{
  "node_id": "us-far-part-24-protection-privacy-freedom-information",
  "title": "FAR Part 24 - Protection of Privacy and Freedom of Information (Privacy Act of 1974, FOIA, Privacy Training, System of Records Operation)",
  "domain": "Public Sector & Government Procurement",
  "version": "1.0.0",
  "last_updated": "2026-06-02",
  "bluf": "Federal Acquisition Regulation (FAR) Part 24 implements two foundational information-rights statutes within federal procurement. Subpart 24.1 applies the Privacy Act of 1974 (5 USC 552a) and OMB Circular A-130 to contractors that design, develop, or operate a system of records on behalf of an agency to accomplish an agency function; contractors and their employees are 'considered employees of the agency for purposes of the criminal penalties' under FAR 24.102, meaning Privacy Act criminal sanctions (knowing and wilful unauthorised disclosure under 5 USC 552a(i)) apply to contractor personnel. Section 24.103 requires contracting officers to identify Privacy Act systems in the work statement, provide the agency's Privacy Act rules of conduct, and ensure the prescribed clauses are inserted. Section 24.104 prescribes clause 52.224-1 (Privacy Act Notification - in solicitations) and 52.224-2 (Privacy Act - in contracts) where contractor operation of a system of records is involved. Subpart 24.2 governs Freedom of Information Act (FOIA, 5 USC 552) interactions with procurement: competitive proposals are not disclosable under FOIA except when incorporated into the resulting contract; information obtained under FAR 15.403-3(b) is exempt; alternative dispute resolution communications are protected under 5 USC 574. Subpart 24.3 (Privacy Training) requires the contractor to provide initial and annual privacy training to any contractor employee who has access to a system of records, handles personally identifiable information, designs, develops, maintains, or operates a system of records, or has access to PII; clause 52.224-3 (Privacy Training, with Alternate I where agency-provided training is required) is prescribed. Training content must address Privacy Act provisions and penalties, appropriate handling and safeguarding practices, authorised use, prohibition on unauthorised disclosure, and breach response procedures per OMB breach response guidance.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "statutory_basis",
      "key_clauses_taxonomy",
      "criminal_penalty_extension",
      "training_requirements_taxonomy",
      "foia_procurement_carve_outs",
      "system_of_records_indicators",
      "industry_mapping"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "us-far-part-4-administrative-information-matters",
    "us-far-part-39-acquisition-information-technology",
    "us-far-part-7-acquisition-planning",
    "us-far-part-15-contracting-by-negotiation"
  ],
  "primary_citations_count": 7
}