6-Sample DPA - Data Protection Agreement Addendum (v4.1).pdf

9/1/2023 rev FBISD Data Protection Agreement v4.1 1

FBISD Data Protection Agreement (v4.1)

1. Definitions.

a. “Agreement” is defined in the attached agreement between the District and Contractor for software and/or software related services (“Services”) and includes the terms of the attached agreement and this Data Protection Addendum.

b. “District Data” includes all Personally Identifiable Information and other information that is not intentionally made generally available by the District on public websites or publications, including but not limited to business, administrative and financial data, intellectual property, and student and personnel data and metadata.

c. “District De-identified Data” means any de-identified, aggregated, or otherwise anonymized data derived from “District Data” from which all Personally Identifiable Information (PII) has been removed such that the identity of individual Staff, Teachers, Students, etc. cannot be determined, and re-identification of District individuals is not possible. The data de-identification procedures and samples of subsequently de-identified District Data (provided for review to ensure efficacy of the de-identification process) must be shared prior to any usage of District De-Identified Data, in any manner. Usage of District De-identified Data requires agreement to these terms in full and prior authorization after the District’s review of the de-identified data sample.

d. “End User” means the individuals authorized by the District to access and use the Services provided by the Contractor under this Agreement.

e. “Personally Identifiable Information” (or PII) includes but is not limited to: personal identifiers such as name, address, phone number, date of birth, Social Security number, and student or personnel identification number; personally identifiable information contained in student education records as that term is defined in the Family Educational Rights and Privacy Act, 20 USC 1232g, as amended (“FERPA”); “personal information” as that term is defined in the Children’s Online Privacy Protection Act of 1998 (“COPPA”); “personal information” as that term is defined in the Protection of Pupil Rights Amendment (“PPRA”); “personally identifiable information” as that term is defined in the Individuals with Disabilities Education Act, as amended (“IDEA”);

“protected health information” as that term is defined in the Health Insurance Portability and Accountability Act, 45 CFR Part 160.103 (“HIPAA”); nonpublic personal information as that term is defined in the Gramm-Leach-Bliley Financial Modernization Act of 1999, 15 USC 6809 (“GLB”); credit and debit card numbers and/or access codes and other cardholder data and sensitive authentication data as those terms are defined in the Payment Card Industry Data Security Standards (“PCI-DSS”); other financial account numbers, access codes, driver’s license numbers;

and state- or federal-identification numbers such as passport, visa or state identity card numbers.

f. “Securely Destroy” means taking actions that render data written on physical (e.g., hardcopy, microfiche, etc.) or electronic media unrecoverable by both ordinary and extraordinary means.

g. “Security Breach” means an event in which District Data is exposed to unauthorized disclosure, access, alteration, or use.

h. “Mining District Data” means to search through, access, or extract District Data, metadata, or information which is not necessary to accomplish the purpose(s) of this Agreement.

2. Rights and License in and to District Data. The Parties agree that as between them, all rights including all intellectual property rights in and to District Data shall remain the sole and exclusive property of the District, and Contractor has a limited, nonexclusive license as provided in this Agreement solely for the purpose of performing its obligations hereunder. This Agreement does not give Contractor any rights, implied or otherwise, to District Data, content, or intellectual property, except as expressly stated in the Agreement.

9/1/2023 rev FBISD Data Protection Agreement v4.1 2

3. Intellectual Property Rights/Disclosure.

a. Unless necessary to perform Contractor’s obligations under this Agreement or expressly agreed by the District in writing, all goods, products, materials, documents, reports, writings, video images, photographs or papers of any nature including software or computer images prepared by Contractor (or its subcontractors) for the District under this Agreement will not be disclosed to any other person or entity.

b. The District agrees and acknowledges that Contractor owns all rights, title and interest to any and all intellectual property associated with the software or services provided by Contractor, including but not limited to all copyright, trademark, trade name, patent, trade secret, or any other intellectual property or proprietary right, whether registered or unregistered with respect to Contractor’s software and related services. Contractor represents that it has all intellectual property rights necessary to enter into and perform its obligations in the Agreement, warrants to the District that the District will have use of any intellectual property contemplated by the Agreement free and clear of claims of any nature by any third Party including, without limitation, copyright or patent infringement claims, and agrees to indemnify the District for any related claims.

c. Notwithstanding the foregoing, for grant collaboration pursuant to subcontracts under sponsored grants, intellectual property rights will be governed by the terms of the grant or contract to the District to the extent such grant or contract requires intellectual property terms to apply to subcontractors.

