Washington State Department of Licensing 1/30/2026

ATTACHMENT H: DOL PRIVACY AND DATA SECURITY REQUIREMENTS Department of Licensing Page 35 of 36 Contract No: K9319 g. DATA AT REST Contractor must encrypt Personal Information while at rest with strong encryption as defined at https://www.pcmag.com/encyclopedia/term/strong-encryption. h. DATA MINIMIZATION Contractor must have a policy for the retention of Personal Information. Contractor must only retain Personal Information for the duration of time needed to fulfill the use for which it was obtained, as well as any legal requirements to retain the record f or the minimum required retention period in General Terms and Conditions- Section 8 Records Maintenance. i. DATA AND MEDIA SANITIZATION Contractor must have a data and media sanitization policy that aligns with current guidelines and definitions in NIST SP 800-88, to include: 1) “Clear” or “clearing” applies when removing Personal Information from media once the Personal Information has met the retention policy required in Section 6.h, Data Minimization, of this attachment, or as directed by DOL. 2) “Purge” or “purging” applies when removing Personal Information from media when media are reused for purposes within the organization but will not store Personal Information. 3) “Destroy” or “destroying” applies when removing media that stored Personal Information when the media is not going to be reused by the organization. 4) Unless explicitly required by law, Contractor must provide one or more certificates of Clearing Personal Information, Purging Personal Information from media, or Destroying media storing Personal Information, within thirty (30) days of: I. Written request by DOL, or II. Termination of this Contract. 7. DATA SECURITY REQUIREMENTS – HARD COPY RECORDS The Contractor must secure all Personal Information in hard copy form as follows: a. HARD COPY STORAGE Printed copies must be stored in locked containers or storage areas when not in use by authorized persons. Examples include a physically secure workspace, locked cabinets, or vaults. Hard copy documents must never be unattended or in areas accessible to the public. b. HARD COPY TRANSPORTATION 1) Hard copy documents containing Personal Information taken outside a secure area must be in the possession of an authorized person, or a trusted courier providing tracking services. 2) Records must be maintained for all transported hard copies showing the person(s)/courier(s) responsible for such transportation, including the receiving party. 8. DATA SECURITY REQUIREMENTS – OFFSHORING a. OFFSHORING – ELECTRONIC RECORDS Contractor must maintain the primary, backup, disaster recovery and other sites for processing or storage of Personal Information only from locations in the United States. 1) Contractor may not, without advance written approval from DOL: i. Directly or indirectly (including through subcontactors) transmit Personal Information outside the United States, or ii. Allow access to Personal Information from outside the United States. Docusign Envelope ID: 4798BD77-1E90-44A1-9098-432C0EDF7393