§49.16. Privacy and confidentiality requirements of swap data repositories. — Inbound Citations

(2) Prior to a swap data repository granting access to SDR data or SDR information to a third-party service provider, the third-party service provider and the swap data repository shall execute a confidentiality agreement setting forth minimum confidentiality procedures and permissible uses of the SDR data and SDR information maintained by the swap data repository that are equivalent to the privacy procedures for swap data repositories outlined in § 49.16.

(2) Each swap data repository shall establish governance arrangements that are well-defined and include a clear organizational structure with consistent lines of responsibility and effective internal controls, including with respect to administration, accounting, and the disclosure of confidential information. § 49.22 of this part contains rules on internal controls applicable to administration and accounting. § 49.16 of this part contains rules on internal controls applicable to the disclosure of confidential information.

(d) A swap data repository shall maintain a business continuity-disaster recovery plan and business continuity-disaster recovery resources, emergency procedures, and backup facilities sufficient to enable timely recovery and resumption of its operations and resumption of its ongoing fulfillment of its duties and obligations as a swap data repository following any disruption of its operations. Such duties and obligations include, without limitation, the duties set forth in §§ 49.10 through 49.18, 49.23, and the core principles set forth in §§ 49.19 through 49.21 and §§ 49.25 through 49.27, and maintenance of a comprehensive audit trail. The swap data repository's business continuity-disaster recovery plan and resources generally should enable resumption of the swap data repository's operations and resumption of ongoing fulfillment of the swap data repository's duties and obligation during the next business day following the disruption. A swap data repository shall update its business continuity-disaster recovery plan and emergency procedures at a frequency determined by an appropriate risk analysis, but at a minimum no less frequently than annually.

(d) The swap data repository's policies and procedures reasonably designed to protect the privacy of any and all SDR data that the swap data repository receives from a swap execution facility, designated contract market, or reporting counterparty, as described in § 49.16;

(4) All functions reserved to the Commission in § 49.16.