FAR 24.301—Privacy training.
Plain-English Summary
FAR 24.301 establishes the contractor privacy training requirement for employees who handle Privacy Act information or work with systems of records. It covers who must be trained, when training must occur, what the training must include, who may provide the training, what records the contractor must keep, and the access restriction that bars untrained employees from handling personally identifiable information (PII) or working on a system of records. In practice, this section is meant to reduce Privacy Act violations, prevent unauthorized disclosure or misuse of PII, and ensure contractor personnel understand how to safeguard sensitive government information. It also ties privacy training to breach response, so employees know what to do if a suspected or confirmed breach occurs. For contractors, this means privacy training is not optional or merely administrative; it is a condition for allowing covered employees to access or handle protected information. For contracting officers and agencies, it provides a compliance tool to ensure contractor personnel are trained to the same basic privacy standards expected of federal employees.
Key Rules
Covered employees must be trained
Contractors must ensure initial privacy training and annual refresher training for employees who access a system of records, handle PII on the agency’s behalf, or design, develop, maintain, or operate a system of records. The requirement applies based on job function, so any employee in one of these roles is covered.
Training must be role-based
Privacy training must be tailored to the employee’s duties and include both foundational and more advanced content as appropriate. It must also include a way to test whether users actually understand the material, not just complete it.
Minimum training topics are specified
At a minimum, training must cover the Privacy Act of 1974 and its penalties, proper safeguarding of PII, authorized and official use of systems of records and PII, restrictions on unauthorized equipment, prohibitions on unauthorized access or disclosure, and breach reporting procedures.
Contractor may use approved training sources
The contractor may provide its own training or use another agency’s training unless the contracting agency requires only its own agency-provided training. This gives flexibility, but the agency can limit that flexibility by contract or direction.
Training records must be maintained
The contractor must keep documentation showing completion of privacy training for all applicable employees and provide it upon request. This makes training a verifiable compliance obligation, not just an internal best practice.
No access without training
An employee may not be given or keep access to a system of records, or handle PII in any covered way, unless the employee has completed privacy training that meets the minimum requirements in paragraph (b). Training is therefore a prerequisite to access.
Responsibilities
Contractor
Ensure all covered employees complete initial privacy training before performing covered duties and complete annual refresher training thereafter. Maintain documentation of completion, provide it on request, and prevent untrained employees from accessing or handling PII or systems of records.
Contractor Employees
Complete required privacy training before accessing or handling PII or systems of records, follow the training in daily work, use only authorized equipment and authorized purposes, and follow breach reporting procedures if a suspected or confirmed incident occurs.
Contracting Officer / Contracting Agency
Specify if only agency-provided privacy training is acceptable, and use contract administration to ensure the contractor is meeting the training and documentation requirements. The agency may also rely on the training requirement to control access to sensitive information.
Agency Privacy / Security Officials
Provide or approve training content when the agency chooses to require its own training, and support breach response guidance and privacy compliance expectations for contractor personnel handling PII or systems of records.
Practical Implications
Contractors should treat privacy training as a gate before access, not a post-hire formality. If an employee has not completed qualifying training, that employee should not be given system access or assigned PII-handling duties.
Annual refresher training is mandatory, so one-time onboarding training is not enough. Contractors need a tracking process to avoid lapses and to document completion for audits, surveillance, or agency requests.
The content must be specific enough to cover the employee’s actual role. Generic privacy awareness training may be insufficient if it does not address system-of-records handling, unauthorized equipment restrictions, or breach procedures.
A common pitfall is assuming cybersecurity training alone satisfies this rule. FAR 24.301 requires privacy training focused on Privacy Act obligations and PII handling, which is distinct from general IT security training.
Contractors should be prepared to show proof of completion quickly. If records are missing or incomplete, the agency may question compliance and may require access suspension until training is verified.
Official Regulatory Text
(a) Contractors are responsible for ensuring that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who- (1) Have access to a system of records; (2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of the agency; or (3) Design, develop, maintain, or operate a system of records (see FAR subpart 24.1 and 39.105 ). (b) Privacy training shall address the key elements necessary for ensuring the safeguarding of personally identifiable information or a system of records. The training shall be role-based, provide foundational as well as more advanced levels of training, and have measures in place to test the knowledge level of users. At a minimum, the privacy training shall cover- (1) The provisions of the Privacy Act of 1974 ( 5 U.S.C. 552a ), including penalties for violations of the Act; (2) The appropriate handling and safeguarding of personally identifiable information; (3) The authorized and official use of a system of records or any other personally identifiable information; (4) The restriction on the use of unauthorized equipment to create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise access personally identifiable information; (5) The prohibition against the unauthorized use of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information; and (6) Procedures to be followed in the event of a suspected or confirmed breach of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information (see Office of Management and Budget guidance for Preparing for and Responding to a Breach of Personally Identifiable Information). (c) The contractor may provide its own training or use the training of another agency unless the contracting agency specifies that only its agency-provided training is acceptable (see 24.302 (b)). (d) The contractor is required to maintain and, upon request, to provide documentation of completion of privacy training for all applicable employees. (e) No contractor employee shall be permitted to have or retain access to a system of records, create, collect, use, process, store, maintain, disseminate, disclose, or dispose, or otherwise handle personally identifiable information, or design, develop, maintain, or operate a system of records, unless the employee has completed privacy training that, at a minimum, addresses the elements in paragraph (b) of this section.