Subpart 24.3 - Privacy Training

Parent topic: Part 24 - Protection of Privacy and Freedom of Information

24.301 Privacy training.

(a) Contractors are responsible for ensuring that initial privacy training, and annual privacy training

thereafter, is completed by contractor employees who-

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle

personally identifiable information on behalf of the agency; or

(3) Design, develop, maintain, or operate a system of records (see FAR subpart 24.1 and 39.105).

(b) Privacy training shall address the key elements necessary for ensuring the safeguarding of

personally identifiable information or a system of records. The training shall be role-based, provide

foundational as well as more advanced levels of training, and have measures in place to test the

knowledge level of users. At a minimum, the privacy training shall cover-

(1) The provisions of the Privacy Act of 1974 (5 U.S.C. 552a), including penalties for violations of the

Act;

(2) The appropriate handling and safeguarding of personally identifiable information;

(3) The authorized and official use of a system of records or any other personally identifiable

information;

(4) The restriction on the use of unauthorized equipment to create, collect, use, process, store,

maintain, disseminate, disclose, dispose, or otherwise access personally identifiable information;

(5) The prohibition against the unauthorized use of a system of records or unauthorized disclosure,

access, handling, or use of personally identifiable information; and

(6) Procedures to be followed in the event of a suspected or confirmed breach of a system of records

or unauthorized disclosure, access, handling, or use of personally identifiable information (see Office

of Management and Budget guidance for Preparing for and Responding to a Breach of Personally

Identifiable Information).

(c) The contractor may provide its own training or use the training of another agency unless the

contracting agency specifies that only its agency-provided training is acceptable (see 24.302(b)).

(d) The contractor is required to maintain and, upon request, to provide documentation of

completion of privacy training for all applicable employees.

(e) No contractor employee shall be permitted to have or retain access to a system of records,

create, collect, use, process, store, maintain, disseminate, disclose, or dispose, or otherwise handle

personally identifiable information, or design, develop, maintain, or operate a system of records,

unless the employee has completed privacy training that, at a minimum, addresses the elements in

paragraph (b) of this section.
24.302 Contract clause.

(a) The contracting officer shall insert the clause at FAR 52.224-3, Privacy Training, in solicitations

and contracts when, on behalf of the agency, contractor employees will-

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle

personally identifiable information; or

(3) Design, develop, maintain, or operate a system of records.

(b) When an agency specifies that only its agency-provided training is acceptable, use the clause

with its Alternate I.