Washington State Department of Licensing 1/30/2026

ATTACHMENT H: DOL PRIVACY AND DATA SECURITY REQUIREMENTS Department of Licensing Page 33 of 36 Contract No: K9319 5. PRIVACY The Contractor must have a privacy framework. At a minimum, the framework must include principles and methodologies for identifying and managing privacy risks, including the following: a. Privacy Policy Contractor must have a privacy policy that: 1) Declares data is managed as an asset of the organization, and outlines appropriate controls for the protection of data, and 2) Sets an expectation that all personnel will secure, use, and dispose of Personal Information in alignment with Contractor’s privacy and security practices, which must collectively align with these Privacy and Data Security Requirements. b. Privacy Notice Contractor must have a privacy notice available to inform the public how Contractor gathers, shares, uses, discloses, and manages Personal Information. This notice must appear on, and be easily recognizable to persons visiting the Contractor’s website where Applicants register for training or examinations. A copy of this notice must also be posted in their place of business where Applicants provide Personal Information to the Contractor or Subcontractor. c. Incident Response Plan Contractors are required to have an incident response plan to respond to an Incident or Data Breach. At a minimum, the plan is to include: 1) Procedures the Contractor uses to prepare for, detect, respond to, and recover from Incidents or Data Breaches, 2) Notification to DOL; and 3) Notification in accordance with chapter 19.255 RCW. d. Training Contractor must provide annual training to all Employees and Subcontractors who have access to Personal Information on its privacy policy and keep a record or log that reflects this annual requirement has been met. Contractor may use the following training video to satisfy the above requirements if they do not have their own equivalent in-house training- https://www.youtube.com/watch?v=uylbgjsVsKs. 6. DATA SECURITY REQUIREMENTS – ELECTRONIC RECORDS All Personal Information in Electronic form, including recorded conversations, must be secured as follows: The Contractor must protect Personal Information with administrative, technical, and physical measures that meet generally recognized cyber security industry standards and best practices, including those established by Washington Technology Solutions (WaTech). Examples of acceptable cyber security industry standards and best practices include: • ISO 27002. • PCI DSS. • NIST 800 series; and • WaTech IT Security Policies and Standards (SEC series) • DOL will audit to the standards in WaTech IT Security Policies and Standards (SEC series) when Contractor does not have an industry standard acceptable to DOL in place to secure electronic information. Docusign Envelope ID: 4798BD77-1E90-44A1-9098-432C0EDF7393