Sec. 201. Executive responsibility
146 words·~1 min read·
/bill/116/s/2968/is/section-201A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Beginning 1 year after the date of enactment of this Act, the chief executive officer of a covered entity that is a large data holder (or, if the entity does not have a chief executive officer, the highest ranking officer of the entity) and each privacy officer and data security officer of such entity shall annually certify to the Commission, in a manner specified by the Commission, that the entity maintains— adequate internal controls to comply with this Act; and reporting structures to ensure that such certifying officers are involved in, and are responsible for, decisions that impact the entity’s compliance with this Act. A certification submitted under subsection
(a)shall be based on a review of the effectiveness of a covered entity’s internal controls and reporting structures that is conducted by the certifying officers no more than 90 days before the submission of the certification.