DEFENSE LOGISTICS AGENCY 

Privacy Safeguards and Responsibilities Certification 

Version for Contractors 

(Prior to Account Access at DLA and Annual Refresher) 

This is to certify that: 

1. I have received Initial / Refresher training on my privacy responsibilities. 

2. I understand that I am responsible for safeguarding personal information1 (also referred to as 

“personally identifiable information”) that I may have access to incident to duties I have been 

contracted by DLA to perform. 

3. I understand that I may be subject to penalties as outlined in 5 U.S.C. 552a, The Privacy Act of 1974, 

as amended,2 32 C.F.R. Part 310, Department of Defense Privacy Program, 32 C.F.R. Part 323, 

Defense Logistics Agency Privacy Program, and 48 C.F.R. Parts 24, 39, 52.224 and 52.239, for: 

a. failure to properly safeguard personal information / personally identifiable information; 

b. improperly collecting, using, maintaining, or disclosing such information; and 

c. failure to report any known or suspected loss or the unauthorized disclosure of such information. 

4. I will conduct myself consistent with established DOD Privacy Rules of Conduct below so that 

personal information to be stored in a Privacy Act System of Records shall only be collected, 

maintained, used, and disseminated, as authorized by 5 U.S.C. 552a, The Privacy Act of 1974, as 

amended, 32 C.F.R. Part 310, Department of Defense Privacy Program, and 32 C.F.R. Part 323, 

Defense Logistics Agency Privacy Program.

5. DOD Privacy Rules of Conduct 

a. As a contractor with access to the DLA network, I will: 

i. Take such actions, as considered appropriate, to ensure that any personal information 

contained in a system of records, of which I have access to, shall be protected so that the 

security and confidentiality of the information shall be preserved. 

ii. Not disclose any personal information contained in any system of records, except as 

authorized by 5 U.S.C. 552a, The Privacy Act of 1974, as amended, or other applicable 

laws or regulations. Willfully making such disclosure when knowing that disclosure is 

prohibited, I will be subject to possible criminal penalties and/or contract penalties. 

iii. Report any unauthorized disclosures of personal information from a system of records or 

the maintenance of any system of records not authorized by 5 U.S.C. 552a, The Privacy 

Act of 1974, as amended, 32 C.F.R. Part 310, Department of Defense Privacy Program, 

 

1

 Personal Information. Information about an individual maintained by an agency, including, but not limited to, education, financial 

transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an 

individual's identity, such as their name, social security number, date and place of birth, mother's maiden name, biometric records, etc., 

including any other personal information which is linked or linkable to an individual. Such information is also known as “personally 

identifiable information (PII).” 

2

 5 U.S.C. 552a, The Privacy Act of 1974, as amended, subsection (i) Criminal Penalties.

(1) Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency 

records which contain individually identifiable information the disclosure of which is prohibited by this section or by rules or 

regulations established there under, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the 

material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than 

$5,000. 

(2) Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements of 

subsection (e)(4) of 5 U.S.C. 552a shall be guilty of a misdemeanor and fined not more than $5,000. 

(3) Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false 

pretenses shall be guilty of a misdemeanor and fined not more than $5,000. 
and 32 C.F.R. Part 323, Defense Logistics Agency Privacy Program, or any suspected loss, 

theft or compromise of personally identifiable information immediately to my contracting 

officer or contracting officer representative and the DLA Information Technology 

Operations Center (ITOC) at 1-877-352-6366. 

b. If I am a System Manager3 for a DLA Privacy Act System of Records4, I will: 

i. Ensure that all personnel with access to the system of records or those who develop or 

supervise procedures for handling records in the system of records shall be aware of their 

responsibilities and are properly trained to safeguard personal information being collected 

and maintained under the DLA Privacy Program. 

ii. Prepare promptly any required new, amended, or altered system notices for the system of 

records and submit them through the DLA HQ Privacy Office to the Defense Privacy 

Office for publication in the Federal Register. 

iii. Not maintain any official files on individuals, which are retrieved by name or other 

personal identifier, without first ensuring that a notice for the system of records has been 

published in the Federal Register. Willfully maintaining a system of records without 

meeting the publication requirements, as prescribed by 5 U.S.C. 552a, The Privacy Act of 

1974, as amended, 32 C.F.R. Part 310, Department of Defense Privacy Program, and 32 

C.F.R. Part 323, Defense Logistics Agency Privacy Program, I will be subject to possible 

criminal penalties and/or contract actions. 

___________________________________ _______________________________ 

Printed Name Date Signed 

______________________________________ __________________________________ 

Signature Contract Number 

INSTRUCTIONS: Keep a copy of this certification for yourself and give a signed/dated copy to 

your employer, and to the contracting officer or contracting officer 

representative. 

 

3

 System Manager. The official who is responsible for the operation and management of a Privacy Act system of records. 

4

 System of Records. A group of records under the control of DLA, or maintained by a contractor on behalf of DLA, from which 

personal information is retrieved by the individual’s name or by some other identifying number, symbol, or other identifying particular 

assigned to an individual.