Office of Information Technology (OIT) 

Privacy Impact Assessment 

DFC-008: Development Outcomes Survey 

April 17, 2023 

1100 New York Ave NW

Washington, DC 20527
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

2 

Overview

The U.S. International Development Finance Corporation (DFC) uses the Development Outcomes Survey (DOS) 

(DFC-008) to determine the development impact of a project supported by DFC. It is managed by the Office of 

Development Policy’s (ODP) Impact Management, Monitoring, and Learning Division. 

The DFC-008 is the principal document used by the agency to review and monitor development impact 

performance of projects supported by DFC. All active eligible projects submit the DFC-008 on an annual basis 

throughout their project lifecycle. The same initial questions are asked of all clients, with form conditionals guiding 

respondents to variations, which are determined by project financing type and sector, resulting in a streamlined 

form of questioning. 

The DFC-008 is completed with the use of a web-based application. This provides a secure and efficient means for 

clients to transmit the required information to the agency. The form is shifting from being administered on the 

DFC Forms Portal and transferred to the agency’s “Insight” Salesforce platform, to being administered directly on 

Insight. 

The Privacy Impact Assessment (PIA) is being conducted because DFC uses the DFC-008 to initiate a new collection 

of information that will be collected, maintained, or disseminated using information technology (IT), and includes 

information in an identifiable form permitting the physical or online contacting of a specific individual, with 

identical questions being posed to, or identical reporting requirements imposed on, 10 or more persons. 

Section 1. Characterization of the Personally Identifiable Information 

(PII) 

The following questions are intended to define the scope of the PII requested and collected as well as 

the reasons for its collection as part of the program, IT system, or technology being developed. 

1.1 What PII is collected, used, disseminated, or maintained by the system? Indicate all 

that apply.

☒ Name

☐ Social Security Number (SSN)

☐ Date of Birth

☐ Place of Birth

☐ Driver’s License

☐ Race/Ethnicity

☐ Passport Number

☐ Personal Bank Account

Number

☐ Business Bank Account

Number

☐ Gender

☐ Religion

☐ Security Clearance

☐ Personal Phone Number

☒ Business Phone Number

☐ Personal Email Address

☒ Business Email Address

☐ Personal Mailing Address

☐ Business Mailing Address

☐ Spouse Information

☐ ID Number

☐ Financial Information

☐ Group Affiliation

☐ Medical Information

☐ Mother’s Maiden Name

☐ Marital Status

☐ Disability Information

☐ Biometrics

☐ Fax Number

☐ Health Plan Number

☐ Civil or Criminal History

☐ Alien Registration Number

☐ Photograph

☐ Credit Card Number

☐ Child or Dependent

Information

☐ Other Names Used

☐ Law Enforcement
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

3 

☐ Employment Information

☐ Truncated SSN

☐ Education Information

☐ Military Status/Service

☐ Legal Status

☐ Emergency Contact

☐ Internet Protocol (IP)

Address

☐ Account Password

☐ Citizenship or Immigration

Status

☐ Retirement Information

☐ Taxpayer Identification

Number (TIN)

☒ Other: Title of Submitter

1.2 What are the sources of the PII in the system?

The form is completed for each DFC-supported Project by the Client organization/company. The person

completing the form on behalf of the Client organization/company is typically an employee of the Client

organization/company. Completion of the DOS (DFC-008) is one of the conditions listed in the agreement between 

DFC and the Client for each Project. 

1.3 Why is the PII being collected, used, disseminated, or maintained? 

The DOS is the principal document used by DFC to review and update a Client’s developmental impact profile and 

is one source for reviewing the project’s compliance with environmental, labor, and economic policies, as 

consistent with DFC’s authorizing legislation. It is a comprehensive survey designed to track project performance 

as compared to baseline data and projections established at the start of the project. Because it is completed

annually, the DOS can track changes over time, and allow for monitoring on a project-by-project basis. The name, 

title, business phone number, and business email address of the Client’s representative is collected at the end of 

the form and provides attestation that the information provided on the DOS is complete and accurate. The 

business contact information also establishes an official point of contact with the Client organization/company for 

reporting development impact data for a specific Project if additional information or clarification about the Project 

is needed. 

