Center for Federal Accountability

What a system of records notice is, and what the Privacy Act requires it to contain

The Privacy Act requires every federal agency to publish a system of records notice in the Federal Register for each group of records it retrieves by a person's name or identifier. This explains what counts as a system of records, what the notice must contain, and when an agency must publish, change or withdraw one.

2026-10-29 · All federal agencies · Standard Interpretation

A system of records notice is a notice a federal agency publishes in the Federal Register to describe a group of records it keeps about individuals. The Privacy Act of 1974 requires the agency to publish "a notice of the existence and character of the system of records" when it establishes or revises the system (5 U.S.C. 552a(e)(4)). The notice tells the public what the system is, whose records are in it, what kinds of records it holds, who outside the agency may receive them, and how a person can see or correct their own record. Many of CFA's advisories on proposed rules turn on whether a current notice covers what an agency proposes to do.

## What counts as a system of records

The Act defines a system of records as "a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual" (5 U.S.C. 552a(a)(5)). A record is any item of information about an individual that contains their name or an identifier (5 U.S.C. 552a(a)(4)). An individual is a citizen of the United States or a lawfully admitted permanent resident (5 U.S.C. 552a(a)(2)).

Two parts of the definition decide most cases. The records must be about individuals: records about businesses fall outside the Act, and courts have split on records about people acting in a business capacity, such as sole proprietors. And the agency must actually retrieve the records by a personal identifier. The Justice Department's guidance on the Act explains that the ability to retrieve records that way is not enough. A file organized by contract number is generally not a system of records; a personnel file organized by employee name or Social Security number is.

The Act also reaches records kept by contractors. When an agency contracts for the operation of a system of records to carry out an agency function, the Act's requirements apply to that system (5 U.S.C. 552a(m)(1)).

## What the notice must contain

The Act lists nine items every notice must include (5 U.S.C. 552a(e)(4)(A) through (I)): the system's name and location; the categories of individuals covered; the categories of records; each routine use, including the categories of users and the purpose of each use; the agency's policies and practices for storing, retrieving, controlling access to, keeping and disposing of the records; the title and business address of the official responsible for the system; how a person can learn whether the system holds a record about them; how a person can get access to that record and contest its contents; and the categories of sources of the records.

OMB Circular A-108 sets a standard template that adds further sections, including the system number, security classification, legal authority, purpose, safeguards, any exemptions claimed and the history of earlier notices for the same system.

A routine use is a disclosure outside the agency "for a purpose which is compatible with the purpose for which it was collected" (5 U.S.C. 552a(a)(7)). It is one of the exceptions to the Act's general rule that an agency may not disclose a record without the individual's written consent (5 U.S.C. 552a(b)(3)). Each routine use must be listed in the notice.

## When an agency must publish, change or withdraw a notice

The notice must be published before the agency begins operating the system (OMB Circular A-108, section 6). The system may operate once the notice is published, but a new or changed routine use cannot take effect until the public has had at least 30 days to comment on it (5 U.S.C. 552a(e)(11)).

Before publication, the agency must report a new or significantly modified system to OMB and to the House and Senate committees that oversee government operations (5 U.S.C. 552a(r)). Under OMB Circular A-108, section 7, that report must be sent at least 30 days before the agency submits the notice to the Federal Register.

OMB Circular A-108, section 6, gives examples of significant changes that require a modified notice, and says the list is not complete: a substantial increase in the number, type or categories of individuals covered; an expansion of the types or categories of records; a change in the system's scope or purpose; a change in the agency's legal authority for the system; a change in how the system operates or where it is located that affects how people exercise their Privacy Act rights; a change in equipment, storage or procedures that creates substantially greater access to the records; a new routine use, or a significant change to one, that makes the information more widely available; and a new rule exempting the system from parts of the Act.

When an agency retires a system, it publishes a notice of rescindment. OMB Circular A-108 also directs agencies to review their notices to confirm they still describe the system accurately, and makes the Senior Agency Official for Privacy accountable for the agency's notices.

A system already covered by an existing notice does not need a separate one. The Office of Personnel Management publishes government-wide notices, such as OPM/GOVT-1 for general personnel records, that employing agencies across the government rely on.

## Penalties and remedies

An agency officer or employee who willfully maintains a system of records without meeting the notice requirement commits a misdemeanor and may be fined up to $5,000 (5 U.S.C. 552a(i)(2)). If an agency refuses to correct a record, the individual may request review within the agency (5 U.S.C. 552a(d)(3)). If an agency refuses access to a record or refuses to correct it, the individual may sue in federal district court (5 U.S.C. 552a(g)(1)).

## How the notice relates to other privacy documents

A Privacy Act statement is a separate notice the agency must give a person at the moment it asks them for information. It states the authority for the request, the principal purpose, the routine uses, whether providing the information is mandatory or voluntary, and the effects of not providing it (5 U.S.C. 552a(e)(3)).

A privacy impact assessment is required by section 208 of the E-Government Act of 2002. It analyzes how a system collects and protects personally identifiable information. OMB's guidance on section 208 (M-03-22) applies to many systems whether or not they are systems of records.

An agency that wants to exempt a system from parts of the Act must publish a rule under 5 U.S.C. 552a(j) or (k). Three recent CFA advisories describe proposed exemptions of this kind.

## How to find a notice

Every system of records notice is published in the Federal Register and can be found at federalregister.gov by searching for the agency name and "system of records." Most agencies also list their current notices on their privacy program pages. CFA's report on system of records notices, under Reports on this site, tracks the notices agencies have published.

Authorities