WA ST Dept of Corrections 9/20/2022

3. Paper Documents. If WADOC Data is stored as physical paper documents,such documents shall be physically segregated from non-WADOC Data and secured in a drawer, folder, or other container, with access limited to only authorized individuals. C. When it is not feasible or practical to segregate WADOC Data from non-WADOC Data using the methods set forth above,then both the WADOC Data and the non-WADOC Data with which it is commingled must be protected as described for WADOC Data in this Agreement. V. DATA CONFIDENTIALITY A. Requestor acknowledges the personal or confidential nature of the information and agrees that all employees, agents, volunteers, contractors, and subcontractors with access to WADOC Data, and third parties with whom WADOC Data is shared, shall comply with all laws, regulations, and policies that apply to protection of the confidentiality of the WADOC Data. Requestor is responsible for ensuring all such employees, agents, volunteers,contractors,subcontractors,and third parties abide by all applicable laws and the data security provisions set forth in this Agreement and any amendments,attachments, or exhibits hereto. B. PENALTIES FOR UNAUTHORIZED DISCLOSURE OF INFORMATION. In the event Requestor fails to comply with any material term of this Agreement, WADOC shall have the right to take any and all actions to remedy such failure and its effects that WADOC,in its sole discretion,deems reasonable under the circumstances. Any costs,fees,or expenses,including legal costs,incurred by WADOC as a result of Requestor's failure to comply with the terms of this Agreement shall be recoverable from Requestor. The exercise of remedies pursuant to this paragraph shall be in addition to all sanctions provided by law and to legal remedies available to parties injured by unauthorized disclosure. VI. DATA BREACH NOTIFICATION A. The compromise or potential compromise of WADOC Data that may be a breach that requires notice to affected individuals under RCW 42.56.590,RCW 19.255.010,or any other applicable breach notification law or rule must be reported to must be reported to the WADOC Contract Manager and WADOC Chief Information Security Officer within one (1)business day of discovery. B. If Requestor does not have full details about the incident,it will report what information it has and provide full details within fifteen(15)business days of discovery. To the extent possible,these initial reports must include at least: 1. The nature of the unauthorized use or disclosure,including a brief description of the event of unauthorized use or disclosure,the date of the event,and the date of discovery. Washington State K12798 Page 6 of 9 Department of Corrections Attachment A