RFP_26O-0924_Sample_Data_Security_and_Confidentiality_Agreement_.docx

[Sample Agreement Only] This is a sample agreement only used for informational purposes.

Sample Agreement is NOT part of Mohave’s solicitation.

DATA SECURITY AND CONFIDENTIALITY AGREEMENT

This DATA SECURITY AND CONFIDENTIALITY AGREEMENT (“Data Agreement”) dated [Date of Agreement], by and between [Educational Institution Issuing Agreement] (the “Educational Institution”) and VENDOR (the “Service Provider”).

RECITALS

A. In providing services to the Educational Institution, Service Provider may have access to confidential records, data, and information concerning students and employees of the Educational Institution.

B. Service Provider agrees to the provisions of this Data Agreement and to the requirements of state and federal law with respect to the receipt, review, storage, and transmission of information received from the Educational Institution.

C. This Data Agreement shall be in addition to any underlying agreement for goods and services entered into between the parties.

NOW THEREFORE, THE PARTIES HEREBY AGREE AS FOLLOWS:

1. Covered Data and Information. All records, information, and data of the Educational Institution to which Service Provider has access are hereafter referred to as “CDI”. CDI includes, but is not limited to, all paper and electronic student education records, information, and data supplied by the Educational Institution, as well as any such records, information and data provided by students of the Educational Institution, all personally identifiable records, information and data concerning students and employees of the Educational Institution, and all personally identifiable information and other non-public information supplied, including but not limited to student data, employee data, and user content.

2. Limited Use of De-identified, aggregate or anonymized CDI. Except as prohibited in Section 5 of this Agreement, the Educational Institution permits the Service Provider to use de-identified, aggregate, or anonymized CDI solely for the purpose of internal research and development to improve the specific services offered by the Service Provider under this Agreement. Service Provider may not transfer any de-identified, aggregate, or anonymized CDI to a third party without the express written consent of the Educational Institution.

3. Compliance with all Applicable Laws and Data Security. Service Provider unconditionally agrees to comply with the requirements of The Family Educational Rights and Privacy Act (FERPA), the Individuals with Disabilities Education Act (IDEA) confidentiality regulations, Children’s Online Privacy Protection Act (COPPA), Protection of Pupil Rights Amendment (PPRA), A.R.S. § 15-117, A.R.S. § 15-141, A.R.S. § 15-142, A.R.S. § 18-551, A.R.S. § 18-552, and any other federal or state law governing cybersecurity, privacy, and the protection of CDI. Service Provider shall not process, store, or maintain CDI outside of the United States without prior written consent from the Educational Institution.

4. Access to CDI. Service Provider hereby acknowledges that it may have access to CDI and that such shall be subject to the terms and conditions of this Data Agreement. Service Provider will only collect CDI as necessary to fulfill its duties as agreed to in any underlying agreement for goods or services.

5. Use of CDI. Service Provider will use CDI only for the purpose of fulfilling its duties and providing services as agreed to in any underlying agreement for goods or services.

6. Data Mining. Service Provider is strictly prohibited from mining, scanning, or using CDI, Educational Institution data, or student data for advertising, marketing, or training artificial intelligence or machine learning models. Service Provider shall not store, process, or maintain any such data outside of the United States without the Educational Institution’s prior written authorization.

7. Confidentiality of CDI. Service Provider agrees to hold CDI in strict confidence. Service Provider shall not use or disclose CDI received from or on behalf of the Educational Institution except as permitted or required by this Data Agreement, as required by law, or as otherwise authorized in writing by the Educational Institution. Service Provider agrees that it will protect CDI it receives from or on behalf of the Educational Institution according to commercially acceptable standards and no less rigorously than it protects its own confidential information. Service Provider shall restrict internal access to CDI to only those employees, contractors, and agents who require such access to perform their official duties under this Agreement, utilizing strictly enforced role-based access controls.

