Privacy Certificate Guidance

• About the Privacy Certificate
• Privacy Certificate Guidelines
• Helpful Hints With Privacy Certificates
• Model Privacy Certificate

About the Privacy Certificate

The NIJ Privacy Certificate (PC) guidelines and format provide instructions and a useful tool for documenting that applicants understand their obligations and how they will fulfill their obligations under the confidentiality regulations found in 28 CFR Part 22. Use of the supplied format will assist you in addressing all the points addressed in 28 CFR Part 22.

Privacy Certificate Guidelines

The following summarizes the requirements of 28 CFR §22.23 and should be used as a guide to completing the PC.

1. The PC must fully describe the following:
   • Procedures to ensure data confidentiality.
   • Procedures to ensure the physical and administrative security of data.
   • Procedures for subject notification or justification for waiver.
   • Procedures for final disposition of data.
2. The PC must also include the name and title of the person:
   • With primary responsibility for ensuring compliance with the regulations.
   • Authorized to approve transfers of data.
   • Authorized to determine final disposition procedures for the data collected and developed by the project.
3. The PC must contain assurances by the applicant that:
   • Data identified to a specific individual will not be used or revealed unless it is research or statistical information that is being used for research and statistical purposes.
   • Identified data will be used or revealed only on a need-to-know basis to:
     • Officers, employees, and subcontractors of the recipient of assistance;
     • Persons and organizations receiving transfers of information for research and statistical purposes only if an information transfer agreement is entered into in which the recipient is bound to use the information only for research and statistical purposes and to take adequate administrative and physical precautions to ensure the confidentiality of the information.
   • Employees with access to data on a need-to-know basis will be advised in writing of the confidentiality requirements and must agree in writing to abide by these requirements.
   • Subcontractors requiring access to identifiable data will only do so according to an information transfer agreement which states that the confidentiality of the data must be maintained and that the information may only be used for research or statistical purposes.
   • Private persons from whom identifiable data are obtained or collected will be advised either orally or in writing that the data will only be used for research and statistical purposes and that compliance with requests for information is not mandatory. That is, participation in the research is voluntary and may be withdrawn at any time. If the notification requirement is to be waived, an explanation must be contained in the PC.
   • Adequate precautions will be taken to ensure the administrative and physical security of the identifiable data.
   • A log indicating that identifiable data have been transferred to persons other than those in NIJ or other OJP bureaus, created under the Omnibus Crime Control Act or its amendments, or to grantee, contractor, or subcontractor staff will be maintained and will indicate whether the data has been returned or if there is an alternative agreement for the future maintenance of such data.
   • Project plans will be designed to preserve the anonymity of persons to whom the information relates, including where appropriate, name-stripping, coding of data, or other similar procedures.
   • Project findings and reports prepared for dissemination will not contain information which can reasonably be expected to be identifiable to a private person.
   • Upon completion of the project, the security of research or statistical information will be protected by either:
     • the complete physical destruction of all copies of the materials or the identified portions of the materials after a three year required recipient retention period or as soon as authorized by law; or
     • the removal of identifiers from the data and separate maintenance of a name-code index in a secure location.
       If you choose to keep a name-code index, you must maintain procedures to secure such an index.
   • Data will be archived according to the Data Archiving Plan approved by NIJ.

Helpful Hints

1. A Brief Description of Project is required. Please be explicit in describing how data will be collected and from whom.  Also, if the study is not collecting or using personally identifiable information, please include the following statement after the project description: "No data identifiable to a private person will be collected."
2. If you use the term N/A or Not Applicable, please include a brief description of why a particular item is not applicable. For example, in responding to the item on describing restrictions on the transfer of identifiable data, consider a response as follows: "Not applicable since this study is not collecting any individually identifiable data." This is particularly valuable if this point has not been made clear in the brief project description
3. Be certain to identify individuals and project staff who will have access to the data. If there are personnel yet to be hired (e.g., graduate students, contract staff) please identify such personnel as "two graduate students to be determined" or "four contract staff to be hired," etc. Also, remember that all future hires must be informed of their obligations under these regulations and agree to comply with the requirements. Once hired, an updated PC that includes the new staff hired should be provided to the grant manager.
4. Specify where the project data will be archived consistent with the approved Data Archiving Plan under Procedures for the final disposition of data (e.g., at the National Archive of Criminal Justice Data (NACJD)).
5. Please be sure to include the signature of the principal investigator, co-investigator(s), and authorized institutional representative. Electronic signatures are acceptable.  Lack of a complete signature block can lead to delays.  For studies that require Institutional Review Board (IRB) approval, the IRB chair/representative should sign as the authorized institutional representative.
6. The PC is a stand-alone document. Each section should be completed.  A project description is required. Failure to provide a stand-alone, fully completed PC can lead to delays.
7. The items to be attached to the PC are data transfer agreements, if applicable; data collection instruments; and the informed consent form and informed consent procedures, if applicable.
8. If the data collection methodology and/or information provided in the PC changes as a result of Institutional Review Board (IRB) requirements, a revised PC must be provided prior to the commencement of research or statistical activities.  IRB approval letters should also accompany the PC.

Model Privacy Certificate

NIJ provides a model privacy certificate for use by applicants seeking NIJ funding. It is a stand-alone document. All sections should be completed and the form should be listed on letterhead.

You may use a printer-friendly, fillable model privacy certificate. Two options to add your organization's letterhead to this form are:

Option 1: Fill, print, and scan:

1. Download and complete the form.
2. Print onto letterhead paper.
3. Scan to create an electronic file for submission.

Option 2: Insert an image of your organization’s letterhead:

1. Download the form.
2. Select the image icon on the first page.
3. Select “Browse” and choose an image file of your organization’s letterhead.
4. Complete and save the form.