RFP27007086 Attachment 6 IT Compliance Requirements DPISA.pdf

URI DATA PRIVACY AND INFORMATION SECURITY ADDENDUM

This DATA PRIVACY AND INFORMATION SECURITY ADDENDUM (“ADDENDUM”) is entered into as of the Effective Date of the Agreement (defined below) by and between the University of Rhode Island (“URI”) and [Vendor Name] (“Vendor”) (each a “Party,” and collectively the “Parties”).

RECITALS

A. URI holds Personal Information and/or Sensitive Personal Information, that may be subject to state and federal Laws relating to the protection of such information as defined herein.

B. Vendor may have access to Personal Information in connection with Vendor’s provision of [Description of Services] to URI (“Services”) pursuant to the [Agreement Name] dated [Agreement Date] (the “Agreement”) and any amendments thereto.

C. URI and Vendor agree that to the extent Vendor accesses and/or receives Personal Information in its performance of the Services, it shall, to the extent applicable, maintain, store, access, use and disclose Personal Information only as necessary to perform the Services and as described in this Addendum.

D. The following terms and conditions shall apply with regard to Personal Information as defined in this

Addendum. To the extent any capitalized terms are not defined in this Addendum, such shall have the same definition as have been provided in the preceding Agreement or in accordance with applicable Laws. The obligations of Vendor under this Addendum shall be deemed to apply to and to bind Vendor’s representatives or affiliates to the extent such representative or affiliate receives or has access to any Personal Information; provided, however, that Vendor shall remain solely liable for any noncompliance with the terms of this Addendum caused by its representatives or affiliates.

In consideration of the Recitals and the mutual agreements that follow, the Parties agree as follows:

1. Defined Terms

a) “Authorized Employees” means Vendor employees who have a need to know or otherwise access and/or receive Personal Information to enable Vendor to perform its obligations under the Agreement.

b) “Authorized Persons” means (i) Authorized Employees; and (ii) Vendor contractors, third parties, supply chain entities, agents, outsourcers and auditors who have a need to know or otherwise access and/or receive Personal Information to enable Vendor to perform its obligations under the Agreement, and who are bound in writing through a contractual agreement to abide by requirements that are the same or similar to the terms and conditions of this Addendum.

c) “Laws” means any foreign, federal, state, provincial, or local statute, law, ordinance, regulation, rule, guidance having the force of law, or governmental requirement, as enacted, amended, supplemented, replaced, or otherwise in effect from time to time during the term, that is applicable to Personal Information accessed, processed, stored, transmitted, disclosed, or received by Vendor on behalf of URI.

Such Laws include, without limitation, the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g and its implementing regulations at 34 C.F.R. Part 99; the Massachusetts data security regulations, 201 CMR 17.00; the Rhode Island Identity Theft Protection Act, R.I. Gen. Laws § 11-49.3-1 et seq.; Connecticut General Statutes § 36a-701b; California Civil Code § 1798.81.5; Oregon Revised Statutes § 646A.600 et seq.; the New York SHIELD Act; the California Consumer Privacy Act, as amended ("CCPA"), and its implementing regulations; the Connecticut Personal Data Privacy and Online Monitoring Act ("CTDPA"); the Colorado Privacy Act; the Delaware Personal Data Privacy Act; the Indiana Consumer Data Privacy Act; the Iowa Consumer Data Privacy Act; the Montana Consumer Data Privacy Act; the Oregon Consumer Privacy Act; the Tennessee Information Protection Act; the Texas Data Privacy and Security Act; the Utah Consumer Privacy Act; the Virginia Consumer Data Protection

Act; the General Data Protection Regulation (EU) 2016/679 ("GDPR"); laws regulating the development and use of AI systems and technologies; and any successor, replacement, analogous, or substantially similar privacy, data protection, cybersecurity, breach notification, or education records laws and regulations. Any reference in this Addendum to Laws shall mean such Laws as amended and in effect from time to time.

d) “Personal Information” means any Personal Information owned, licensed, received, collected, stored, maintained or processed by URI, or to which URI otherwise has access and that may be defined as “Personal Information” or “personal data” under applicable Laws that is disclosed to and/or accessed by Vendor. References to “Personal Information” herein shall include Sensitive Personal Information.

