FAR 24.104—Contract clauses.
Plain-English Summary
FAR 24.104 tells contracting officers when they must include the Privacy Act clauses in solicitations and contracts. It applies when a contractor will design, develop, or operate a system of records on individuals in order to carry out an agency function, and it specifically requires insertion of FAR 52.224-1, Privacy Act Notification, and FAR 52.224-2, Privacy Act. In practice, this section is about making sure privacy obligations are built into the contract from the start whenever contractor performance will involve a Privacy Act system of records. The rule matters because these systems contain personal information about individuals, and the government must ensure the contractor understands notice, handling, and compliance requirements before work begins. For contracting officers, this is a mandatory clause-insertion requirement, not a discretionary best practice. For contractors, it signals that performance may involve sensitive personal data and that compliance obligations will be contractually enforceable.
Key Rules
Triggering condition
The clause requirement applies when the contract involves the design, development, or operation of a system of records on individuals. The system must be needed to accomplish an agency function, so the rule is tied to contractor work that supports government operations involving personal records.
Mandatory clause insertion
When the trigger is met, the contracting officer shall insert both required clauses in the solicitation and the contract. This is a mandatory action, not optional, and both clauses must be included.
Privacy Act Notification clause
FAR 52.224-1, Privacy Act Notification, must be included to alert offerors and contractors that the work involves a Privacy Act system of records. This clause helps ensure the contractor is aware of the privacy-related nature of the requirement before performance starts.
Privacy Act clause
FAR 52.224-2, Privacy Act, must also be included to impose the contract terms associated with Privacy Act compliance. This clause is the operative contract provision that governs contractor responsibilities for handling the system of records.
Responsibilities
Contracting Officer
Determine whether the requirement involves the design, development, or operation of a system of records on individuals for an agency function, and if so, insert FAR 52.224-1 and FAR 52.224-2 in both the solicitation and the resulting contract.
Agency
Identify requirements that involve Privacy Act systems of records and ensure acquisition planning and contract drafting account for the need to protect personal information and comply with Privacy Act requirements.
Contractor
Review the solicitation and contract for the Privacy Act clauses, understand that the work involves a system of records on individuals, and comply with the contractual privacy obligations during performance.
Practical Implications
This section is a clause-check item for acquisition planning: if the work touches a Privacy Act system of records, the clauses must be included up front.
A common pitfall is overlooking the requirement because the system is being developed or operated for the agency rather than by the agency itself; contractor involvement still triggers the clause requirement.
Another risk is failing to recognize that both design/development and operation can trigger the rule, not just full-scale system administration.
Contractors should treat the presence of these clauses as a signal that personal data handling, access controls, and privacy compliance will be scrutinized during performance.
Contracting officers should verify the requirement early, because omitting mandatory clauses can create compliance problems and may require contract modification later.
Official Regulatory Text
When the design, development, or operation of a system of records on individuals is required to accomplish an agency function, the contracting officer shall insert the following clauses in solicitations and contracts: (a) The clause at 52.224-1 , Privacy Act Notification. (b) The clause at 52.224-2 , Privacy Act.