1.4 How is the PII collected?

Client organizations/companies that have DFC-supported Projects select an individual staff representative to 

complete the DOS on behalf of the Client organization/company. The personally identifiable information (PII) is 

collected from the person who has been listed by the Client organization/company as the contact person for 

impact monitoring data for a specific Project. The person is contacted through automated email and instructed to 

complete the DOS for the Reporting Period for that Project. The DOS has historically been submitted in the DFC 

Forms Portal and pushed into the Insight Project record as a PDF. The DOS is transitioning to being completed 

directly through Insight for the data collection cycle launching in fiscal year (FY) 2023. 

The DOS is subject to the Paperwork Reduction Act and contains the following Office of Management and Budget 

(OMB) control number and agency form number:

OMB Control Number: 3015-0015

Agency Form Number: DFC-008
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

4 

1.5 How will the PII be checked for accuracy?

The PII submitted is presumed to be accurate because it is collected directly from the person that is listed by the 

Client organization/company as their contact person for impact monitoring data for a specific Project. An 

automated email is also sent to the person before filling out the DOS, which verifies that the business email 

address is accurate.

The project data in the DOS is reviewed by members of DFC’s Impact Management, Monitoring, and Learning 

team. It is compared against previous year data for that specific Project and against previously submitted 

information from the Client for that Project. The Impact Management team corresponds directly with the Client to 

clarify any questions regarding the data. The Client makes any needed adjustments and resubmits the form. The 

status of the form is then changed to “Final Submitted” in Insight.

1.6 If the information is retrieved by a personal identifier, what System of Records Notice 

(SORN) applies to the information. If a SORN is not required, what specific legal 

authorities, arrangements, and agreements define the collection of PII?

A System of Records Notice does not apply to the DOS because completed DOS forms are retrieved by project

number or project name and not by personal identifier. Furthermore, the PII in the DOS pertains to persons acting 

in an entrepreneurial capacity on behalf of a Client organization/company. As the persons are not acting in a 

personal capacity, they are not considered “individuals” protected by the Privacy Act.

Section 9652 of the Better Utilization of Investments Leading to Development Act of 2018 (22 U.S.C. § 9652, the 

“BUILD Act”) directs DFC to establish a performance measurement system. Among other requirements is a need 

for DFC to “develop standards for, and a method for ensuring, appropriate development performance of the 

Corporation’s portfolio, including – (A) measurement of the projected and ex post development of a project; and 

(B) the information necessary to comply with section 9653 of this title.”

Section 9653 of the BUILD Act requires DFC to complete an annual report that includes reviews, analysis, and 

projections of development outcomes of DFC investments. This analysis also includes information about 

compliance of Projects with human rights, environmental, labor, and social policies. 

The data collected in the DOS is one way that DFC measures the development performance of projects and is a key 

tool in mission-essential ongoing project monitoring and Congressionally-mandated annual reporting.

1.7 Privacy Impact Analysis: Related to Characterization of the PII

Privacy Risk: There is a risk that more PII will be collected than is relevant and necessary.

Mitigation: This risk is partially mitigated. The PII collected at the end of the DOS is limited to business contact 

information – name, title, business phone number, and business email address of the contact person for the Client

organization/company. This information is collected in order to receive attestation that the information being 

submitted to DFC is complete and accurate, and to establish an official point of contact with the Client

organization/company for reporting development impact data for a specific Project if additional information or 

clarification about the Project is needed.