Without limiting the foregoing, Personal Information shall mean the following categories of non-public information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household that the business collects and/or processes:

i. Identifiers (e.g. a name, alias, postal address, unique personal identifier, online identifier, Internet

Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers);

ii. Personal information (e.g. a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information);

iii. Protected classification characteristics (e.g. age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information);

iv. Commercial information (e.g. records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies);

v. Biometric information (e.g. genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data);

vi. Internet or other similar network activity (e.g. browsing history, search history, information on a consumer's interaction with a website, application, or advertisement);

vii. Geolocation data (e.g. physical location or movements);

viii. Sensory data (e.g. audio, electronic, visual, thermal, olfactory or similar information);

ix. Professional or employment-related information (e.g. current or past job history or performance evaluations);

x. Education information (e.g. education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records); and/or,

xi. Inferences drawn from other personal information (e.g. profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes).

e) “Security Breach” means (i) any act or omission that compromises either the security, or confidentiality of Personal Information and/or the unauthorized access, use or disclosure of Personal Information caused by Vendor’s and/or its agents or subcontractors acts or omissions, or (ii) receipt of any notification or report in relation to the privacy and/or security practices of Vendor and/or its contractors or a breach or alleged breach of the Agreement relating to such privacy and/or security practices.

f) “Sensitive Personal Information” means Social Security, driver’s license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, or union membership; contents of mail, email, and text messages; genetic data; biometric information; health and medical information, including information collected and analyzed during an individual’s health care; personal information collected and analyzed concerning an individual’s sex life or sexual orientation.

2. Obligations of Vendor to Protect and Secure Personal Information

a) Vendor acknowledges and agrees that, in the course of providing Services to URI, Vendor may receive or have access to Personal Information, and Vendor shall comply with the terms and conditions set forth herein in its access, collection, receipt, transmission, disclosure, storage, disposal, use and discussions of such Personal Information and be responsible for a Security Breach of Personal Information by Authorized Employees and Authorized Persons. Vendor shall be responsible for, and remain liable to, URI for all actions and omissions of all Authorized Employees and Authorized Persons concerning the protection and security of Personal Information as if they were Vendor’s own actions and omissions.

Vendor shall ensure that it has written contracts in place with all Authorized Persons that may have access to Personal Information which contains access restrictions and use restrictions substantially similar to such access restrictions and use restrictions contained herein.

b) In recognition of the foregoing, Vendor agrees and covenants that it shall: (i) keep and maintain all Personal Information in strict confidence, using such degree of care as is appropriate to avoid unauthorized access, use or disclosure; (ii) access, use and disclose Personal Information solely and exclusively for the purposes for which the Personal Information, or access to it, is provided pursuant to the terms and conditions of the Agreement; (iii) not use, sell, rent, transfer, distribute, or otherwise disclose or make available Personal Information for Vendor’s own purposes or for the benefit of anyone other than URI, in each case, without URI’s prior written consent; and (iv) not directly or indirectly, disclose Personal Information to any person other than its Authorized Employees and Authorized Persons without express written consent from URI unless and only to the extent required by government authorities or law enforcement as required by applicable law, in which case Vendor shall use its best efforts to notify URI before such disclosure, if permitted by applicable law, or as soon after as reasonably possible.

c) Vendor represents and warrants that its collection, access, use, storage, disposal, and disclosure of Personal Information does and will comply with all applicable Laws during the term of the Agreement.

d) Vendor shall implement appropriate administrative, physical and technical safeguards to protect Personal

Information and to prevent unauthorized access, use, or disclosure of Personal Information, including reasonable efforts to: (i) limit access of Personal Information to Authorized Employees/Authorized Persons only if such access is required in order to perform services to URI; (ii) as applicable, secure its facilities, data centers, paper files, servers, back-up systems and computing equipment including mobile devices with storage capability; (iii) implement network, device application, database and platform security; (iv) secure information in transmission, storage and disposal; (v) implement multi-factor authentication and access controls within media, applications, operating systems; (vi) encrypt Personal Information stored on any mobile media; (vii) as applicable, segregate Personal Information stored in Vendors’ systems from information of Vendor or its other customers so that Personal Information of URI is not commingled with any other types of information; (ix) implement appropriate personnel security and integrity procedures and practices including conducting background checks and insider threat monitoring;

and (x) provide appropriate privacy and information security training to Vendor’s employees.