4. Data Privacy.

a. Contractor will use District Data only for the purpose of fulfilling its duties under this Agreement and will not share District Data with or disclose it to any third Party without the prior written consent of the District, except as required by law.

b. District Personally Identifiable Information will not be stored outside the United States without prior written consent from the District.

c. Contractor will provide access to District Data only to its employees and subcontractors who need to access the data to fulfill Contractor’s obligations under this Agreement. Contractor will ensure that employees and subcontractors who perform work under this Agreement have read, understood, and received appropriate instruction as to how to comply with the data protection provisions of this Agreement. If Contractor will have access to “education records” for the District’s students as defined under FERPA, the Contractor acknowledges that for the purposes of this Agreement it will be designated as a “school official” with “legitimate educational interests” in the District Education records, as those terms have been defined under FERPA and its implementing regulations, and the Contractor agrees to abide by the FERPA limitations and requirements imposed on school officials.

The Parties agree that: (1) the Services/functions to be provided by Contractor are Services/functions for which the District would otherwise use its own employees; (2) Contractor is under the District’s direct control with respect to Contractor’s access to and use of the education records; and (3) Contractor is subject to the requirements of 34 C.F.R. 99.33(a) with respect to Contractor’s access to and use of the education records. Contractor will use the education records only for the purpose of fulfilling its duties under this Agreement for District’s and its End User’s benefit, and will not share such data with or disclose it to any third Party except as provided for in this Agreement, required by law, or authorized in writing by the District.

d. Except as provided in this subsection, Contractor will use District Data only for the purpose of fulfilling its duties under this Agreement.

i. Contractor may not use or sell District Data

1. to market or advertise to students, families/guardians, or District employees;

2. to inform, influence, or enable marketing, advertising, or other commercial efforts by Contractor or a third party;

3. for any commercial purpose other than fulfilling its duties under this Agreement.

9/1/2023 rev FBISD Data Protection Agreement v4.1 3

ii. Contractor may use District De-identified Data only for the purposes of development, research, and product improvement. Data shall be considered “de-identified” when PII is removed, an individual record cannot be linked back to the original record, and there is no reasonable basis to believe that the remaining information in the records can be used to identify an individual.

iii. � [Check if Applicable] Contractor requests approval to use District De-identified Data for limited marketing purposes. If approved, Contractor may utilize such data for the Limited Marketing Purpose identified below. Such data shall be aggregated with data from other districts or clients, and in no event may the de-identified/aggregated data be identified or identifiable as data from the District.

Limited Marketing Purpose:

Authorized District Approval:

e. Contractor agrees to assist District in maintaining the privacy of District Data as may be required by State and Federal law, including but not limited to FERPA, PRRA, IDEA, and COPPA.

f. Contractor is prohibited from Mining District Data for any purposes other than those agreed to by the Parties.

g. Contractor is prohibited from using the software or Services to advertise in any form (including banner ads) to District students, parents, or employees.

5. Data Security.

a. Contractor will store and process District Data in accordance with commercial best practices, including appropriate administrative, physical, and technical safeguards, to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will be no less protective than those used to secure Contractor’s own data of a similar type, and in no event less than reasonable in view of the type and nature of the data involved. Without limiting the foregoing, Contractor warrants that it will use industry-standard and up-to-date security tools and technologies such as anti-virus protections and intrusion detection methods in providing Services under this Agreement.

