26QE033_ATTCH6_PRIVCHECKLIST_040726.docx

DEPARTMENT OF DEFENSE EDUCATION ACTIVITY (DODEA)

Privacy Checklist INSTRUCTIONS: DoDEA has a continuing affirmative responsibility to safeguard PII and to prevent its loss, theft or compromise. All DoDEA affiliated personnel, including support Contractors/Companies/Entities must ensure their actions do not contribute to, or result in, a compromise or breach of PII. This checklist is completed by an authorized representative of a digital resource that maintains, processes, stores, disseminates, discloses, or otherwise "handles" members of the public, i.e.

Student or Sponsors, PII on DoDEA's behalf. The authorized representative MUST carefully read/review and check each box of the Acknowledgments section and complete/sign the certification block. Please return the checklist to the DoDEA representative, i.e. Action Officer or Contracting Officer.

ACKNOWLEDGMENTS

The Contractor/Company/Entity shall comply with the Privacy Act of 1974, as amended, when creating, collecting, using, processing, storing, maintaining, disseminating, disclosing, or otherwise "handling" PII on DoDEA's behalf.

The Contractor/Company/Entity shall assist with the completion of a Privacy Impact Assessment (PIA) in coordination with the DoDEA Action Officer, DoDEA Senior Component Official for Privacy (SCOP) or designee, and the DoDEA Chief Information Officer (CIO) or designee before the digital resource maintaining PII becomes operational. A PIA is a decision-making tool used to identify and mitigate privacy risks at the beginning of and/or throughout contracUservice performance. The requirement can be completed using a DD Form 2930 (https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd2930.pdf), or for third-party applications or Websites, a DD Form 2930a (https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd2930a.pdf).

The Contractor/Company/Entity shall provide their employees with initial privacy training and annual training thereafter. This requirement applies to personnel with access to DoDEA Students or Sponsors PII and/or a DoDEA System of Records (SOR), and those who design, develop, maintain, or operate a SOR, or who otherwise create, collect, use, process, store, maintain, disseminate, disclose, or otherwise "handle" PII on DoDEA's behalf. The training must be role-based; includes foundational and role-based training; and test users' privacy knowledge. The training can be contractor driven or can be accessed from the DoDEA Privacy Page, under the training tab (https://dl.dod.cyber.mil/wp-contenUu oads/trn/online/disa pii v50 fin !_web/index.html).

The Contractor/Company/Entity shall provide Official Notice (in writing) to DoDEA and US-CERT if/when a breach or compromise of information or PII occurs. The Contractor/ Company/Entity shall develop/establish procedures for notifying and assisting affected individuals and to cooperate with DoDEA directed investigations or mitigating measures. Official Notice to DoDEA and to those affected by a data breach must be timely (within 24 hours of discovery), complete, and documented on a DD Form 2959 (https://www.esd.whs.mil/Portals/54/Documents/DD/forms/dd/dd2959.pdf).

The transfer of ownership of information to the Contractor/Company/Entity does not of itself constitute or convey any rights in the copyrighted work embodied in the information; nor, in the absence of an agreement, does constitute the transfer of ownership of a copyright. The use of DoDEA PII must be limited and agreed upon in writing. The agreement must include proper restrictions or denial on use and dissemination of PII and must include the specific purpose for which PII is collected. The Contractor/ Company/Entity shall only use, process, store, maintain, disseminate, or disclose PII for the purpose that is explained in the agreement and is compatible with the purpose for which the PII was collected, or that is otherwise legally authorized.

Federal records created by the Contractor/Company/Entity for the purpose of DoDEA related business are DoDEA records, therefore, all such records and rights therein are owned by DoDEA. The Contractor/Company/Entity shall work with the DoDEA Records Management Officer (RMO) to incorporate records management functionality or guidance in the contracUprocess for the purpose of prohibiting unauthorized creation, retention, use, disclosure, removal, sale, and destruction of Government information.

The Contractor/Company/Entity shall deliver, return, or destroy information at DoDEA's direction.

FAR Clause 52.204-23 prohibits the acquisition of hardware, software, and services developed or provided by Russia-based Kaspersky Labs and other covered entities. The Contractor/Company/Entity shall report to DoDEA any such hardware, software, or services discovered before and/or during contracUservice performance.

Sections 889(a)(1)(A) & (B) of the NOAA for Fiscal Year 2019 prohibits the acquisition of telecom or video services and equipment from China as a national security measure and to protect Government information and communication technology systems. The Contractor/Company/Entity shall not procure any equipment, systems, or services from: Huawei Technologies; ZTE Corp.; Hytera Communications; Hangzhou Hikvision; Dahua Technology; or an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country [People's Republic of China] as determined by the Secretary of Defense. The Contractor/Company/Entity shall report to DoDEA any such hardware, software, or services discovered before and/or during contracUservice performance.

CERTIFICATION

By my signature below, I acknowledge that I have read and fully understand the information contained in the Acknowledgments section of this Checklist.

Authorized Representative Legal Name

Authorized Representative Signature and Date

DoDEA PRIVACY CHECKLIST, DECEMBER 2022 image1.png image2.png image3.png image4.png image5.png image6.png image7.png image8.png