2 

challenges when protecting privacy. To help ensure that agencies are able to answer these 

complex questions and meet the new challenges while delivering on agency missions, each 

agency shall now reassess the structure and resources of its privacy program and the agency’s 

current SAOP designation. 

Designation of the SAOP

The head of the agency is ultimately responsible for ensuring that privacy interests are 

protected and that PII is managed responsibly within the agency. To ensure that agencies 

effectively carry out the privacy-related functions described in law and OMB policies, Executive 

Order 13719 requires the head of each agency to designate or re-designate an SAOP who has 

agency-wide responsibility and accountability for the agency’s privacy program. The role and 

designation of the SAOP shall be governed by the following requirements: 

• Position. The SAOP shall be a senior official at the Deputy Assistant Secretary or 

equivalent level who serves in a central leadership position at the agency, has visibility

into relevant agency operations, and is positioned highly enough within the agency to 

regularly engage with other agency leadership, including the head of the agency.4

• Expertise. The SAOP shall have the necessary skills, knowledge, and expertise to lead

and direct the agency’s privacy program and carry out the privacy-related functions 

described in law and OMB policies.

• Authority. The SAOP shall have the necessary authority at the agency to lead and direct

the agency’s privacy program and carry out the privacy-related functions described in law 

and OMB policies.

When determining whom to designate as the SAOP, agencies should be aware of 

applicable law.

5

 Moreover, agencies should recognize that privacy and security are independent 

and separate disciplines. While privacy and security require coordination, they often raise 

distinct concerns and require different expertise and different approaches. The distinction 

between privacy and security is one of the reasons that the Executive Branch has established a 

Federal Privacy Council independent from the Chief Information Officers Council.

 

4 In cases where the head of an agency wishes to designate an official who meets the other criteria in this 

Memorandum but who is not at the Deputy Assistant Secretary or equivalent level, the agency shall consult with 

OMB prior to making the designation.

5 See, e.g., Consolidated Appropriations Act of 2005, Pub. L. No. 108-447, § 522, 118 Stat. 2809, 3268 (2004); 

Implementing Recommendations of the 9/11 Commission Act of 2007, Pub. L. No. 110-53, § 803, 121 Stat. 266, 

360, 42 U.S.C. § 2000ee-1(f) (2007); Homeland Security Act of 2002, Pub. L. No. 107-296, § 222, 116 Stat. 2135, 

2155, 6 U.S.C. § 142 (2002); and Violence Against Women and Department of Justice Reauthorization Act of 2005, 

Pub. L. No. 109-162, § 1174, 119 Stat. 2960, 3124 (2006).
3 

Responsibilities of the SAOP

Each agency shall develop, implement, document, maintain, and oversee an agency-wide 

privacy program that includes people, processes, and technologies.6

 The privacy program shall 

be led by an SAOP who is responsible for ensuring compliance with applicable privacy 

requirements, developing and evaluating privacy policy, and managing privacy risks consistent 

with the agency’s mission. 

• Policy Making. The SAOP shall have a central policy-making role in the agency’s 

development and evaluation of legislative, regulatory, and other policy proposals that 

have privacy implications. In this role, the SAOP shall ensure that the agency considers 

and addresses the privacy implications of all agency regulations and policies, and shall 

lead the agency’s evaluation of the privacy implications of legislative proposals, 

congressional testimony, and other materials pursuant to OMB Circular No. A-19.7

• Compliance. The SAOP shall have a central role in overseeing, coordinating, and 

facilitating the agency’s privacy compliance efforts. In this role, the SAOP shall ensure 

that the agency complies with applicable privacy requirements in law, regulation, and 

policy. Relevant authorities include, but are not limited to, the Privacy Act of 1974;8 the 

Paperwork Reduction Act of 1995;9 the E-Government Act of 2002;10 the Health 

Insurance Portability and Accountability Act of 1996;11 OMB Circular A-130;12 Privacy 

Act Implementation: Guidelines and Responsibilities;

13 OMB Circular A-108;14 OMB’s 

Final Guidance Interpreting the Provisions of Public Law 100-503, the Computer 

Matching and Privacy Protection Act of 1988;15 and OMB Guidance for Implementing 

the Privacy Provisions of the E-Government Act of 2002.16

 

6 For information about the general requirements for agency privacy programs, see OMB Circular No. A-130, 

Managing Information as a Strategic Resource (July 28, 2016), available at

https://www.whitehouse.gov/sites/default/files/omb/assets/OMB/circulars/a130/a130revised.pdf. 7 See OMB Circular No. A-19, Legislative Coordination and Clearance (Sept. 20, 1979), available at 

https://www.whitehouse.gov/omb/circulars_a019/. 8 5 U.S.C. § 552a.