e) Vendor agrees to report, promptly and in writing, to URI any use, access, acquisition, or disclosure of Personal Information not provided for by the Agreement, as requested by URI, or as required by Law, and of which Vendor knows or has reason to know.

f) Vendor may subcontract any portion of the Services, provided that Vendor ensures that there is a written agreement in place with each subcontractor requiring the subcontractor to agree to the same restrictions and conditions that apply to Vendor with respect to the protection of Personal Information through this Addendum through a written contractual agreement.

g) Vendor shall not, directly or indirectly, divulge, disclose or communicate any Personal Information it receives from URI to any person, firm, or corporation, except with the written permission of URI, provided however, Vendor may disclose such information to its subcontractors as described herein and any and all Authorized Persons.

h) All records pertaining to Personal Information received from URI, whether developed by URI or others, are and shall remain the property of URI.

i) Vendor agrees that URI’s Personal Information may not be maintained, stored, or transmitted outside of the United States of America except to its wholly owned subsidiaries.

j) Vendor shall maintain or adopt a written information security program (“WISP”) or its equivalent consistent with applicable Laws that govern the protection of Personal Information received from URI or maintained on behalf of URI. Vendor agrees to apply the standards and requirements of all applicable Laws to all such Personal Information, regardless of the jurisdiction in which the subject of Personal Information resides. During the term of the Agreement, Vendor shall maintain, and provide for URI’s review, at URI’s request upon no less than thirty (30) days’ advance written notice, (a) Vendor’s WISP;

and (b) other applicable security program documents, including summaries of its incident response policies, encryption standards and/or other computer security protection policies or procedures, that constitute compliance with applicable Laws.

k) Vendor agrees to notify promptly, but in no event later than twenty-four (24) hours, after discovery of a security vulnerability, including, but not limited to, an exploitation of security vulnerabilities by third parties that have resulted in corruption, unauthorized modification, sale, rental, and/or otherwise damages to or materially alters the integrity of any of URI’s Personal Information, and shall work with URI to mitigate such vulnerabilities.

l) Vendor shall have a process for managing both minor and major security incidents. Vendor shall notify

URI promptly, and in no event later than twenty-four (24) hours after completing the initial incident response investigation, in writing, of any Security Breach. Vendor shall promptly and in writing provide URI with all relevant available information of the Security Breach and shall use reasonable efforts to mitigate such Security Breach and prevent a recurrence thereof. Security Breaches include, but are not limited to, a: virus or worm outbreak, cyber security intrusions into systems directly responsible for supporting URI’s data and services, physical security breaches into facilities directly responsible for supporting URI’s data and services, and other successful attacks on systems directly responsible for supporting URI’s data and services.

m) Vendor shall not be required to provide a written report of attempted security incidents. “Attempted

Security Incidents” means, without limitation, pings and other broadcast attacks on firewall, port scans, unsuccessful log-on attempts, common denial of service attacks, and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of Personal Information or other serious vulnerability to URI’s data.

n) In the event of a Security Breach, the Parties shall cooperate to (a) mitigate and resolve any data privacy or security issues involving Personal Information, and (b) as applicable, make any notifications to individuals affected by the Security Breach, and/or governmental/administrative entities as required by applicable Laws. Vendor’s failure to comply with this subsection shall be considered a material breach of the Agreement, for which no cure period shall apply.

o) Immediately following Vendor’s notification to URI of a Security Breach, the Parties shall coordinate with each other to further investigate the security vulnerability or Security Breach, in determining whether additional measures need to be taken to address the Security Breach, including mitigation of the Security Breach and making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law, regulation, industry standards or otherwise reasonably required by URI.

p) Vendor shall use its best efforts to immediately remedy a security vulnerability or Security Breach and prevent further security vulnerabilities or Security Breach at Vendor’s expense in accordance with applicable privacy rights, Laws, regulations and standards.

q) In addition to any indemnification obligations set forth herein, Vendor shall reimburse URI for actual and documented costs incurred by URI in responding to, and mitigating damages caused by, any security vulnerability or Security Breach.

r) Following a Security Breach, URI, or its designated agent, shall have the right, upon reasonable notice to

Vendor, to complete a review of Vendor’s security measures and ensure that unauthorized access to Personal Information has been eliminated.

s) Vendor shall ensure that all Personal Information that it has access to in its provision of Services to URI shall be secured and replicated in the event that the Vendor’s services or data center containing URI’s Personal Information suffers an adverse system event, so that Vendor shall be able to continue its business as intended with respect to the Services provided by Vendor to URI under the Agreement.