8. Data De-Identification. Service Provider may have permission via any underlying agreement to provide goods or services to use de-identified CDI for purposes as identified in the agreement. De-identified CDI will have all direct and indirect personal identifiers removed. This includes, but is not limited to, name, identification numbers, date of birth, demographic information, location information, and school identification numbers. Service Provider agrees not to attempt to re-identify any de-identified CDI and agrees not to transfer de-identified CDI to any party without the Educational Institution’s express written consent as required by Section 2. Any receiving party shall agree in writing not to attempt re-identification and shall agree to be bound by the terms of this Data Agreement.

9. Reporting Student CDI. Service Provider may at times have reason to report CDI of Educational Institution students to third parties as provided by express written permission from the Educational Institution or as required by law. In reporting aggregated, de-identified data containing CDI, Service Provider shall:

a. Not disclose data about categories of 10 or fewer students;

b. Not report a total count of students;

c. Not report percentages of 0% or 100%; and

d. Report data in ranges rather than specific numbers.

10. Return or Destruction of CDI. Within thirty (30) days following termination, cancellation, expiration, or other conclusion of the work or services provided to the Educational Institution by Service Provider, Service Provider shall return all CDI to the Educational Institution. If the return of CDI is not feasible, Service Provider shall destroy any and all CDI and represent in writing to the Educational Institution that it has destroyed all CDI and no longer has any CDI in its possession or control. Service Provider shall ensure that all CDI it is in possession of or in the possession of any subcontractors or agents is destroyed or returned to the Educational Institution when no longer needed for the specified purposes as authorized by the Educational Institution.

11. Security of Electronic Information. Service Provider shall develop, implement, maintain, and use appropriate administrative, technical, and physical security measures and technical safeguards to preserve the confidentiality, integrity, and availability of all electronically maintained or transmitted CDI received from or on behalf of the Educational Institution or its students or employees. Service Provider shall store and process CDI in accordance with industry best practices to secure CDI from unauthorized access, disclosure, and use. These security measures and technical safeguards shall be extended by express written agreement to all subcontractors and third parties used by Service Provider. Service Provider shall at a minimum:

a. Protect and maintain the confidentiality of passwords used to access CDI;

b. Notify the Educational Institution when Service Provider’s access to CDI is no longer necessary;

c. Notify the Educational Institution within 24 hours of discovery if passwords used to access CDI by Service Provider, a subcontractor, or other third party are lost, stolen, or otherwise obtained or potentially obtained by unauthorized users;

d. Encrypt all CDI at rest using AES-256 or an equivalent or stronger encryption standard and encrypt all CDI in transit using TLS 1.2 or higher;

e. Deploy advanced endpoint detection and response tools on all servers and workstations that access or store CDI;

f. Require multi-factor authentication (MFA) for all administrative accounts and any user account with access to CDI.

Service Provider will conduct periodic risk assessments and remediate any identified security risks in a timely manner.

12. Reporting of Disclosure or Misuse of CDI. Service Provider shall, within 24 hours of discovery, report to the Educational Institution any and all use or disclosure of CDI not authorized by this Data Agreement or authorized in writing by the Educational Institution. Service Provider’s report shall identify:

a. The nature of the unauthorized use or disclosure;

b. The CDI used or disclosed;

c. The identity of the person or entity who made the unauthorized use or received the unauthorized disclosure;

d. What Service Provider has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

e. What corrective action Service Provider has taken or shall take to prevent further similar unauthorized use or disclosure.

Service Provider shall provide such other information, including a written report, as reasonably requested by the Educational Institution. Service Provider shall have a plan for responding to a breach of data security developed pursuant to best practices in the industry and shall share that plan with the Educational Institution upon request.

13. Educational Institution Access. Service Provider shall, upon request provide security documentation, including but not limited to SOC 2 reports, independent security assessments, penetration test summaries, or other documentation demonstrating compliance with this Agreement, subject to reasonable confidentiality protections.

14. Rights to Intellectual Property. This Data Agreement does not give Service Provider any rights, implied or otherwise, to CDI, data, content, or intellectual property except as expressly stated in any underlying agreement between the parties. This includes but is not limited to the right to share, sell, or trade CDI. The Educational Institution acknowledges that this agreement does not convey any intellectual property right in any of Service Provider’s materials or content, including any revisions of derivative work or material. Service Provider-owned materials shall remain the property of the Service Provider. All rights, including copyright, trade secrets, patent, pre-existing materials, and intellectual property rights shall remain the sole property of the Service Provider. CDI is and remains the property of the Educational Institution.

