13 CFR 130.380 – Client privacy
(a) SBDCs, including their contractors and other agents, are not permitted to disclose the Client’s name, address, email address, or telephone number, hereafter referred to as “client contact data,” of individuals or small businesses that obtain any type of assistance from the Program to any person or entity other than the SBDC, without the consent of the client, except in instances where:
(1) Court orders require the SBA Administrator to do so in any civil or criminal enforcement action initiated by a Federal or state agency; or
(2) The Administrator considers such a disclosure to be necessary for the purpose of conducting a financial audit of a center, not including those required under § 130.830, as determined on a case-by-case basis when formal requests are made by a Federal or state agency. Such formal requests must justify and document the need for individual client contact and/or program activity data to the satisfaction of the Administrator; or
(3) SBA requires client contact data to directly survey SBDC clients.
(b) SBDCs must provide an opportunity for a client to opt-in to allow the SBA to obtain client contact data. The SBA may use the permitted client contact data only to conduct surveys or studies that help stakeholders better understand how the services the client received affect their business outcomes over time. These surveys or studies would include, but not be limited to:
(1) Studying evaluation and performance management;
(2) Measuring the effect and economic or other impact of Agency programs;
(3) Assessing public and SBDC partner needs;
(4) Measuring customer satisfaction;
(5) Guiding program policy development;
(6) Improving grant-making processes; and
(7) Other areas SBA determines would be valuable to strengthen the SBDC Programs and/or enhance support for SBDC clients.
(c) SBDCs may not deny access to services to clients solely based on their refusal to provide consent as referenced in this section.
(d) Any reports or studies on program activity produced by SBDC and/or the Administrator, including their contractors and other agents, may not disseminate client contact data and must only report data in the aggregate. Individual client contact data will not be disclosed in any way that could individually identify a client.
(e) SBDCs and the Administrator, including their contractors and other agents, must obtain consent from the client prior to publishing media or reports that identify an individual client.
(f) This section does not restrict the Agency in any way from access and use of program performance data.