The university at which the GSDAP applicant was enrolled when the data was originally provided is ultimately accountable for protecting the data and complying with the terms and conditions stated in Section 8 of the Non-Disclosure/Confidentiality Agreement.