6. Employee and Subcontractor Qualifications.

a. Contractor shall ensure that its employees and subcontractors who have potential access to District

Data have undergone appropriate background screening, and possess all needed qualifications to comply with the terms of this agreement including but not limited to all terms relating to data and intellectual property protection.

b. If the Contractor must under this Agreement create, obtain, transmit, use, maintain, process, or dispose of the subset of District Data known as Personally Identifiable Information or financial or business data which has been identified to the Contractor as having the potential to affect the accuracy of the District’s financial statements, Contractor shall perform background checks reviewing any national criminal history record information on all employees who have potential to access such data.

7. Data Authenticity and Integrity. Contractor will take reasonable measures to protect District Data against deterioration or degradation of data quality and authenticity.

8. Security Breach.

a. Response. Immediately upon, but in no event later than 24 hours after becoming aware of a Security

Breach, or of circumstances that could have resulted in unauthorized access to or disclosure or use of District Data, Contractor will notify the District, fully investigate the incident, and cooperate fully with the District’s investigation of and response to the incident. Except as otherwise required by law or law enforcement, Contractor will not provide notice of the incident directly to individuals

9/1/2023 rev FBISD Data Protection Agreement v4.1 4 whose Personally Identifiable Information was involved, regulatory agencies, or other entities, without prior written permission from the District.

b. Liability. In addition to any other remedies available to the District under law or equity, Contractor will reimburse the District in full for all costs incurred by the District in investigation and remediation of any Security Breach caused in whole or in part by Contractor or subcontractors, including but not limited to providing notification to individuals whose Personally Identifiable Information was compromised and to regulatory agencies or other entities as required by law or contract; providing one year’s credit monitoring to the affected individuals if the Personally Identifiable Information exposed during the breach could be used to commit financial identity theft;

and the payment of legal fees, audit costs, fines, and other fees imposed against the District as a result of the Security Breach.

c. Except in the event of Contractor’s negligence, gross negligence, or willful misconduct, Contractors total liability to the District under this Section 8 shall not exceed three times the total amount paid to Contractor under the Agreement.

9. Response to Legal Orders, Demands or Requests for Data.

a. Except as otherwise expressly prohibited by law, Contractor will:

i. immediately notify the District of any subpoenas, warrants, or other legal orders, demands or requests received by Contractor seeking District Data;

ii. reasonably consult with the District regarding Contractor’s response;

iii. cooperate with the District’s reasonable requests in connection with efforts by the District to intervene and quash or modify the legal order, demand or request; and

iv. upon the District’s request, provide the District with a copy of its response.

b. If the District receives a subpoena, warrant, or other legal order, demand (including a request for information pursuant to the Texas Public Information Act), or other request seeking District Data maintained by Contractor, the District will promptly provide a copy of the request to Contractor.

Contractor will promptly supply the District with copies of records or information required for the District to respond, and will cooperate with the District’s reasonable requests in connection with the District’s response.

10. Data Transfer Upon Termination or Expiration.

a. Upon termination or expiration of this Agreement, Contractor will ensure that all District Data are securely returned or destroyed as directed by the District. Transfer to the District or a third Party designated by the District shall occur within a reasonable period of time, without significant interruption in service, and in the manner or format in which the data was provided. Contractor shall ensure that such transfer/migration uses facilities and methods that enable the District to access and use the District Data, are reasonably compatible with the relevant systems of the District or its transferee, and to the extent technologically feasible, that the District will have reasonable access to District Data during the transition. In the event that the District requests destruction of any District Data, Contractor agrees to Securely Destroy all District Data in its possession and in the possession of any subcontractors or agents to which the Contractor might have transferred District Data. The Contractor agrees to provide documentation of data destruction to the District.

b. Contractor will promptly notify the District of impending cessation of its business and any contingency plans. This includes immediate transfer of any previously escrowed assets and data and providing the District access to Contractor’s facilities as necessary to remove and destroy District-owned assets and data. Contractor shall implement its exit plan and take all necessary actions to ensure a smooth transition of service with minimal disruption to the District. Contractor will work closely with its successor to ensure a successful transition to the new equipment, with minimal downtime and effect on the District, all such work to be coordinated and performed in advance of the formal, final transition date.