15. Indemnity. Service Provider shall defend, indemnify, and hold harmless the Educational Institution, its Board Members, officers, agents, and employees, from and against any and all claims, liabilities, demands, actions, losses, damages, and expenses including the Educational Institution’s costs and reasonable attorneys’ fees, which arise as a result of Service Provider’s failure to meet any of its obligations under this Data Agreement. Service Provider shall also comply with all applicable breach notification requirements and shall be responsible for all reasonable costs associated with a security incident or breach resulting from Service Provider's acts or omissions, including investigation, containment, notification, credit monitoring when required by law or directed by the Educational Institution, and other remediation costs, to the extent permitted by applicable law and this Agreement. Notwithstanding anything in this Agreement or any underlying agreement to the contrary, Service Provider's obligations relating to a security incident, data breach, unauthorized access to CDI, confidentiality breach, privacy violation, or indemnification under this section shall not be subject to any limitation of liability, exclusion of damages, or liability cap contained in this Agreement or any underlying agreement.

16. Remedies. If the Educational Institution determines in good faith that Service Provider has materially breached any of its obligations under this Data Agreement, the Educational Institution shall have the right to require Service Provider to submit to a plan of monitoring and reporting; to provide Service Provider with a fifteen (15)-day period to cure the breach; or to terminate the work or services of Service Provider for the Educational Institution immediately. Prior to exercising any of these options, the Educational Institution shall provide written notice to Service Provider describing the violation and the action the Educational Institution intends to take. The remedies described herein may be exercised by the Educational Institution in its sole discretion and are in addition to any remedies permitted by law or pursuant to any other agreement between the parties.

17. Subcontractors. Service Provider shall require that any subcontractor, agent, or cloud service provider receiving CDI be authorized by the Educational Institution and expressly agree in writing to comply with all terms of this Data Agreement. Service Provider shall ensure such third parties maintain administrative, technical, and physical safeguards that meet or exceed the security requirements of this Agreement. Service Provider remains fully responsible for the acts and omissions of its subcontractors, agents, and cloud service providers.

18. Modifications. Service Provider will not modify or change how CDI is collected, used, or shared under the terms of this Data Agreement in any way without advance notice to and consent from the Educational Institution.

19. Arizona Law. This Data Agreement is made in the State of Arizona and shall be interpreted by the laws of the State of Arizona. Any dispute arising out of or relating to this Data Agreement shall be brought in the Superior Court of the county in which the Educational Institution is located or the United States District Court, District of Arizona.

20. Cancellation. The Educational Institution reserves all rights that it may have to cancel this Data Agreement for possible conflicts of interest under A.R.S. § 38-511, as amended.

21. No Israel Boycott. The Parties agree that they are not currently engaged in, and agree that for the duration of this Agreement they will not engage in a boycott of Israel, as that term is defined in A.R.S.

§ 35-393.

22. Arbitration. To the extent permitted by A.R.S. §§ 1518 and 12-133, the parties agree to resolve any dispute arising out of this Agreement by arbitration.

23. Amendments. All references to provisions of statutes, codes, and regulations include any and all amendments thereto.

24. Mandatory Terms. This Agreement incorporates by reference all mandatory contract provisions of state agencies required by statute or executive order.

25. Miscellaneous. The provisions of this Data Agreement shall survive the termination, cancellation or completion of all work, services, performance or obligations by Service Provider to the Educational Institution. This Data Agreement shall be binding upon the parties hereto, their officers, employees and agents. Time is of the essence of this Data Agreement. Except as expressly modified by the provisions of this Data Agreement, any underlying agreement for goods or services shall continue in full force and effect. In the event any inconsistencies exist between the terms of this Data Agreement and any underlying agreement, this Data Agreement shall control.

IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be duly executed by its authorized parties on its behalf.

[Educational Institution Issuing Agreement] VENDOR

Signature: Signature: Printed Name: Printed Name: Title: Title: Date: Date:

Sample Agreement 26O-0924