whatbindsCheck your order

Clauses · FAR · Cybersecurity

FAR 52.224-2 Privacy Act

Does the regulation require it to flow down?

Yes

(a)(3): in all subcontracts under the contract that require the design, development, or operation of a system of records

Form
verbatim, including (a)(3) itself; in addition (a)(2) requires repeating the Privacy Act notification in every solicitation and resulting subcontract
Reaches
all tiers

Checked against acquisition.gov on 2026-08-04 · edition APR 1984 · base v0.9.3 Read the text ↗

What it makes you produce

One item for your checklist.

  1. Nothing to send, ever

    There is no paperwork here. It is a rule you follow while you perform the work.

    • Nothing to send. The Act's rules on collecting, using, storing and disclosing records run for the whole of the work, with your employees treated as agency employees for the Act's criminal provisions

      Owed when the work has you designing, developing or operating a system of records on individuals

      FAR 52.224-2

When it is used

Contracts where the contractor designs, develops, or operates a system of records (a set of records about individuals retrievable by name/identifier, under agency control) to accomplish an agency function. No dollar threshold.

Read closely

Paragraph (a)(2) carries the Privacy Act notification into your own solicitations and subcontracts for the same work, and (a)(3) carries this clause itself. What makes it expensive is not paperwork but access control: restricting who touches the system, and being able to show it.

The 8 templates that name it, with the line

Source: acquisition.gov, FAR 52.224-2 (verified 2026-08-04)

This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.