; (3) implement safeguards designed to control the risks identified in the covered entity's or service provider's risk assessment, and regularly assess the effectiveness of those safeguards; (4) maintain reasonable procedures to require that third parties and service providers to whom personal data is transferred by the covered entity or service provider involved maintain reasonable administrative, technical, and physical safeguards designed to protect the security and confidentiality of personal data; and (5) evaluate and make reasonable adjustments to the safeguards in light of material changes in technology, internal or external threats to personal data, and the changing business arrangements or operations of the covered entity or service provider. 7. Accountability (a) Definition of applicable entity In this section, the term applicable entity means a covered entity or service provider that, on an annual basis, conducts collection and processing of— (1) the personal data of more than 20,000,000 individuals; or (2) the sensitive personal data of more than 1,000,000 individuals. (b) Privacy officer (1) Designation Each applicable entity shall— (A) designate an employee of the applicable entity, or an individual who is a contractor of the applicable entity, to be the privacy officer responsible for overseeing its policies and practices relating to the collection and processing of personal data; and (B) ensure that the privacy officer is involved in all issues relating to the privacy and security of personal data. (2) Conflicts of interest The privacy officer may perform other tasks and duties for the applicable entity, but only to the extent that the applicable entity ensures that the performance of those other tasks or duties does not present a conflict of interest with respect to the duties and responsibilities of the privacy officer role. (3) Responsibilities The privacy officer shall— (A) inform and advise the applicable entity of the obligations of the applicable entity under this Act