A new clause has been added to the Federal Acquisition Regulation (FAR) that requires certain contractors to provide “privacy training” to their employees. FAR 52.224-3 “Privacy Training” will be included in all contracts awarded after January 19, 2017, that involve access to a system of records or the handling of Personally Identifiable Information (PII). A system of records refers to records under the control of an agency from which information is retrieved by the name of an individual or by some other form of identifier assigned to that individual. Such contractors will now have to provide privacy training to employees that includes the following parameters.
Employees must receive privacy training prior to starting their assignment and annually thereafter. If Alternate I to the clause is used, the Government will provide the training. Otherwise, the contractor may obtain the training from a source of their own choosing. Regardless of the source, the training must include the items below.
Contractors are required to generate and maintain documentation demonstrating compliance with the training requirement.