Clauses · FAR · Cybersecurity
FAR 52.224-2 Privacy Act
Does the regulation require it to flow down?
Yes
(a)(3): in all subcontracts under the contract that require the design, development, or operation of a system of records
- Form
- verbatim, including (a)(3) itself; in addition (a)(2) requires repeating the Privacy Act notification in every solicitation and resulting subcontract
- Reaches
- all tiers
Checked against acquisition.gov on 2026-08-04 · edition APR 1984 · base v0.9.3 Read the text ↗
What it makes you produce
One item for your checklist.
Nothing to send, ever
There is no paperwork here. It is a rule you follow while you perform the work.
- FAR 52.224-2
Nothing to send. The Act's rules on collecting, using, storing and disclosing records run for the whole of the work, with your employees treated as agency employees for the Act's criminal provisions
Owed when the work has you designing, developing or operating a system of records on individuals
When it is used
Contracts where the contractor designs, develops, or operates a system of records (a set of records about individuals retrievable by name/identifier, under agency control) to accomplish an agency function. No dollar threshold.
Read closely
Paragraph (a)(2) carries the Privacy Act notification into your own solicitations and subcontracts for the same work, and (a)(3) carries this clause itself. What makes it expensive is not paperwork but access control: restricting who touches the system, and being able to show it.
The 8 templates that name it, with the line
Source: acquisition.gov, FAR 52.224-2 (verified 2026-08-04)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.