Therefore, Vendor shall maintain such processes in place to ensure that in the event that it is bankrupt, that data is corrupted, that URI’s Personal Information is impacted by ransomware or other malicious code, or there is any other interruption of its services, that Vendor has sufficient contingency plans in place to allow URI to continue its operations using the Personal Information that it has entrusted to Vendor in a reasonable timeframe.

t) Upon thirty (30) days’ written notice from URI to Vendor, and no more often than annually, to confirm

Vendor’s compliance with this Addendum, Vendor grants URI or, upon URI’s election, a third party on URI’s behalf, permission to perform during Vendor’s reasonable business hours, and in a manner that shall not unreasonably inhibit Vendors business operations, an assessment, audit, examination or review of relevant controls in Vendor’s physical and/or technical environment in relation to Personal Information being handled and/or services being provided to URI pursuant to this Addendum and the Agreement.

Vendor shall fully cooperate with such assessment by providing access to knowledgeable personnel, Vendor physical premises, documentation, and representative application software that processes, stores or transports URI’s Personal Information pursuant to this Addendum.

u) As applicable, Vendor understands the extremely sensitive nature of the Personal Information it receives and/or accesses from URI, and acknowledges that URI may suffer irreparable harm, for which damages would not be an adequate remedy if URI’s Personal Information were improperly disclosed. Vendor therefore agrees that URI shall be entitled to seek and obtain equitable relief in addition to all other remedies at law to protect its Personal Information.

v) Service Provider and its Authorized Employees shall not cause or allow Client’s Personal Information to be processed via a third-party generative AI service, such as but not limited to ChatGPT, Aria, and Microsoft CoPilot. Instances of Personal Information processed by a third-party generative AI program without prior express written consent of a duly authorized official University shall be treated as a Security Breach.

3. Consumer Privacy Rights

a) Vendor shall not collect, use, disclose, or retain Personal Information received from URI outside of providing services to URI or for any purpose other than the specific purpose of performing the services under the Agreement, including retaining, using or disclosing Personal Information for a commercial purpose other than the business purposes necessary to provide the services, or as otherwise permitted by applicable Laws.

b) Vendor shall not sell or share, as those terms are defined by applicable Laws, any Personal Information it collects, accesses, or receives from URI and/or on behalf of URI, except as permitted by applicable Laws.

c) Vendor may not access, combine, use, retain, or disclose Personal Information received from one or more entities to which it provides services, except as necessary to detect data security incidents, or protect against fraudulent or illegal activity, or to comply with a valid legal request pursuant to applicable Laws.

d) If Vendor receives a consumer request pursuant to applicable Laws directly from a consumer regarding

Personal Information that Vendor receives, collects, maintains, shares or is furnished or disclosed orally, in writing, electronically or in other form or media by URI to Vendor, it shall notify URI of such request in writing. If Vendor does not comply with the request, it shall explain the basis for the denial to URI and to the consumer as required by applicable Laws. Vendor agrees to respond to such request pursuant to applicable Laws.

e) If URI instructs Vendor to limit the use of consumer(s) Personal Information pursuant to a request under applicable Laws, Vendor agrees to adhere to such instructions as required by such Laws.

f) Vendor certifies that it understands the terms of this Agreement and the restrictions and prohibitions on selling, sharing, collecting, retaining and using Personal Information under applicable Laws. Vendor agrees that it will comply with these restrictions and prohibitions and that it will not collect, sell, retain, use, or disclose Personal Information in violation of this Agreement and/or applicable Laws.

g) As applicable and if Vendor collects Personal Information from consumers pursuant to the Agreement, Vendor shall check for and comply with opt-out preference signals unless URI informs Vendor that the consumer has consented to the sale or sharing of Personal Information.

h) With respect to any directions from URI related to the request of any individual consumer under applicable Laws, Vendor must:

i. Carry out any directions from URI to delete any Personal Information for an identified individual in your possession, custody, or control, in accordance with applicable Laws. Vendor must certify to URI in writing that the individual consumer’s Personal Information has been deleted or destroyed. In the event that deletion of the Personal Information is not possible for any legal or technical reason, Vendor shall immediately inform URI what Personal Information Vendor is unable to delete and the reason, and shall maintain the Personal Information, if permitted, under the same terms described herein;

ii. Carry out any directions from URI to correct any Personal Information for an identified individual in Vendor’s possession, custody or control, in accordance with applicable Laws.

