whatbindsCheck your order

Clauses · FAR · Cybersecurity

FAR 52.224-1 Privacy Act Notification

Does the regulation require it to flow down?

No

No flow-down mandate: 24.104 addresses the contracting officer, and the clause text is two sentences of notice with no subcontracts paragraph. The mandate lives in its partner 52.224-2, whose paragraph (c) requires including that clause, including paragraph (c) itself, in all subcontracts awarded under the contract that require the design, development, or operation of such a system of records. Primes flow -1 down because it travels as a pair with -2 and because the notice is the predicate for the criminal-penalty warning in -2

A clause can reach your subcontract without a mandate. Once it is in your document, it is a contract term all the same. The missing mandate is a fact about the regulation. It is not a ruling on your order.

Checked against acquisition.gov on 2026-08-05 · edition Apr 1984 · base v0.9.3 Read the text ↗

What it makes you produce

One item for your checklist.

  1. Nothing to send, ever

    There is no paperwork here. It is a rule you follow while you perform the work.

    • Nothing to send. The Privacy Act of 1974 and the agency rules under it govern the records work from the day the order starts, and a violation of the Act can carry criminal penalties

      Owed when the work has you designing, developing or operating a system of records on individuals to accomplish an agency function

      FAR 52.224-1

When it is used

FAR 24.104: when the design, development, or operation of a system of records on individuals is required to accomplish an agency function, the contracting officer inserts BOTH 52.224-1 (a) and 52.224-2 (b). No dollar threshold and no commercial or COTS exception in the prescription. The test is narrow and often misread: it is not 'you touch personal data' — it is that you design, develop, or operate a SYSTEM OF RECORDS on individuals for the agency, as defined by the Privacy Act of 1974 (5 U.S.C. 552a). Handling employee data of your own, or incidental PII, does not meet it; running an agency database of records retrieved by personal identifier does.

Read closely

This clause is the notice; the duties travel with it. 52.224-2 carries the obligations, the treatment of your employees under the Act's criminal provisions, and the flow-down. 52.224-3 carries the training and the records.

The 2 templates that name it, with the line
105Raytheon TC-002 — Supplement 1: Government Contract Provisions from the FARRTXline 7289AAR Government Services — C40 Purchase Order General Provisions, Non-Commercial Firm Fixed Price Items or ServicesAAR Corpline 3031

Source: acquisition.gov, FAR 52.224-1, FAR 24.104 and FAR 52.224-2(c) (verified 2026-08-05); RFO Part 24 treatment via the VA class deviation adopting the FAR Council model text, effective 2025-11-03

This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.