Common use of Safeguarding PII Clause in Contracts

Safeguarding PII. If Grantee or any of its Subcontractors will or may receive PII under this Agreement, Grantee shall provide for the security of such PII, in a manner and form acceptable to the State, including, without limitation, all State requirements relating to non-disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Grantee shall take full responsibility for the security of all PII in its possession or in the possession of its Subcontractors, and shall hold the State harmless for any damages or liabilities resulting from the unauthorized disclosure or loss thereof. Grantee shall be a “Third-Party Service Provider” as defined in CRS §24-73-103(1)(i) and shall maintain security procedures and practices consistent with CRS §§00-00-000 et seq. In addition, as set forth in § 00-00-000, et. seq., C.R.S., Vendor, including, but not limited to, Vendor’s employees, agents and Subcontractors, agrees not to share any PII with any third parties for the purpose of investigating for, participating in, cooperating with, or assisting with Federal immigration enforcement. If Vendor is given direct access to any State databases containing PII, Vendor shall execute, on behalf of itself and its employees, the certification PII Individual Certification Form or PII Entity Certification Form [Download form from Hyperlink] on an annual basis and Vendor’s duty shall continue as long as Vendor has direct access to any State databases containing PII. If Vendor uses any Subcontractors to perform services requiring direct access to State databases containing PII, the Vendor shall require such Subcontractors to execute and deliver the certification to the State on an annual basis, so long as the Subcontractor has access to State databases containing PII.

Safeguarding PII. If Grantee or any of its Subcontractors will or may receive PII under this Agreement, Grantee shall provide for the security of such PII, in a manner and form acceptable to the State, including, without limitation, all State requirements relating to non-non- disclosure, use of appropriate technology, security practices, computer access security, data access security, data storage encryption, data transmission encryption, security inspections, and audits. Grantee shall take full responsibility for the security of all PII in its possession or in the possession of its Subcontractors, and shall hold the State harmless for any damages or liabilities resulting from the unauthorized disclosure or loss thereof. Grantee shall be a “Third-Party Service Provider” as defined in CRS §24-73-103(1)(i) and shall maintain security procedures and practices consistent with CRS §§00-00-000 et seq. In addition, as set forth in § 00-00-000, et. seq., C.R.S., Vendor, including, but not limited to, Vendor’s employees, agents and Subcontractors, agrees not to share any PII with any third parties for the purpose of investigating for, participating in, cooperating with, or assisting with Federal immigration enforcement. If Vendor is given direct access to any State databases containing PII, Vendor shall execute, on behalf of itself and its employees, the certification PII Individual Certification Form or PII Entity Certification Form [Download form from Hyperlink] on an annual basis and Vendor’s duty shall continue as long as Vendor has direct access to any State databases containing PII. If Vendor uses any Subcontractors to perform services requiring direct access to State databases containing PII, the Vendor shall require such Subcontractors to execute and deliver the certification to the State on an annual basis, so long as the Subcontractor has access to State databases containing PII.