ATTACHMENT 1 DATA SHARING AGREEMENT.PDF

J-119 DSA (8-23)
Page 1 of 10 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
ARIZONA DEPARTMENT OF ECONOMIC SECURITY 
Division of Technology Services/Information Risk Management 
1400 West Washington Street, Mail Drop 1426, Phoenix, Arizona 85007 
DATA SHARING REQUEST/AGREEMENT 
BETWEEN 
REQUESTING ENTITY: 
DES Division / Administration/Program / Office Name or External Organization Name: 
AND 
DATA MANAGER: ARIZONA DEPARTMENT OF ECONOMIC SECURITY 
Division / Administration/Program / Office Name: 
DSA Effective Date: 
DSA Agreement No.: 
Contract Start Date: 
Contract No.: 
Contract Max End Date: 
(If applicable) 
UID: 
Equal Opportunity Employer / Program • Auxiliary aids and services are available upon request to individuals with 
disabilities • TTY/TDD Services 7-1-1

J-119 DSA (8-23) – Page 2 of 10 

Agreement No.: 
SECTION I. REQUEST (Completed by Requesting Entity) 
Use attachment if necessary 
1a. PURPOSE OF THIS REQUEST (What information is being requested and why? How will it be used? Define 
business need. Give details/specifics.) 
1b. INFORMATION TECHNOLOGY AND CONNECTIVITY TYPE (VPN, DVD, Mainframe, etc.; or some other 
alternative way of accessing application/data?) Select all appropriate and explain in detail below: 
VPN-Client 
Mainframe 
Secure-FTP 
Secure-Email 
Other 
1c. INFORMATION TYPE BEING ACCESSED (Personal Identifiable Information, FBI, SSA, HIPAA, define)

J-119 DSA (8-23) – Page 3 of 10 
Agreement No.: 
1d. WILL THIS INFORMATION BE RETAINED? 
Yes 
No If Yes, where, and how? 
PLEASE SELECT THE TYPE OF INFORMATION REQUESTED AND SPECIFIC FIELDS: 
HIPAA 
PCI 
PHI 
PII 
Full Name 
Home Address 
SSN or National Identification Number 
Vehicle Registration Plate 
Driver’s License Number 
Fingerprints 
Credit Card Numbers 
Digital Identity 
Date of Birth 
Birthplace 
Gender/Race 
Health/Medical Records 
Wage/Tax Info 
Phone Number 
Criminal Record 
Medical Benefits Eligibility Records 
The requester enters all information required for successful communication between the requesting entity and 
the DES IT Staff. 
Contact Name (1): 
Phone: 
Contact Name (2): 
Phone: 
Contact Address: 
Contact (1) E-Mail Address: 
Contact (2) E-Mail Address: 
Contact Fax No: 
SECTION I. (Continued) REQUEST (Completed by Requesting Entity) 
Use attachment if necessary 
2. 
CITE LAW, REGULATION, DIRECTIVE OR OTHER BASIS FOR THIS REQUEST 


J-119 DSA (8-23) – Page 4 of 10 

Agreement No.: 
3. 
WILL OTHER ENTITIES INTERFACE/WORK WITH YOUR ORGANIZATION? 
Yes 
No If Yes, identify entity and reason(s) for interface: 
4. 
WILL INFORMATION BE DISCLOSED/SHARED WITH ANOTHER ENTITY/ORGANIZATION? 
Yes 
No If Yes, identify the entity/organization and reason(s) for disclosure: 
5. 
WILL DES DATA BE STORED IN ANY FORM OF (DATABASES, FILES, TAPES, PAPER COPIES, ETC.)? WILL 
DATA BELONGING TO DES BE STORED IN A SECURE SPECIFIED ON-SITE LOCATION? 
Yes 
No If Yes, identify where, what type of data and how the data is to be stored, and for how long: 
6. 
DESCRIBE IN DETAIL THE SAFEGUARDS YOUR ENTITY/ORGANIZATION HAS IN PLACE TO PROTECT 
AGAINST UNAUTHORIZED ACCESS/DISCLOSURE OF DES DATA/INFORMATION. EX. SECURE LOCATION, 
LOCKED AREAS, PASSWORD PROTECTION.

