; and (2) reporting structures to ensure that such certifying officers are involved in, and are responsible for, decisions that impact the entity’s compliance with this Act. (b) Requirements A certification submitted under subsection (a) shall be based on a review of the effectiveness of a covered entity’s internal controls and reporting structures that is conducted by the certifying officers no more than 90 days before the submission of the certification. 202. Privacy and data security officers; comprehensive privacy and data security programs; risk assessments and compliance (a) Privacy and data security officer A covered entity shall designate— (1) 1 or more qualified employees as privacy officers; and (2) 1 or more qualified employees (in addition to any employee designated under paragraph (1)) as data security officers. (b) Comprehensive privacy and data security programs, risk assessments, and compliance An employee who is designated by a covered entity as a privacy officer or a data security officer shall be responsible for, at a minimum— (1) implementing a comprehensive written data privacy program and data security program to safeguard the privacy and security of covered data throughout the life cycle of development and operational practices of the covered entity’s products or services; (2) annually conducting privacy and data security risk assessments, data hygiene, and other quality control practices; and (3) facilitating the covered entity’s ongoing compliance with this Act. 203. Service providers and third parties (a) Service providers A service provider— (1) shall not process service provider data for any processing purpose other than one performed on behalf of, and at the direction of, the covered entity that transferred such data to the service provider, except that a service provider may process data to comply with a legal obligation or the establishment, exercise, or defense of legal claims