Overview
This section prescribes the mandatory inclusion of the "Privacy Training" contract clause in federal solicitations and contracts where contractor personnel handle personally identifiable information (PII) or interact with systems of records on behalf of an agency.
Key Rules
- Mandatory Insertion: Contracting officers must include FAR clause 52.224-3 if contractor employees will have access to, or handle, PII or systems of records.
- Broad Scope of Activities: The requirement is triggered if employees create, collect, use, process, store, maintain, disseminate, disclose, dispose of, or otherwise handle PII.
- Systems of Records: The clause applies to those who design, develop, maintain, or operate a system of records for the government.
- Alternate I Usage: If an agency mandates that only its specific internal training is acceptable (disallowing contractor-provided training), the Contracting Officer must use the clause with its Alternate I.
Practical Implications
- Compliance Burden: Contractors must proactively identify which employees require training and ensure documented completion before they begin work involving sensitive data.
- Onboarding Delays: Project timelines must account for the time required for personnel to complete mandated privacy training, especially when agency-specific training (Alternate I) is required.