J-119 DSA (8-23) – Page 5 of 10 
Agreement No.: 
6a. IF AN INFORMATION BREACH SHOULD OCCUR, WHAT ARE YOUR PROCESSES AND PROCEDURES TO 
ADDRESS THIS? (See Section II, #6) 
7. 
HOW WILL THE INFORMATION BE PRESENTED FOR USE? WILL THE INFORMATION BE POSTED, 
DIGITALLY COPIED, APPLICATION, ETC.? 
8. 
HOW WILL THIS INFORMATION BE DISPOSED OF WHEN NO LONGER NEEDED? SEE RETENTION POLICY. 
Print Name and Title of Authorized Contact: 
Phone: 
Fax: 
E-mail:  
Date: 
Mailing Address/Mail Drop: 
City: 
State: 
ZIP Code:  



J-119 DSA (8-23) – Page 6 of 10 
Agreement No.: 
SECTION II. STIPULATIONS REGARDING THE USE OF INFORMATION 
STIPULATIONS APPLICABLE TO THE REQUESTING ENTITY: 
1. Disclosure of the data provided to the Requesting Entity is not permitted unless specifically authorized. 
2. Repackaging or redistribution of data or screens, or creation of separate files will not be permitted unless specifically 
authorized. 
3. The data shall be used only to assist in legal valid business needs as stated in Section I, item 1a of this Agreement. 
4. All data shall be stored in a physically secure, logically encrypted facility/system that follows the physical security 
regulations and standards based on the type of data appropriate and related standards. HIPAA/PHI/PII/PCI/PUB­
1075 etc. 
5. All data in electronic format shall be safeguarded and stored, processed, and monitored so that unauthorized persons 
cannot compromise the information. 
6. DES shall be notified within 24 hours when an information breach occurs. Notification must be in accordance with 
timelines based on State and Federal law. 
7. Only authorized staff will be given access to accomplish the purpose(s) specified in Section I, item 1a of this 
Agreement. 
8. All DES information system users must successfully complete the authorized information security awareness training 
course provided through the State of Arizona Learning Portal, which instructs users on general information security 
awareness concepts, such as confidentiality, privacy laws and the penalties imposed when there is non-compliance. 
All users must complete the security awareness training course at the initial information system access point and are 
required to recertify annually thereafter. 
9. A Request for Terminal Access and/or other Activity (J-125) shall be used to request specific access for each 
authorized staff member and must be signed by the staff supervisor or designee. 
10. All authorized users are required to electronically sign the State User Affirmation Agreement, as a condition for using 
the requested data. The affirmation agreement must be signed at the initial information system access point and 
annually thereafter. 
11. All changes requiring additional access or removal of access must be reported promptly within two business days to 
the respective user account management team via email at ISAAdmin@azdes.gov. 
12. Federal and state audit and data security personnel may have access to offices and records of the requesting entity 
to monitor or verify compliance with this Agreement. 
13. This Data Sharing Agreement will remain in effect for 5 years from the effective date unless otherwise stipulated in 
Section III or overridden by the Contract, a Memorandum of Understanding, or an InterAgency Agreement. If duration 
is overridden by another document, please reference the document in Section III. 
14. Upon Contract Termination, Media Sanitization procedures shall be adhered to in accordance with Arizona Statewide 
Policy – P8250v 1.0 - The Business Unit shall sanitize digital and non-digital information system media containing 
Confidential information prior to disposal, release of organizational control, or release for reuse using defined 
sanitization techniques and procedures in accordance with the Media Protection Standard S8250. [NIST 800-53 MP­
6] [HIPAA 164.310(d)(2)(i)] [HIPAA 164.310(d)(2)(ii)] [IRS Pub 1075] 
15. All DES Contract retention terms and conditions will be adhered to as written unless otherwise stated on DES 
Retention Policy [(DES 1-37-12-(01)(02)(03)] is applicable. 
16. Requesting entity is responsible for all costs and licenses associated with securely connecting to DES and for 
maintaining confidential standards. 
STIPULATIONS APPLICABLE TO PROVIDER: 
1. DES will use the Requesting Entity employee identifying information solely for the purpose of establishing access. 
2. Only authorized DES employees will have access to Requesting Entity employee data. 
3. In accordance with applicable federal, state, and/or local privacy regulations, DES will protect all information collected 
from the Requesting Entity. 
STIPULATIONS APPLICABLE TO HIPAA – HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT 
1. All staff shall attend an authorized HIPAA awareness training class, where they will be instructed on confidentiality, 
privacy, information safeguards and penalties imposed when compliance is breached. 
2. If applicable, a “Business Associate Contract” [45 CFR 164.502(e), 154.504(e). 164.532(d) & (e)] will be attached to 
this data sharing agreement as an addendum. 
STIPULATIONS APPLICABLE TO DIVISION DATA OWNERS: 
1. The assigned DES User Account Management representative must verify external and internal requesters, submit 
a service request (Cherwell), and attach the received Request for Terminal Access (J-125) and process the account 
creation request. A service request must contain the affected DSA number, and all contents of the Request for 
Terminal Access (J-125) in the service request summary field. The DES User Account Management representative 
must monitor and manage all accounts with access to data or with whom this DSA is in partnership.