Vendor must certify to URI in writing that the such individual consumer’s Personal Information has been corrected and that it will remain corrected;

iii. Carry out any directions from URI to provide any Personal Information Vendor has collected or maintained about an identified individual in accordance with a “right to know” request; and

iv. Notify URI if Vendor believes that such request would involve “disproportionate effort” within five (5) business days of such determination to discuss further.

i) Vendor agrees to notify URI in writing within five (5) business days if Vendor makes a determination that it can no longer meet its obligations under this Addendum as these terms related to consumer privacy rights under applicable Laws.

4. Term and Termination.

a) This Addendum shall be effective as of the date of the underlying Agreement and shall continue for the duration of the Agreement unless terminated upon prior written notice by URI.

b) URI may terminate this Addendum and the Agreement upon thirty (30) days' written notice to Vendor in the event of any material breach of this Addendum by Vendor. URI shall have no obligation to provide Vendor an opportunity to cure such breach; however, URI may, in its sole discretion, permit Vendor a cure period of up to thirty (30) days. If URI grants a cure period and Vendor fails to cure the breach within such period, URI may immediately terminate this Addendum and the Agreement.

c) On the expiration or termination of the Agreement, Vendor shall return or destroy, at URI’s sole discretion, any and all Personal Information in its possession within 30 days of the expiration or termination date. If URI requests that Vendor destroy such data, Vendor shall provide a written certification of destruction. If such return or destruction is not technically feasible, Vendor agrees to continue to protect and secure Personal Information in accordance with this Addendum for as long as Vendor maintains such information.

5. Miscellaneous

a) Vendor shall maintain or cause to be maintained sufficient insurance coverage as shall be necessary to insure Vendor and its employees, agents, representatives and subcontractors against any and all claims, losses, or damages arising under this Addendum and such insurance coverage shall apply to all services provided by Vendor or its representatives, agents, or subcontractors. Notwithstanding this provision, Vendor covenants that for the term of the Agreement, it shall maintain Cyber Liability insurance coverage with aggregate limits no less than $10,000,000.00.

b) Vendor agrees that, to the fullest extent permitted by law, it shall be and remain strictly liable for the security of all Personal Information when in Vendor’s possession and when being transmitted from Vendor or received by Vendor. Without limiting any other obligations under any agreement entered into between the Parties, Vendor shall defend, indemnify and hold harmless URI and its officers, directors, employees, and agents from and against all losses, claims, damages, liabilities, deficiencies, actions, judgments, interest, awards, penalties, fines, costs or expenses, including but not limited to the following costs: (i) costs to print and mail notification letters to affected individuals; (ii) media notification costs;

(iii) costs for a call center if URI reasonably determines that such is necessary to handle inquiries; (iv) credit monitoring costs if URI reasonably determines that it is necessary to mitigate harm for affected individuals or if such credit monitoring is required by law; (v) forensic costs; (vi) reasonable attorneys’ fees arising out of or resulting from any claim against URI or resulting from Vendor’s failure to comply with any of its obligations under this Addendum, including, but not limited to, negligent or intentional acts or omissions, or resulting from a Security Breach or encryption failure in the transmission of Personal Information; and (vii) fines and/or penalties incurred as a result of a Security Breach caused by Vendor. Any limitations of liability in the Agreement shall not apply to Vendor’s indemnity obligations hereunder.

c) Vendor will cooperate with URI and URI’s efforts to mitigate, to the extent practicable, any harmful effect that is known to Vendor of an access, use or disclosure of Personal Information by Vendor that is not provided for in the Addendum or the Agreement.

d) The Parties agree to take such action as is necessary to amend this Addendum from time to time as is necessary for the Parties to comply with applicable Laws.

e) In the case of any conflict between the terms of this Addendum and the Agreement with respect to the subject matter of this Addendum, the terms of this Addendum shall govern.

f) The terms of this Addendum shall survive termination of all agreements between the Parties if URI’s Personal Information is in the possession of Vendor.