conducted during Contractor’s regular business hours after reasonable advance written notice to Contractor with minimal disruption to Contractor’s business. Audits shall be limited to once each year unless the State has credible evidence that a violation of this Agreement has occurred. E. If Contractor processes, handles, or transmits information provided to a state agency by the Social Security Administration (SSA) or has authority to perform on the state agency’s behalf, the state agency should clearly state the specific roles and functions of the Contractor within the agreement. Any Order placed with the Contractor must contain non-disclosure language as it pertains to SSA- provided information.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract. E. If Contractor processes, handles, or transmits information provided to a state agency by the Social Security Administration (SSA) or has authority to perform on the state agency’s behalf, the state agency should clearly state the specific roles and functions of the Contractor within the agreement. Any Order placed with the Contractor must contain non-disclosure language as it pertains to SSA-provided information.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon expiration of a lease or rental Order, Contractor will provide the State with a disk removal service whereby a Contractor’s service technician will remove the device’s hard disk drive from the Xerox–branded copier for an additional flat fee charge and leave the disk with the State before the device is removed from the State’s premises. If Contractor’s Services include data processing, upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The If Contractor’s Services include data processing, the State retains the right to use the established operational services to access and retrieve relevant State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its relevant data processing facilities information for an audit of the measures referred to in this Exhibit in accordance with the terms of this ContractParticipating Addendum. E. If Contractor processes, handles, or transmits information provided to a state agency by the Social Security Administration (SSA) or has authority to perform on the state agency’s behalf, the state agency should clearly state the specific roles and functions of the Contractor within the agreement. Any Order placed with the Contractor must contain non-disclosure language as it pertains to SSA-provided information.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data State Records anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. . The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.of

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor in accordance with the provisions of this Exhibit and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. . The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Except for as needed for support services, Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records where, and to the extent, stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract. The State shall provide Contractor with additional information as to the operational services process prior to the audit.

Data Handling. A. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data.shall i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract. E. If Contractor processes, handles, or transmits information provided to a state agency by the Social Security Administration (SSA) or has authority to perform on the state agency’s behalf, the state agency should clearly state the specific roles and functions of the Contractor within the agreement. Any Order placed with the Contractor must contain non-disclosure language as it pertains to SSA-provided information.

Data Handling. A. F. Contractor may not maintain or forward these State Records to or from any other facility or location, except for the authorized and approved purposes of backup and disaster recovery purposes, without the prior written consent of the State. Contractor may not maintain State Records in any data center or other storage location outside the United States for any purpose without the prior express written consent of OIS. B. G. Contractor shall not allow remote access to State Records from outside the United States, including access by Contractor’s employees or agents, without the prior express written consent of OIS. Contractor shall communicate any request regarding non-U.S. access to State Records to the Security and Compliance Representative for the State. The State shall have sole discretion to grant or deny any such request. C. H. Upon request by the State made any time prior to 60 days following the termination of this Contract for any reason, whether or not the Contract is expiring or terminating, Contractor shall make available to the State a complete download file of all State data. i. This download file shall be made available to the State within 10 Business Days of the State’s request, shall be encrypted and appropriately authenticated, and shall contain, without limitation, all State Records, Work Product, and system schema and transformation definitions, or delimited text files with documents, detailed schema definitions along with attachments in its native format. ii. Upon the termination of Contractor’s provision of data processing services, Contractor shall, as directed by the State, return all State Records provided by the State to Contractor, and the copies thereof, to the State or destroy all such State Records and certify to the State that it has done so. If any legal obligation imposed upon Contractor prevents it from returning or destroying all or part of the State Records provided by the State to Contractor, Contractor shall guarantee the confidentiality of all State Records provided by the State to Contractor and will not actively process such data anymore. Contractor shall not interrupt or obstruct the State’s ability to access and retrieve State Records stored by Contractor. D. I. The State retains the right to use the established operational services to access and retrieve State Records stored on Contractor’s infrastructure at its sole discretion and at any time. Upon request of the State or of the supervisory authority, Contractor shall submit its data processing facilities for an audit of the measures referred to in this Exhibit in accordance with the terms of this Contract.