J-119 DSA (8-23) – Page 7 of 10 
Agreement No.: 
SECTION III. ADDITIONAL INFORMATION 
TERMINATION OF AGREEMENT ONLY: 
a. Information will be returned based on Contract terms and conditions. 
Yes 
No 
b. Information will be truncated (erased/deleted). 
Yes 
No 
c. Information in physical form shall be shredded. 
Yes 
No 
d. All the above. 
Yes 
No 
External Agency POC (Print Name): 
Phone Number: 
Signature: 
Date: 
SECTION IV (A). RECOMMENDATIONS 
(Completed by the Data Managing Program/Data Owner) 
Recommend APPROVAL 
Request is not recommended for approval 
Print Name: 
Phone Number: 
Date: 
Signature: 
Mail Drop: 
SECTION IV (B). PRIVACY RECOMMENDATIONS 
(Completed by the Division HIPAA or Privacy Officer) 
Recommend APPROVAL 
Request is not recommended for approval 
Not Applicable for this Data Sharing Agreement 
Print Name: 
Phone Number:  
Date: 
Signature: 
Mail Drop: 
SECTION IV (C). DES ENTERPRISE SERVICE DELIVERY  
(Completed by DTS Service Delivery Manager) 
Recommend APPROVAL 
Request is not recommended for approval 
Print Name: 
Phone Number: 
Date: 
Signature: 
Mail Drop:  

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
SIGN
SIGN
SIGN
SIGN

J-119 DSA (8-23) – Page 8 of 10 
Agreement No.: 
SECTION V. APPROVAL 
(Completed by the Requesting Entity and the Data Managing Program) 
I attest to the correctness of the information provided in Section I and agree to the stipulations and costs, if any, listed in 
Section III. I agree to comply with all provisions of the DES Information Security Policies and Procedures. If any violations 
of DES Information Security Policies and Procedures occur, this Agreement may be terminated. I further understand that 
DES will periodically review the terms of the Agreement to ensure it conforms with DES Policies and Procedures. In the 
event changes in either federal or state law or regulations occur that conflict with the terms of the Agreement or render 
the terms of the Agreement void, impracticable, or otherwise impossible, this Agreement will terminate immediately. 
A new Agreement or amendment to the existing Agreement will be initiated to provide for any changes that cannot 
be accommodated within the provisions of the existing Agreement. The Requesting Entity shall hold harmless and 
indemnify the State of Arizona and the Department of Economic Security for any liability resulting from acts or omissions 
attributable to the Requesting Entity. 
IN WITNESS HERETO, the PARTIES have executed this Agreement by signature of their duly authorized officials: 
FOR THE REQUESTING ENTITY: (Completed by Requesting Entity) 
Entity Name:  
Print Signatory Name:  
Title: 
Signature: 
Date: 
FOR THE DEPARTMENT OF ECONOMIC SECURITY:  
(Completed by Data Managing Program) 
Entity Name: 
Print Signatory Name: 
Title:  
Signature: 
Date: 
SECTION VI. APPROVAL  
(Completed by Chief Information Security Officer (CISO)) 
This signed Agreement meets all requirements necessary to permit controlled sharing of DES data while simultaneously 
providing for the protection of the data. I certify that: 
THIS AGREEMENT CONFORMS to DES Information Security Policy [DES 1-38-8120 and 1-38-8280]. 
THIS AGREEMENT DOES NOT CONFORM to DES Information Security Policy [DES 1-38-8120 and 1-38-8280]. 
Implementation of this Agreement cannot proceed until the following action(s) is/are taken: 
(Signature) 
DES Chief Information Security Officer  
(Title) 
(Date) 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
SIGN
SIGN
SIGN

