The data management plan is a seven-page questionnaire, Form 200-029, that the Washington State Department of Licensing (DOL) uses in its procurement process to learn how a vendor's product will collect, protect, store and return DOL data. The DOL project lead and the vendor complete it together. On FillingPDF you can fill out the form online and download or print the completed PDF; the form and DOL's other forms are published by the agency at dol.wa.gov.
Last updated
What is 200-029?
The Data Management Plan (Form 200-029) is the Washington State Department of Licensing (DOL) form that collects the information DOL needs from a vendor during procurement, organized around the Washington State Agency Privacy Principles.
DOL defines a data management plan (DMP) as a written document that describes how data will be managed at each stage of a data lifecycle. DMPs support the goal of safer data in DOL's strategic plan, and they are created by data producers and product vendors in consultation with data stewards.
The form is organized in these sections:
- Contact Information, plus Title, Creator, Affiliation and Last Modified at the top.
- Data Collection.
- Documentation and Metadata.
- Lawful, Fair, and Responsible Use.
- Due Diligence for Data Partnerships.
- Open Data, Transparency, and Accountability.
- Data Retention, Storage, and Minimization.
- Protect Sensitive Data and Contexts.
- Data Quality.
- Data Security.
A Definitions page at the end explains terms such as biometric, breach, offshore (data), protected personal information (PPI) and the four data categories. The form tells you to complete it while viewing DOL Appendix B: Data Stewardship Guidance for Vendors.
Who needs to file 200-029?
The form says that the DOL project lead and the vendor are responsible for completing it. It is used as part of the procurement process for DOL, so the people who complete it are vendors whose product will collect, store or process DOL data, working with the DOL project lead.
The form names one main point of contact, who is responsible for the data management. That person's name, email and 10-digit phone number go in the Contact Information block.
Some questions apply only in certain cases. The cyber liability insurance question applies if your product collects or stores Protected Personal Information from DOL. The "If yes, where" line applies only if you will offshore DOL data. The "If yes, describe" lines apply only if you answer Yes on biometrics, on machine learning or automated decisions, or on ISO 8000.
The form does not describe any use outside DOL procurement. Questions go to [email protected].
When to file 200-029
Complete the Data Management Plan when DOL asks for it as part of its procurement process. The form states that it provides the required information for that process, and it prints no separate due date or renewal cycle.
The form also asks you to commit to later actions: providing documentation to DOL's Research and Analytics Office and Data Stewardship Program when data changes occur, keeping security certifications current throughout the working relationship, and informing DOL within 24 hours of discovering any data breach or data incident. Confirm the response timing for the plan itself with the DOL project lead or at [email protected].
Documents you need
- DOL Appendix B: Data Stewardship Guidance for Vendors: not attached, but the form says to view it while completing the questions.
- Data dictionary, if you consent to share it in the Documentation and Metadata section.
- Metadata schema, if you select it among the items you will share.
- Data migration plan including roadmaps or crosswalks, if you select it.
- Retirement or retention plan for legacy system, if you select it.
- Data flow diagram(s) showing how and where all data is exchanged and stored, if you select it.
- Privacy policy, data security policy, data destruction policy or plan, and data incident response or breach plan, each only if you select it.
- Documentation on end-of-life migration of DOL data back to DOL systems, if you select it.
- Any other documentation you list on the "Other:" line of the Documentation and Metadata section.
How to fill out 200-029
Enter title, creator and affiliation
At the top, fill in Title, Creator, Affiliation and Last Modified. Have the DOL project lead involved, since the form says the project lead and the vendor complete it together.
Add the main point of contact
Under Contact Information, enter the Name, Email and 10-digit phone number of the person responsible for the data management.
Answer the Data Collection questions
Questions 1 to 3 ask what data is collected and why and when, how it is collected and who supplies it. In question 4 mark Category 1, 2, 3 or 4 data, and in question 5 list the categories encrypted at rest and in transit.
Complete Documentation and Metadata
Describe the documentation that will accompany the product and select every item you will share, such as a data dictionary or data flow diagram. Answer the Yes/No question on documenting data changes and explain how DOL can fully extract its data during and at the end of the contract.
Address Lawful, Fair, and Responsible Use
List the privacy mandates and laws that apply, who outside your organization uses the data and why, and where primary and backup servers are located. Answer Yes or No on reading DOL's privacy and security requirements and on offshoring, with the location if Yes.
