ATTACHMENT F NDA Entity

Page 1 of 4 Rev. 10/28/2021

NON-DISCLOSURE / CONFIDENTIALITY

OF SENSITIVE INFORMATION AGREEMENT

The Georgia Technology Authority (“GTA”), a public corporation and instrumentality of the State of Georgia, develops, operates, maintains, or has access to data, applications and systems that contain Sensitive Information that is vital to the services and responsibilities of state government. The safeguarding of this information from unauthorized use or disclosure is a responsibility of vital importance to GTA.

This Agreement establishes and documents the entity identified on the signature page of this Agreement who will have access to such Sensitive Information (the “Recipient”) as to the protection and safeguarding of sensitive data and/or information vital to GTA or its government customers while performing work on systems, applications, proposals, bids, contracts, projects, or research and development tasks. This Agreement is in addition to any other agreement between Recipient and GTA and is not intended to alter those agreements.

GTA has determined that in the course of Recipient’s day-to-day responsibilities, Recipient will have access to Sensitive Information or may be assigned to a sensitive project or a position of trust, and Recipient has agreed to accept and perform such responsibilities and have access to such information. Therefore, in consideration of, and as a condition of Recipient’s work on GTA and/or other Georgia government systems, applications, proposals, bids, contracts, projects, or research and development tasks, Recipient agrees as follows:

Section I. Definitions

1.1 "Sensitive Information" means any data or information received by Recipient from GTA or any of its government customers as part of the Recipient’s Project Assignment except for data or information that is subject to disclosure pursuant to laws, regulations, or Court order or process including, but not limited to, the Georgia Open Records Act.

1.2 "Nondisclosure Period" means the period beginning on the date of this Agreement and surviving the termination of the Recipient's engagement or employment with GTA, until such time that such Sensitive Information is or becomes (through no improper action or inaction by Recipient) considered to be non-sensitive information by the GTA or its government customer.

1.3 "Personal Data" means any information that is not subject to disclosure under Georgia law including, but not limited to the Georgia Open Records Act, that is related to any identified or identifiable natural or legal person, including but not limited to government employees; and any other additional data deemed as personal data under any applicable federal personal data protection laws.

Page 2 of 4 Rev. 10/28/2021

1.4 “Project Assignment” means any involvement in a government project, including but not limited to meetings, debriefings, bid and proposal preparation, contract negotiations, project performance, and project closeout.

1.5 “Project” means a government contract, order, assignment, or task that is considered confidential, sensitive, or classified or the subject of national security.

1.6 “Recipient” means the entity identified on the signature page of this Agreement, and shall include all Representatives, as defined hereunder, of the Recipient.

1.7 “Representatives” means the employees, directors, officers, members, partners, contractors, agents, or other representatives of the Recipient.

Section II. Sensitive Information

2.1 During the Nondisclosure Period, Recipient will hold in confidence all Sensitive Information that comes into Recipient's knowledge during Recipient’s Project Assignment and will not disclose, publish, or make use of such Sensitive Information, directly or indirectly, on behalf of Recipient or on behalf of any other person or entity, without the prior written consent of GTA and/or GTA’s government customer that is the custodian of the Sensitive Information.

2.2 Recipient acknowledges that during the course of its engagement or employment with GTA, Recipient shall not store, save, or transfer any government data or Sensitive Information to any personal computer equipment or storage device belonging to Recipient or to any third party not authorized to receive such Sensitive Information in writing by GTA and/or GTA’s government customer that is the custodian of the Sensitive Information.

2.3 Recipient will take all necessary steps to ensure that its Representatives adhere to the terms of this Agreement, and Recipient will be responsible for any breach of this Agreement by its Representatives.

2.4 Upon GTA’s request and, in any event, upon exiting a Project Assignment, termination of a

Project, or the termination of Recipient's engagement or employment with GTA, Recipient shall deliver to GTA all memoranda, notes, records, manuals or other documents (including, but not limited to, written instruments, voice or data recordings, or computer tapes, disks or files of any nature, whether electronic or hard copy), including all copies of such materials and all documentation prepared or produced in connection with a Project that pertain to Sensitive Information, whether made or compiled by Recipient or furnished to Recipient by virtue of its involvement in with a Project.