9 44 U.S.C. chapter 35.

10 44 U.S.C. § 3501 note. 11 Pub. L. No. 104-191. 12 OMB Circular No. A-130, Managing Information as a Strategic Resource (July 28, 2016), available at

https://www.whitehouse.gov/sites/default/files/omb/assets/OMB/circulars/a130/a130revised.pdf. 13 Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948 (July 9, 1975), available at

http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 14 At the time of the issuance of this Memorandum, OMB Circular No. A-108 is forthcoming. Agencies shall 

continue to apply the requirements in Appendix I of the 2000 version of Circular No. A-130 regarding review, 

reporting, and publication pertaining to the Privacy Act until OMB issues Circular A-108.

15 Final Guidance Interpreting the Provisions of Public Law 100-503, the Computer Matching and Privacy 

Protection Act of 1988, 54 Fed. Reg. 25,818 (June 19, 1989), available at

https://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/final_guidance_pl100-503.pdf. 16 OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act 

of 2002 (Sept. 26, 2003), available at http://www.whitehouse.gov/omb/memoranda_m03-22.
4 

• Risk Management. The SAOP shall manage privacy risks associated with any agency 

activities that involve the creation, collection, use, processing, storage, maintenance, 

dissemination, disclosure, and disposal of PII by programs and information systems. The 

SAOP’s review of privacy risks shall begin at the earliest planning and development 

stages of agency actions and policies that involve PII, and continue throughout the life 

cycle of the programs or information systems. Appropriately managing privacy risks 

may require agencies to take steps beyond those required in law, regulation, and policy. 

If the SAOP’s agency is listed in Section 4(b) of Executive Order 13719 or designated by 

the Chair of the Federal Privacy Council, the SAOP shall serve on the Federal Privacy Council.17

At the discretion of the SAOP and consistent with applicable law, other qualified agency 

personnel may perform particular privacy functions that are assigned to the SAOP. In addition, 

agencies shall consider establishing privacy programs and privacy officials at sub-agencies, 

components, or programs where there is a need for privacy leadership in support of the SAOP. 

In all cases, however, the SAOP shall retain responsibility and accountability for the agency’s 

privacy program, including privacy functions performed by officials at sub-agencies, 

components, or programs. 

Resources of the SAOP and Privacy Program 

Agencies shall identify and plan for the financial, human, information, and infrastructural 

resources that are necessary to carry out the privacy-related functions described in law and OMB 

policies. When assessing the resource needs of the SAOP and the privacy program, the agency 

shall consider factors such as the agency’s: 

• Size and structure, including the agency’s geographic presence; 

• Mission, and the volume, sensitivity, and uses of PII to support that mission; 

• Privacy risks associated with the creation, collection, use, processing, storage, 

maintenance, dissemination, disclosure, and disposal of PII; and 

• Information resources, including planned investments in information technologies that 

will be used to create, collect, use, process, store, maintain, disseminate, disclose, and 

dispose of PII. 

Implementation

Within 60 days of the issuance of this Memorandum, the head of each agency shall assess

the management, structure, and operation of the agency’s privacy program, and, if necessary,

designate or re-designate a new official to serve as the SAOP. The agency shall report the name, 

title, and contact information of the SAOP to OMB on the MAX website of the Federal Privacy 

Council and shall update this information whenever changes occur. In addition, OMB will ask 

the agency to provide additional information about the role and designation of the SAOP, and the 

structure and resources of the agency’s privacy program, as part of annual reporting under the 

Federal Information Security Modernization Act of 2014.18

 

17 See supra note 1.

18 44 U.S.C. chapter 35.
5 

This Memorandum rescinds and replaces OMB Memorandum M-05-08, Designation of 

Senior Agency Officials for Privacy (Feb. 11, 2005). Agencies should consult OMB Circular No. 

A-130 for definitions of terms used in this Memorandum.19 If agencies have specific questions 

about this Memorandum, they may contact OMB at privacy-oira@omb.eop.gov. 

Agencies shall implement this Memorandum consistent with applicable law. This 

Memorandum is not intended to, and does not, create any right or benefit, substantive or 

procedural, enforceable at law or in equity by any party against the United States, its 

departments, agencies, or entities, its officers, employees or agents, or any other person. 

 

19 OMB Circular No. A-130, Managing Information as a Strategic Resource (July 28, 2016), available at

https://www.whitehouse.gov/sites/default/files/omb/assets/OMB/circulars/a130/a130revised.pdf.