9/1/2023 rev FBISD Data Protection Agreement v4.1 5

11. Audits.

a. If the Contractor must under this Agreement create, obtain, transmit, use, maintain, process, or dispose of the subset of District Data known as Personally Identifiable Information or financial or business data which has been identified to the Contractor as having the potential to affect the accuracy of the District’s financial statements, Contractor will at its expense conduct or have conducted at least annually a/an:

i. American Institute of CPAs Service Organization Controls (SOC) Type II audit, or other industry standard security audit which attests the Contractor’s security policies, procedures and controls;

ii. vulnerability scan of Contractor’s electronic systems and facilities that are used in any way to deliver Services under this Agreement; and

iii. formal penetration test of Contractor’s electronic systems and facilities that are used in any way to deliver Services under this Agreement.

b. If the Contractor at least annually does not have conducted an audit as described in (11a) the District reserves the right to perform audits of Contractor at the District’s expense to ensure compliance with the terms of this Agreement. The Contractor shall reasonably cooperate in the performance of such audits. This provision applies to all agreements under which the Contractor must create, obtain, transmit, use, maintain, process, or dispose of District Data.

c. Upon request, the Contractor will provide the District appropriate documentation of the above audits (proof) and will promptly modify its security measures as needed in order to cure any material findings uncovered as part of any audit in order to meet its obligations under this Agreement.

12. Compliance.

a. Contractor will comply with all applicable laws and industry standards in performing Services under this Agreement. Any Contractor personnel visiting the District’s facilities will comply with all applicable District policies regarding access to, use of, and conduct within such facilities. The District will provide copies of such policies to Contractor upon request.

b. Contractor warrants that any subcontractors used by Contractor to fulfill its obligations under this Agreement will be subject to and will comply with each and every term of this Data Protection Agreement in the same manner that Contractor itself is subject to the terms of this Data Protection Agreement.

c. Contractor warrants that the service it will provide to the District is fully compliant with and will enable the District to be compliant with relevant requirements of all laws, regulation, and guidance applicable to the District and/or Contractor, including but not limited to: COPPA, FERPA, PPRA, IDEA, Americans with Disabilities Act (ADA), as amended, and Federal Export Administration Regulations.

13. No End User Agreements. This Agreement is the entire agreement between the District (including District employees and other End Users) and the Contractor regarding Contractor’s access to, use of, and disclosure of District Data. In the event that the Contractor enters into terms of use agreements or other agreements or understandings, whether electronic, click-through, verbal or in writing, with District employees or other End Users, such agreements, to the extent the provisions conflict with this Agreement, shall be without effect, and the terms of this Agreement shall control.

14. Term and Termination.

a. Term. This Agreement will become effective when the Contractor accepts the Agreement. It will continue in effect until all obligations of the Parties have been met, unless terminated as provided in this Section. In addition, certain provisions and requirements of this Agreement will survive its expiration or other termination in accordance with Section 16 herein.

9/1/2023 rev FBISD Data Protection Agreement v4.1 6

b. Termination by the District. The District may immediately terminate the Agreement if the District makes the determination that the Contractor has breached a material term of this Data Protection Agreement.

c. Automatic Termination. This Agreement will automatically terminate without any further action of the Parties upon the termination or expiration of the Agreement between the Parties.

15. Survival. The Contractor’s obligations under Section 10 shall survive termination of this Agreement until all District Data has been returned or Securely Destroyed.

16. Injunctive Relief. The Parties agree that Contractor’s disclosure or use (or threat to disclose or use) any District Data in breach of this Agreement will cause immediate and irreparable harm to the District and the District shall be entitled to immediate injunctive relief against any actual or threatened violation, in addition to any of its other rights and remedies. In the event of any suit or action arising under this Agreement, Contractor consents to mandatory and exclusive jurisdiction of the courts in Fort Bend County, Texas.

FORT BEND INDEPENDENT SCHOOL DISTRICT

Applicable

By: _____________________________ _______________________ Fort Bend ISD Authorized Administrator Date

CONTRACTOR NAME: ________________________________________

Signature Date

FORT BEND INDEPENDENT SCHOOL DISTRICT

Not Applicable

Fort Bend ISD Authorized Administrator Date

CONTRACTOR NAME: _______________________________________

Signature Date