2.5 The restrictions stated in paragraphs 2.1, 2.2, 2.3 and 2.4 are in addition to and not in lieu of protections afforded to trade secrets and Sensitive Information under applicable federal or state law. Nothing in this Agreement is intended to or shall be interpreted as diminishing or otherwise limiting the GTA's rights under applicable law to protect state secrets, trade secrets or Sensitive Information.

Section III. Reasonable and Necessary Restrictions

3.1 Recipient acknowledges that during the course of its engagement or employment with GTA

Page 3 of 4 Rev. 10/28/2021

Recipient has received or may receive access to Sensitive Information regarding government programs that are considered confidential, sensitive, classified, and/or the subject of state or national security. Accordingly, Recipient is willing to enter into the covenants contained in this Agreement in order to provide GTA with what Recipient considers to be reasonable protection of its interests.

3.2 Recipient acknowledges that the restrictions, prohibitions and other provisions in this

Agreement are reasonable, fair, and equitable in scope, terms, and duration; are necessary to protect the legitimate business interests of GTA and those of GTA’s customers.

3.3 Recipient acknowledges that unauthorized disclosure of Sensitive Information may subject

Recipient to dismissal from the Project Assignment and other criminal and civil liability, penalties or imprisonment.

3.4 Nothing in this Agreement prohibits nor should be construed as prohibiting the Recipient from complying with applicable laws, regulations, or Court order or process including, but not limited to, the Georgia Open Records Act. However, Recipient shall immediately provide GTA with notice if Recipient receives a request for data or information received by Recipient during the course of the Project Assignment including, but not limited to, a request under the Georgia Open Records Act, a Court order, or a subpoena.

Section IV. Business Practices

4.1 By signing this Agreement Recipient agrees to abide by GTA’s Enterprise Information

Security Policies and with GTA’s internal policies regarding the protection and dissemination of Sensitive Information, whether in written, oral or electronic form.

Recipient agrees to promptly report to the appropriate GTA official, in accordance with GTA’s policies, any loss, theft, misuse, misplacement, unauthorized disclosure, or other security violation, the Recipient has knowledge of and whether Recipient is personally involved. Recipient understands that anonymity will be kept to the extent possible when reporting security violations. Recipient is expressly prohibited from:

(a) disclosing password or access information to Sensitive Information associated with a

Project with any party who does not have involvement in the Project AND a “need-to-know;”

(b) maintaining any Sensitive Information after having exited the Project or after termination of engagement or employment with GTA; or

(c) disclosing or providing Sensitive Information, whether written, oral or electronic, to any party who is not a GTA employee or contractor directly involved in the Project or the GTA government customer who is the custodian of the Sensitive Information.

4.2 Recipient understands and agrees that GTA will provide Project Sensitive Information on a need-to-know basis, in full or in part. Upon Recipient exiting a Project or termination of Recipient’s engagement with GTA, Recipient agrees to any debriefing interview that may be required by the Project manager or GTA security officer or GTA government customer security officer.

Page 4 of 4 Rev. 10/28/2021

Section V. Severability

In the event that a court of competent jurisdiction holds any provision of this Agreement invalid or unenforceable in any circumstances, the remainder of this Agreement, and the application of such provision in any other circumstances, shall not be affected thereby. In such event, the affected provision will be deemed modified to the extent necessary to render such provision enforceable, and the rights and obligations of the parties will be construed and enforced accordingly, preserving to the fullest permissible extent the intent of the parties.

Section VI. Governing Law

This Agreement, the rights and obligations of the parties hereto, and any claims or disputes relating to this Agreement, shall be governed by and construed in accordance with the laws of the State of Georgia, not including the choice-of-law rules thereof.

Section VII. Amendment; Waiver

No amendment, modification, or discharge of this Agreement shall be valid or binding unless set forth in writing and duly executed by each of the parties hereto. Any waiver by any party or consent by any party to any breach of or any variation from any provision of this Agreement shall be valid only if in writing and only in the specific instance in which it is given, and such waiver or consent shall not be construed as a waiver of any subsequent breach or any other provision or as consent with respect to any similar instance or circumstance.

IN WITNESS WHEREOF, the undersigned has executed this Agreement as of the earliest date written below.

Date: ___________________

RECIPIENT

Entity: _________________________________________________________

By: _____________________________________________________________ (Signature)

Print Name: ___________________________________________________

Title: ___________________________________________________________