REMEMBER THESE RULES:

 Do not collect PII without proper official

 Do not disseminate PII to other members of the DLA workforce unless you

know that release is authorized and there is an official need to

 Do not place PII on shared drives, e-mail folders, multi-access calendars, or the

(eWorkplace, TMT, etc.) unless it is password protected or encrypted.

 Ensure access to information is limited to those officers and employees of

DLA who have a need for record in the performance of their official

 Never place PII on the

 Always encrypt and digitally sign email containing

TRAINING REQUIREMENTS

 All DLA employees must complete Information Assurance (IA) Awareness

Training prior obtaining access to DLA and/or DoD systems; and annually

 All DLA employees must complete DoD Personally Identifiable Information

Training to obtaining access to DLA and/or DoD systems; and annually

thereafter. maintain auditable certificates of training

 All DLA employees must sign the DLA Privacy Safeguards and Responsibilities



FOOTNOTES 

1. “Need to know” refers to those officers and employees of the agency

the records who have a need for the record in the performance of their duties. 

See 5

2. DLA Policies and Procedures When Personal Information is Lost, Stolen, or

3. Communication Tasking Order (CTO) 07-15 Task 1, Digital Signatures and

Implementation (HQ LAN Manager email dated June 5,

4. DoD 5400.11-R, “DoD Privacy Program,”

FOR MORE INFORMATION

Defense Logistics

FOIA / Privacy Act Office, ATTN: 

8725 John J. Kingman Road, Suite

Fort Belvoir, Virginia

COM (703) 767-6194, DSN 427 or

 (703) 767-5045, DSN

Email: 

Visit the web at: http://www.dla.mil/HQ/GeneralCounsel/FOIA.aspx

Revised March 2017

DEFENSE LOGISTICS

USERS GUIDE

D
DEFINITION OF PERSONAL INFORMATION / PII

Information about an individual maintained by DLA, including, but not limited to, 

education, financial transactions, medical history, and criminal or employment history 

and information which can be used to distinguish or trace an individual’s identity, 

such as their name, social security number, date and place of birth, mother’s maiden 

name, biometric records, etc., including any other personal information which is 

linked or linkable to an individual. Such information is also known as “personally 

identifiable information (PII).”

I F Y O U collect, maintain, use, or disseminate Personally Identifiable Information

(PII), it must be required to support a DLA function or program as authorized by law or

Executive Order. Whether you are working from your desk at the office or at home teleworking, it is your responsibility to:

 Ensure that the information entrusted to you in the course of your work is

kept secure

 Minimize the use of Social Security Number (SSNs) and other PII whenever

 Keep the information timely, accurate, relevant, and complete to the purpose

for which it

 Allow only those personnel with a “need to know” access to

P R O T E C T I V E M E A S U R E S

INFORMATION TECHNOLOGY (IT) EQUIPMENT

 Never leave your laptop

 Keep your laptop in a secure government space or secured under lock and

key when not

 Laptops and mobile electronic equipment must have full disk

 Mark all external drives or mobile media using DLA Form 1461, “Privacy Act

-

 If encryption is not available, do not create, store, or transmit PII on IT

 Ensure PII resides only on government furnished IT equipment. Never store

PII on

 Do not maintain PII on a public web site or electronic bulletin

EMAIL

 Email containing PII and email subject to the Privacy Act should be digitally signed and using DoD approved certificates available at 

https://dod411.gds.disa.mil.

2

 Double check that you have the correct email addresses and all recipients

have a “need know” before

 Double check your attachment to make sure you have selected the right

 Best business practice is to ensure the email subject line contains “FOUO

-- Sensitive” if the email contains PII, and place in the body of the

email the warning, “This email may contain information subject

to the Privacy Act of 1974 and For Official Use Only. Any misuse or

unauthorized disclosure may result in both civil criminal

PRINTED MATERIALS AND FAX MACHINES

 Verify printer location prior to sending a document containing PII to

the printer, promptly pick up all copies of the documents as soon as

they are

 Double check the fax number prior to transmitting documents with PII, and

ensure is standing by on the receiving end of the fax. Do not fax PII

to unattended fax

 Ensure all printed documents with PII are properly marked with “FOUO --

 When deemed appropriate, double wrap PII when sending it through the

mail. Seal material in an envelope, address the envelope to an authorized recipient, mark envelope “FOUO -- Privacy Sensitive,” and then

place that sealed envelope in a sealed, unmarked envelope addressed to the authorized

 Use DLA Form 1880, “Privacy Act Cover Sheet” when hand

documents containing

DISPOSAL

 Dispose of documents containing PII by making them unrecognizable by shredding, or

 Disposal methods are considered adequate if the personal data is rendered unrecognizable beyond

 Documents containing PII may also be placed in a burn bag for

 Ensure all hard drives are degaussed, properly marked, and accounted for prior

to turn

 Do not discard documents with PII in trash or recycle

 Destroy DLA records in accordance with the DLA Records

NETWORK SHARED DRIVES

 Do not store PII on shared drives without first encrypting or password protecting the

 Make sure that access controls are in place to limit access to files/folders that

contain PII those with a “need to know.” Check with the J-6 helpdesk for 

how to do this

REPORTING PII INCIDENTS

Immediately notify the DLA Information Technology Operations Center (ITOC) at 

1.877.352.6366 if you suspect or discover that PII has been lost, stolen, or compromised.

WHAT IS IDENTITY THEFT?

 Identity theft occurs when someone uses your personally identifying information, like name, Social Security number, or credit card number, without

your permission, to fraud or other



their identities stolen each

 If your PII is compromised, monitor financial accounts for suspicious

 If your identity is stolen, immediately contact the FTC for more

http://www.consumer.ftc.gov/features/feature-0014-identity-theft