Privacy Certificate Guidelines
OJP policy requires that all grantees receiving funds to conduct research or statistical activities that involve
collecting data identifiable to a private person submit a Privacy Certificate in accordance with the
requirements of 28 CFR Part 22.
To determine if these regulations apply to a particular project, the applicant/grantee should answer the follow-
ing two questions. First, is the project a research or statistical project as defined in 28 CFR § 22.2? Second,
does the project involve collecting information identifiable to a private person as defined in 28 CFR § 22.2?
If the answer to both of these questions is yes, then a Privacy Certificate is required.
Projects will typically fall into one of three categories:
Category 1: The project does not involve any research or
statistical activities.
Category 2: The project involves research and/or statistical activities but does not involve the collection of
information identifiable to private persons.
Category 3: The project involves research and/or statistical activities and involves the collection of informa-
tion identifiable to private persons.
Applicants/grantees whose projects fall into categories 1 and 2 do not need to prepare a Privacy Certificate in
accordance with the regulations. However,
applicants/grantees should submit a brief description of the project
(one or two paragraphs) demonstrating that a Privacy Certificate is not required. For example, the project
description for a project in category 1 would describe the type of activities involved (e.g., demonstration pro-
gram, training and technical assistance) and contain a statement to the effect that no research or statistical
activities will be conducted as part of this project. Similarly, the project description for a
project in category 2
would contain a very brief description of the research/statistical activities to be conducted and the type(s) of
data being collected or used in the project and would assert that no information identifiable to a private person
is being collected. Applicants/grantees whose projects fall into category 3 will need to submit a Privacy Cer-
tificate in compliance with 28 CFR Part 22.
The attached documents have been created to assist OJJDP applicants/grantees in preparing a Privacy Certifi-
cate. The Privacy Certificate should include a face sheet with general project information and assurances and
an attachment detailing procedures for protecting the confidentiality of data identifiable to private persons.
The face sheet must be signed by the Principal Investigator(s) and the Authorized Institutional Representative
from the institution or organization conducting the project (with the name and title typed under each signature).
The Privacy Certificate submitted to OJJDP should contain original signatures submited via hard copy
and scan or completed with the applicable e-signatures. Please note that each section must be completed for
the Privacy Certificate to be approved. The applicable section(s) of 28 CFR Part 22 are noted in brackets for
reference purposes. Guidelines for completing each section are provided in italics.
If you do not have an electronic signature and would still like to sign this document electornically, select Tools in the
Show or Hide Panels in the upper right hand corner of this PDF. Click on the "Sign and Certity" ribbon and elect the
"Apply Ink Signature" option.
If you have a
ny questions about preparing a Privacy Certificate, please contact your OJJDP grant manager.
Office of Juvenile Justice and Delinquency Prevention
1
