Clauses · FAR · Cybersecurity
FAR 52.224-3 Privacy Training
Does the regulation require it to flow down?
Yes
(f): in all subcontracts where sub employees will have access to a system of records or will handle PII
- Form
- substance, including (f) itself
- Reaches
- all tiers
Checked against acquisition.gov on 2026-08-04 · edition JAN 2017 (Basic, Alt I JAN 2017) · base v0.9.3 Read the text ↗
What it makes you produce
2 items for your checklist, slowest first.
A program you have to be running
You are either running it or you are not, and what the prime asks for is the date it started.
- 52.224-3(b)
Initial and annual role-based privacy training, with a test of what was learned
Owed when an employee will have access to a system of records, handle personally identifiable information, or design, develop, maintain or operate a system of records
Something you write
Days to weeks, and nobody outside your company has to agree to it.
- 52.224-3(d)
The completion records for that training
Owed when the contracting officer requests them
When it is used
Contracts where contractor employees have access to a system of records, handle personally identifiable information (PII), or design/develop/maintain/operate an agency system of records. No dollar threshold. Alt I: only training provided by the agency itself counts.
Read closely
Paragraph (e) is the gate a buyer checks first: nobody reaches the records or the data before the training is finished. Agency-developed training satisfies the content list at (c). Where the order names Alternate I the agency provides the course itself, initially and each year after, which moves this from a program you build to a course somebody else has to give you on their calendar — the records still stay yours.
The 16 templates that name it, with the line
Source: acquisition.gov, FAR 52.224-3; 52.244-6 (Oct 2025) and 52.212-5 (MAR 2026) (verified 2026-08-04)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.