Privacy Risk: There is a risk that the PII collected will be inaccurate or incomplete.
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

5 

Mitigation: This risk is partially mitigated. The PII at the end of the DOS is presumed to be accurate because it is 

provided directly from the source. In addition, the name of the person is listed by the Client

organization/company as their point of contact, and an automated email is sent to the person before filling out the 

DOS, which verifies that the business email address is accurate. The Client cannot submit the DOS unless the 

required representative certification fields have been completed (name, date, title, business phone number, and 

business email address).

Section 2. Uses of the PII

The following questions are intended to clearly delineate the use of PII and the accuracy of the data 

being used. 

2.1 Describe how the PII in the system will be used in support of the program’s business 

purpose. 

The PII from the DOS is used to attest to the completeness and accuracy of the data provided in the DOS and to 

establish a point of contact with the Client organization/company for reporting development impact data for a 

specific Project. 

The project data from the DOS will be used in the following ways:

Reporting and communications

1. To complete the Congressionally-mandated annual report that includes (1) projected impacts (which are

derived from IQ scoring of projects and (2) analysis of realized impact results (derived from the DOS) from

DFC investments.

2. To enable additional ad-hoc communications with Congress and other key stakeholders (e.g., to facilitate

the timely response to Congressional inquiries).

3. To support DFC’s broader learning agenda, as needed.

Monitoring

4. To monitor compliance of individual projects with human rights, environmental, labor, and social policies.

5. To monitoring development impact on a project-by-project and portfolio basis.

6. To identify opportunities for technical assistance and to support monitoring of technical assistance

efforts.

2.2 What types of tools are used to analyze data and what type of data may be 

produced? 

DFC leverages several databases to store and structure data. Data from the DFC-008 have historically been stored 

in two such databases:

• Through 2022, data received by DFC enter .NET, a Structured Query Language (SQL) database.

• Upon the completion of data cleaning, responses have then been migrated into Insight, a Salesforce

Object Query Language (SoQL) database.
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

6 

Moving forward, data will be collected through and stored in Insight (Salesforce). 

To extract data, analysts either develop and implement queries via the SoQL workbench or design and execute 

“reports” in Salesforce (“Insight”). Data may then be further transformed in Tableau, Microsoft Excel, or through 

other analytic tools as needed. 

Analyses explore data both at the observation or client level and in aggregate. At no point will analyses be 

conducted on the PII collected through the DOS. 

Typical analyses include:

• Basic descriptive statistics (sums, averages, and medians)

• Distribution, skew, and outlier analyses

• Longitudinal analyses (e.g., changes over time)

2.3 If the system uses commercial or publicly available data, explain why and how it is 

used. 

N/A – This form does not use commercial or publicly available data.

2.4 Privacy Impact Analysis: Related to Uses of the PII

Privacy Risk: There is a risk that PII will be used inappropriately.

Mitigation: This risk is partially mitigated. The PII collected through the DOS is limited to information found on a 

business card, which is non-sensitive in nature. Thus, there are limited opportunities for PII to be used 

inappropriately. In addition, all DFC personnel are required to take annual privacy awareness training and sign the 

DFC Privacy Rules of Behavior to attest that they will handle PII appropriately.

Section 3. Retention of PII 

The following questions are intended to outline how long PII will be retained after the initial collection.

3.1 Has the retention schedule been approved by the National Archives and Records 

Administration (NARA)? If so, please indicate the name of the records retention 

schedule. 

All forms are scheduled under the National Archives and Records Administration (NARA) General Records Schedule 

(GRS) 4.1 - Records Management Records, Item 040 - Forms management records. 

3.2 For what reason is the PII retained? 

In accordance with NARA GRS 4.1, Item 040, the PII in the DOS is retained as part of “[r]ecords involved with 

ensuring use of standard Federal and agency forms to support effective record-keeping and ensuring that Federal 

standard forms are available and used as appropriate to support Federal record-keeping requirements.”

3.3 How long is the PII retained?
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

7 

PII in DFC forms are considered temporary records, have a retention period of three years, and are destroyed after 

the form is discontinued, superseded, or cancelled, but longer retention is authorized if needed for business use.

