Privacy Certificate 

Grantee1, _____________________________________________, certifies that data identifiable 

to a private person2 will not be used or revealed, except as authorized in 28 CFR Part 22, 

Sections 22.21 & 22.22. 

Brief Description of Project (required by 28 CFR §22.23(b): 

Grantee certifies that any private person from whom identifiable information is collected or 

obtained shall be notified, in accordance with 28 CFR §22.27, that such data will only be used or 

revealed for research or statistical purposes and that compliance with the request for information 

is not mandatory and participation in the project maybe terminated at any time. In addition, 

grantee certifies that where findings in a project cannot, by virtue of sample size or uniqueness 

of subject, be expected to totally conceal the identity of an individual, such individual shall be so 

advised. 

Procedures to notify subjects that such data will only be used or revealed for research or 

statistical purposes and that compliance with the request for information is not mandatory 

and participation in the project maybe terminated at any time as required by 28 CFR 

§22.23(b)(4):

If notification of subjects is to be waived, pursuant to 28 CFR §22.27(c), please provide a 

justification: 
Grantee certifies that project plans will be designed to preserve the confidentiality of private 

persons to whom information relates, including where appropriate, name-stripping, coding of 

data, or other similar procedures. 

Procedures developed to preserve the confidentiality of personally identifiable information, 

as required by 28 CFR §22.23(b)(7): 

Grantee certifies that, if applicable, a log will be maintained indicating that (1) identifiable data 

have been transferred to persons other than employees of NIJ, BJA, BJS, OJJDP, OVC, OJP, or 

grantee/contractor/subcontractor staff; and (2) such data have been returned or that alternative 

arrangements have been agreed upon for future maintenance of such data, in accordance with 28 

CFR §22.23(b)(6). 

Justification for the collection and/or maintenance of any data in identifiable form, if 

applicable: 

Procedures for data storage, as required by 28 CFR §22.23(b)(5): 
___________________________________________________________________ 

Grantee certifies that all contractors, subcontractors, and consultants requiring access to 

identifiable data will agree, through conditions in their subcontract or consultant agreement, to 

comply with the requirements of 28 CFR §22.24, regarding information transfer agreements. 

Grantee also certifies that NIJ will be provided with copies of any and all transfer agreements 

before they are executed as well as the name and title of the individual(s) with the authority to 

transfer data.. 

Description of any institutional limitations or restrictions on the transfer of data in 

identifiable form, if applicable: 

Name and title of individual with the authority to transfer data: 

Grantee certifies that access to the data will be limited to those employees having a need for such 

data and that such employees shall be advised of and agree in writing to comply with the 

regulations in 28 CFR Part 22. 

Grantee certifies that all project personnel, including subcontractors, have been advised of and 

have agreed, in writing, to comply with all procedures to protect privacy and the confidentiality 

of personally identifiable information. 

Access to data is restricted to the following individuals, as required by 28 CFR 

§22.23(b)(2): 

Principal Investigator(s) 

Project Staff 

Contractors, Subcontractors, and/or consultants 

Grantee certifies that adequate precautions will be taken to ensure administrative and physical 
security of identifiable data and to preserve the confidentiality of the personally identifiable 

information. 

Procedures to insure the physical and administrative security of data, as required by 28 

CFR §22.25(b), including, if applicable, a description of those procedures used to secure a 

name index : 

Procedures for the final disposition of data, as required by 28 CFR §22.25: 

Name and title of individual authorized to determine the final disposition of data: 

Grantee certifies that copies of all questionnaires, informed consent forms and informed consent 

procedures designed for use in the project are attached to this Privacy Certificate. 

Grantee certifies that project findings and reports prepared for dissemination will not contain 

information which can reasonably be expected to be identifiable to a private person, except as 

authorized by 28 CFR §22.22. 

Grantee certifies that the procedures described above are correct and shall be carried out. 

Grantee certifies that the project will be conducted in accordance with all the requirements of the 

Omnibus Crime Control and Safe Streets Act of 1968 as amended and the regulations contained 

in 28 CFR Part 22. 

Grantee certifies that NIJ shall be notified of any material change in any of the information 

provided in this Privacy Certificate. 

Signature (s): 

____________________________________ (Principal Investigator) 

____________________________________ (Principal Investigator) 

____________________________________ (Institutional Representative) 

Date:____________________________ 

Notes: 
1 Please include the name of the Principal Investigator(s) for this project as well as the name of the 

grantee organization on line 1. In the signature blocks, the PI(s) should sign, as well as the person 

representing the institution receiving the grant funds. Where a research project involves human

 subjects, the chair of the Institutional Review Board (IRB) should sign as authorizing official.

2 Information identifiable to a private person is defined in 28 CFR §22.2(e) as "information 

which either--(1) Is labeled by name or other personal identifiers, or (2) Can, by virtue of sample 

size or other factors, be reasonably interpreted as referring to a particular person."