Answer Due Diligence for Data Partnerships
Mark Yes or No on the Data Sharing Policy, audit cooperation, annual self-assessment and timely deliverables, and describe the training your personnel take for category 2-4 data.
Cover Open Data and Accountability
Answer the Yes/No questions on full data extraction, a separate reporting environment, nightly synchronization, API lists and sharing public data. Check the three API sub-questions if your solution supports APIs.
Describe retention and storage controls
Explain how your product manages retention and deletes data per the State Archives' schedules and the DOL Records Retention Schedule. Answer Yes or No on litigation holds, public records requests and transfer to the State Archives.
Answer the sensitive data questions
State whether your product uses biometrics or machine learning and AI for automated decisions, describing each if Yes. Then describe your controls protecting category 2, 3 and 4 data.
Complete the Data Quality questions
Answer the ISO 8000 question, explain how you evaluate DOL's eight data quality dimensions, and state whether you can provide data suited to a multi-program data warehouse.
Finish the Data Security section
Explain how you manage access and security, list your standards and certifications, and answer Yes or No on the security design review, current certifications, secure protocols, 24-hour breach notice and cyber liability insurance. Then explain how you restrict access to shared data.
Review and download the completed PDF
Check that every question is answered and that no vulnerability information appears. Download or print the completed PDF from FillingPDF and deliver it as the DOL project lead directs.
How to submit 200-029
The form prints no mailing address, portal or upload channel. It is provided as part of the procurement process for the Department of Licensing (DOL), so return it the way the DOL project lead directs. Questions about the form go to [email protected].
DOL's forms page recommends downloading PDF forms to your computer or network drive and opening them with the latest version of Adobe Reader before filling them out, because completing forms in a web browser can cause formatting issues.
Do not include any information on vulnerabilities to your data security environment in the document; the form says so at the question on data storage locations.
FillingPDF lets you fill out and download the PDF; submission follows the channels the DOL project lead gives you.
Common mistakes to avoid
- Completing the form without viewing DOL Appendix B: Data Stewardship Guidance for Vendors, which the form says to use while answering.
- Describing vulnerabilities in your data security environment; the form says not to include any such information.
- Leaving the Category 1 to 4 selections unmarked, or not stating which categories are encrypted at rest and in transit when Category 3 and Category 4 data require both.
- Entering the Contact Information as a general office rather than the main point of contact responsible for data management, with a 10-digit phone number.
- Answering Yes to the offshoring question but leaving the "If yes, where" line blank.
- Answering Yes to biometrics, machine learning or automated decisions, or ISO 8000 without completing the "If yes, describe" line.
- Skipping the storage question, which asks for the type of servers and the name, city and state of the secure data center for primary and backup servers.
- Selecting Yes on the 24-hour breach notification or audit cooperation questions without being able to meet them; the form asks you to commit.
Frequently asked questions
What is a data management plan on Form 200-029?
It is the Washington State Department of Licensing form that records how a vendor's product will manage DOL data across its lifecycle. DOL uses it in the procurement process, and its questions follow the Washington State Agency Privacy Principles.
Who completes the DOL Data Management Plan?
The DOL project lead and the vendor are responsible for completing it. The form names one main point of contact, who is responsible for the data management, and asks for that person's name, email and 10-digit phone number.
Can I fill out the data management plan online?
Yes. You can fill out the PDF online on FillingPDF and download or print it. FillingPDF is an independent service and does not send the form to DOL; you return it as the DOL project lead directs.
Who do I contact with questions about Form 200-029?
The form lists [email protected] for questions. It also tells you to view DOL Appendix B: Data Stewardship Guidance for Vendors while you complete the questions.
Which data categories require encryption on this form?
Category 3 and Category 4 data require encryption at rest and in transit, according to the form, which refers to the Encryption Standard. Question 5 of Data Collection asks which categories your product encrypts.
What does offshoring mean on the Data Management Plan?
The form defines offshore as the electronic or hard copy transmission, accessing, viewing, capturing images, storage or processing of protected personal information outside the United States. If you will offshore DOL data, answer Yes and say where.
How quickly must I report a data breach under this form?
The Data Security section asks whether you will inform DOL within 24 hours of discovery of any data breach or data incident. It is a Yes/No commitment on the form; the contract sets the binding terms.
Should I describe security weaknesses in my plan?
No. At the question on where data is stored, processed, collected and managed, the form says not to include any information on vulnerabilities to your data security environment in the document.
Ready to fill out 200-029?
Fill out 200-029 now