Business use of the DOS may include longitudinal analyses of particular project metrics to determine development 

impact and potential for future projects, and analysis on an aggregate and portfolio level with possible 

segmentation by project sector, impact thesis, and/or geographic market. The PII in the DOS is not used as part of 

any analysis and is retained for the same amount of the time in which the DOS is retained for business use.

3.4 How is the PII disposed of at the end of the retention period? 

At the end of the retention period, when there is no longer a business use for the data, completed DOS forms are 

electronically deleted from Insight, and any paper records of the DOS that were printed are shredded or pulped. 

3.5 Privacy Impact Analysis: Related to Retention of PII

Privacy Risk: There is a risk that PII may be retained for a longer period than necessary.

Mitigation: This risk is partially mitigated. The DOS is retained in accordance with a NARA-approved GRS. The 

privacy program discusses ODP’s records retention procedures at least once every three years during the PIA 

review process to ensure that PII is retained for only the relevant and necessary period. 

Section 4. Internal Sharing and Disclosure

The following questions are intended to define the scope of PII sharing within DFC. 

4.1 With which internal organizations is PII shared? What PII is shared, and for what 

purpose? 

DFC staff have access to the DOS in Insight. Designated DFC staff process the data in for DFC, other staff in ODP

access the data, and DFC staff in other parts of the agency also access the data in support of DFC’s business needs. 

The PII on the form is only used to certify the form and to contact the representative of the Client

organization/company if corrections or clarifications are needed.

4.2 How is the PII transmitted or disclosed internally? 

From 2023 onwards, designated DFC staff can access completed DOS forms by searching for the project number or 

project name in Insight. From there, staff may access the completed PDF of a Client’s DOS response or view fieldby-field information on the corresponding Insight page within a project’s record. 

For historical data, DFC staff may also access complete DOS forms in Insight. However, access to field-by-field 

information is restricted (as this information is stored in .NET) and is determined and approved by the Managing 

Director of the staff requiring access and by the Office of Information Technology (OIT). 

4.3 Privacy Impact Analysis: Related to Internal Sharing and Disclosure

Privacy Risk: There is a risk that PII may be shared internally with individuals who do not have a need to know.
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

8 

Mitigation: This risk is partially mitigated. For historical data, access controls in the .NET database enable DFC to 

restrict access to the DOS in accordance with the principle of least privilege. Therefore, the business contact 

information collected in the DOS along with any associated project data will only be shared with DFC personnel 

who have a role in administering the form or in maintaining the DFC Forms Portal. Individuals requesting access to 

the DOS must go through a multi-layered approval process involving the Managing Director of the staff requiring 

access and OIT, thus ensuring that the individual receiving access is properly vetted.

Section 5. External Sharing and Disclosure

The following questions are intended to define the content, scope, and authority for PII sharing external 

to DFC, which includes federal, state, and local governments, and the private sector. 

5.1 With which external organizations is PII shared? What information is shared, and for 

what purpose? 

Information about persons completing the DOS is not shared outside the agency. Project data from the DOS is 

reported in the DFC Annual Report, on the DFC website, for use by the DFC Office of External Affairs, etc., on an 

aggregate and portfolio level with possible segmentation by project sector, impact thesis, and/or geographic 

market. This is standard performance data and not related to a single individual. 

5.2 Is the sharing of PII outside the agency compatible with the original purpose for the 

collection? 

N/A – the PII is not shared outside of DFC.

5.3 Is the external sharing covered by an appropriate routine use in a SORN? If not, 

please describe under what legal mechanism the IT system is allowed to share the 

information in identifiable form outside of DFC.

N/A – the PII is not shared outside of DFC. 

5.4 How is the PII shared outside the agency and what security measures safeguard its 

transmission? 

N/A – the PII is not shared outside of DFC. 

5.5 Privacy Impact Analysis: Related to External Sharing and Disclosure

Privacy Risk: There is a risk that PII may be shared externally with individuals who do not have a need to know.