J-119 DSA (8-23) – Page 9 of 10 
ROUTING INSTRUCTIONS FOR J-119 
DATA- SHARING AGREEMENT BETWEEN DES ENTITIES: 
1. Sections I, II and III are completed, contact information is provided and the document is signed by the requesting 
Division or Program Assistant Director, Program Administrator, or designee. The Requesting Entity Division or 
Program Security Analyst sends the document to the Data Managing Division/Program Security Analyst. The DSA/ 
PSA from the Data Managing Division/Program will complete Section III and the recommendation in Section IV. If 
applicable, the Division HIPAA Privacy Officer will complete the recommendation in Section IV. Reason must be given 
if request is not recommended for approval. Section V is signed and dated by the Data Managing Assistant Director, 
Program Administrator, or designee. 
EXCEPTION: All DERS UI Data Sharing Agreements will follow their own established process. 
2. The Data Managing Division/Program Security Analyst forwards the Agreement to the Enterprise Delivery Team for 
signature and approval of information technology connectivity. Enterprise service delivery team sends DSA back 
to the Division/Program security team for final signatures. The Agreement is signed, and dated by the Information 
Security Administrator. The original Agreement is sent back to the Division/Program entered on the tracking list. The 
Agreement is scanned as a PDF to the network shared drive where all Data Sharing Agreements are saved. DSA is 
not final until fully signed by all parties. 
NOTE: When the Agreement is modified during the approval process, both entities must review the modifications and 
re-sign/date the document. 
DATA-SHARING AGREEMENT BETWEEN DES AND AN EXTERNAL ENTITY: 
3. Section I, II and III are completed by the requesting entity, contact information is provided and the document is signed 
by the requesting entity and Division or Program Assistant Director, Program Administrator, or designee. The Division 
or Program Security Analyst sends the document out for signatures. If applicable, the Division HIPAA Privacy Officer 
will complete the recommendation in Section IV. Reason must be given if request is not recommended for approval. 
Section V is signed and dated by the requesting entity administrator and Data Managing Assistant Director, Program 
Administrator, or designee. 
EXCEPTION: All DERS UI Data Sharing Agreements will follow their own established process. 
4. The Data Managing Division/Program Security Analyst forwards the Agreement to the Enterprise Delivery Team for 
signature and approval of information technology connectivity. Enterprise service delivery team sends DSA back 
to the Division/Program security team for final signatures. The Agreement is signed, and dated by the Information 
Security Administrator. The original Agreement is sent back to the Division/Program entered into the tracking list. The 
Agreement is scanned as a PDF to the network shared drive where all Data Sharing Agreements are saved. DSA is 
not final until fully signed by all parties. 
NOTE: When the Agreement is modified during the approval process, both entities must review the modifications and 
re-sign/date the document.

J-119 DSA (8-23) – Page 10 of 10 
DATA SHARING AGREEMENT WITH INTERNAL (if applicable)  
EXTERNAL CONTRACTS BETWEEN ENTITIES PROCEDURES: STEP BY STEP 
1. From the Contracts Division for which the Contract has been originally created, the authorized Contracts person shall 
contact the Security Representative from the specific Agency for which the Contract was created, notify that a Data 
Sharing Agreement (DSA) is needed and being requested, and a copy must be sent to the Security Analyst to start 
the process of creating a DSA. 
a. NOTE: A DSA request will not be honored without a valid Contract (number) (if applicable) accompanying 
the DSA. 
2. Any external Contracts agreed upon by DES that include the sharing of information require a J-119 – Data Sharing 
Agreement (DSA). The normal longevity of the J-119 DSA is 5 years, with annual review. The newly agreed upon 
Contract terms and conditions supersedes the longevity of the DSA length of 5 years to align with the Contracts 
terms, conditions, and longevity. 
a. Example: If a newly accepted Contract of 2 years needs a DSA, the DSA will align with the Contract’s longevity of 
2 years. A DSA is created. 
b. If at the end of the 2 years the contract is renewed for 1 more year, then the contract’s personnel shall inform the 
Agency’s Security Team of the contract extension. Agency’s Security Team will update the DSA tracking database 
to reflect the contract extension. The DSA can be renewed every year(s) up to five (5) years (the total life cycle of 
a DSA) before a new DSA is created. 
i. J-119A (Amendment Form) is required when additional access to other information not stipulated in the original 
DSA is being requested. For any extensions/changes of a DSA along with the following requirements: 
1. J-119A must document the changes to the original DSA. 
2. J-119A must document the new Contract Number. 
3. Document all changes made on the renewed Contract that involve terms and conditions in the sharing of 
information. 
4. Assign an agreement number to the DSA and put the Contract number on the first page of the DSA 
(preferably typed). 
5. DSA with other handwritten notes, directions, alterations and scratch offs will not be accepted by SRC. 
6. Security Analyst will enter all data into the DSA Database and will select status field “pending signatures to 
SRC.” 
Words of CAUTION: 
a. Security Analyst that has created the DSA will have to reproduce the DSA once again to be compliant, no 
exceptions. 
b. A DSA that is attached to a Contract will not be approved by SRC without a valid contract number. 
3. When the Security Analyst has completed all applicable signatures, the DSA must then be sent for final review 
and approval to the Division of Technology Services (DTS), Security, Risk, and Compliance (SRC), Attention: Chief 
Information Security Officer (CISO), 1400 W. Washington Street, Mail Drop 1426, Phoenix, Arizona 85007. The DSA 
Agreement shall be entered into the Data Security Warehouse Database by the Security Analyst with the status of 
“Pending SRC Approval’’. 
4. The original agreement is filed in the DES Data Managing Division/Program and the SRC Security Analyst confirms 
all data in the DSA database. The Agreement is not final until signed by the SRC Security Analyst, the DES Executor, 
and the Requesting Entity(s). 
5. A final digital copy of all signatures of essential personnel mentioned above is required to SRC for SRC Security 
Administrator to change the DSA to ACTIVE within the database.