Mitigation: This risk is partially mitigated. As a practical matter, DFC does not share PII from the DOS outside of 

DFC. In addition, any project-related data released externally from the DOS is done on an aggregate and portfolio 

level and is not tied to a single individual.
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

9 

Section 6. Notice

The following questions are directed at providing notice to the individual of the scope of information 

collected, the right to consent to uses of the information, and the right to decline to provide 

information. 

6.1 Was notice provided to the individual before collection of the PII? 

All revisions to DFC forms are announced in the Federal Register. The relevant Federal Register notifications have 

been made for this update to the DOS. Notice is also provided to individuals through this PIA. 

The form itself also contains a notification detailing how DFC intends to use the information. This notification is 

provided at the beginning of the form, and the submitter checks a box agreeing that they have read and agree to 

the terms and conditions listed.

Lastly, the below Privacy Notice will appear once a Client starts the DOS: 

Privacy Notice:

Authority: The Better Utilization of Investments Leading to Development Act (22 U.S.C. § 9601, 

the “BUILD Act”) directs the United States International Development Finance Corporation (DFC) 

to facilitate market-based private sector development and to report on metrics for support 

transactions. In order to determine whether a project is eligible for a DFC product and to ensure 

reporting compliance, DFC has established a series of information collections or forms accessed 

through this portal.

This Privacy Notice applies to all collections in this portal except for DFC-006, Personal 

Information Form, which is accompanied by a Privacy Act Statement specific to that form.

Purpose: The personally identifiable information (PII) collected in all forms in the portal except 

for DFC-006, Personal Information Form, is limited to contact information for the individual filling 

out that particular form. The name, business phone number, and business email address of the 

individual is used to certify the form. This information is used by staff members reviewing the 

data to contact the individual for corrections or clarifications as necessary. The information 

collections are retrieved by project name or number and not by the name of the individual.

Routine Uses: Information about individuals completing the form on behalf of the project is not 

shared outside the agency except to the extent required by law or as necessary to represent the 

agency in litigation.

Disclosure: Providing contact information for the individual completing the form is voluntary; 

however, if the agency has no contact information for the project, DFC staff will be unable to 

communicate with the project’s point of contact to continue processing their submission.
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

10

6.2 Do individuals have the opportunity and right to decline to provide PII? If so, is a 

penalty or denial of service attached? 

Providing the PII is voluntary; however, submission of the DOS is a condition for DFC projects. If the PII is not 

provided on the form, then the DOS will be considered incomplete. Client organizations/companies may reference 

their respective legal agreements for specific information.

6.3 Do individuals have the right to consent to particular uses of the PII? If so, how does 

the individual exercise the right? 

Providing PII is required to be included in the DOS for the form to be considered complete, but PII is not included in 

the analysis and reporting of the responses, so there is no need for consent on specific uses.

6.4 Privacy Impact Analysis: Related to Notice

Privacy Risk: There is a risk that notice has not been given to individuals on the use of collected PII.

Mitigation: This risk is partially mitigated. DFC provides notice on the use of collected PII through this PIA and 

through the agency’s respective legal agreements with the Client organizations/companies. The DOS itself also 

contains a notification detailing how DFC intends to use the information, and a Privacy Notice appears once a 

Client starts the DOS in Insight. 

Section 7. Access, Redress, and Correction

The following questions are directed at an individual’s ability to ensure the accuracy of the PII collected 

about him or her. 

7.1 What are the procedures that allow individuals to gain access to their information? 

Any person who submits information in the DOS may log into Insight at any time and view a PDF version of their 

completed submission. If a person has difficulty accessing their account or the PDF version of their submission, 

they may email DOS@dfc.gov, and DFC technical staff will assist them with accessing the information.

7.2 What are the procedures for correcting inaccurate or erroneous information? 

If a person needs to change any information that was provided in the DOS, they can request the change directly to 

ODP Monitoring staff at DOS@dfc.gov. 

7.3 How are individuals notified of the procedures for correcting their information?

This PIA provides notice to persons on how to correct their information. 

7.4 If no formal redress is provided, what alternatives are available to the individual?

N/A – formal redress is available to individuals as described in section 7.2 of this PIA.
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

11

7.5 Privacy Impact Analysis: Related to Access, Redress, and Correction

Privacy Risk: There is a risk that individuals will not be able to access or correct any information maintained on 

them by DFC.

Mitigation: This risk is partially mitigated. All data is sent directly by a representative of the Client

organization/company. After a person submits the DOS in Insight, they are able access a final PDF version of the 

completed DOS. If they need to correct any information after the form has been submitted, they may reach out to 

ODP Monitoring staff directly at DOS@dfc.gov to request a change.

Section 8. Technical Access and Security

The following questions are intended to describe technical safeguards and security measures. 

8.1 How will the PII be secured?

(1) Physical Controls. Indicate all that apply.

☒ Security Guards

☒ Key Guards

☐ Locked File Cabinets

☒ Secured Facility

☒ Closed Circuit Television

☒ Cipher Locks

☒ Identification Badges

☐ Safes

☐ Combination Locks

☐ Locked Offices

☐ Other. Describe

(2) Technical Controls. Indicate all that apply.

☒ Password

☒ Firewall

☒ Encryption

☒ User Identification

☒ Biometrics

☒ Intrusion Detection System (IDS)

☒ Virtual Private Network (VPN)

☒ Public Key Infrastructure (PKI) Certificates

☒ Personal Identity Verification (PIV) Card

☒ Other. Multifactor authentication using cell phone, email, authenticated app

(3) Administrative Controls. Indicate all that apply.

☐ Periodic Security Audits
Privacy Impact Assessment (PIA)

DFC-008: Development Outcomes Survey

12

☒ Backups Secured Off-site

☒ Rules of Behavior

☒ Role-Based Training

☒ Regular Monitoring of Users’ Security Practices

☒ Methods to Ensure Only Authorized Personnel Have Access to PII

☒ Encryption of Backups Containing Sensitive Data

☒ Mandatory Security, Privacy, and Records Management Training

☐ Other. Describe

8.2 Will DFC contractors have access to the system? If so, how frequently are contracts 

reviewed and by whom? 

DFC’s contracted technical staff have access to perform operations and maintenance in Insight, the IT system that 

stores the DOS. Select contracted staff also have access to the .NET database, which stores historical DOS 

submissions. Contracts are reviewed periodically by the Contracting Officer’s Representative and Contracting 

Officer, at minimum during modifications to the contract, when new key personnel are added, and during the 

contract option period.

8.3 Describe what privacy training is provided to users either generally or specifically 

relevant to the program or system?

DFC employees and contractors must take annual privacy awareness training and information security awareness 

training, which educate users on the need to protect agency data and provide best practices for handling PII.

8.4 Has Assessment and Authorization (A&A) been completed for the system?

As the DOS is a survey and not an IT system, Assessment and Authorization (A&A) is not applicable to the DOS. 

However, A&A is currently being performed on the new, modernized Insight platform on which the DOS will be 

hosted; this is scheduled for completion in FY 2023. 

8.5 Privacy Impact Analysis: Related to Technical Access and Security

Privacy Risk: There is a risk that PII will not be properly secured.

Mitigation: This risk is partially mitigated. DFC employs numerous physical, technical, and administrative controls 

to secure its IT resources. In particular, access to the DFC Forms Portal requires the use of a username and 

password to authenticate the user into the system. Moving forward, Clients will gain access to the DOS through 

Login.gov, which serves as the data entry portal into Insight. Login.gov is a federally recommended user 

authentication service provided by the U.S. General Services Administration to partner agencies. Additionally, 

each external user only has access to their own submitted data in Insight. All DFC personnel also must take annual 

privacy awareness training and information security awareness training informing them of proper methods for 

securing PII.