PT-6 System of Records Notice

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	2 (2 in a baseline)

Related controls: AC-3, PM-20, PT-2, PT-3, PT-5

Control statement

For systems that process information that will be maintained in a Privacy Act system of records:

• a. Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review;
• b. Publish system of records notices in the Federal Register; and
• c. Keep system of records notices accurate, up-to-date, and scoped in accordance with policy.

NIST discussion

The PRIVACT requires that federal agencies publish a system of records notice in the Federal Register upon the establishment and/or modification of a PRIVACT system of records. As a general matter, a system of records notice is required when an agency maintains a group of any records under the control of the agency from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifier. The notice describes the existence and character of the system and identifies the system of records, the purpose(s) of the system, the authority for maintenance of the records, the categories of records maintained in the system, the categories of individuals about whom records are maintained, the routine uses to which the records are subject, and additional details about the system as described in OMB A-108.

Control enhancements

PT-6(1) Routine Uses

Baselines: Privacy

Review all routine uses published in the system of records notice at [Assignment: organization-defined frequency] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

Discussion and assessment objectives for PT-6(1)

A PRIVACT routine use is a particular kind of disclosure of a record outside of the federal agency maintaining the system of records. A routine use is an exception to the PRIVACT prohibition on the disclosure of a record in a system of records without the prior written consent of the individual to whom the record pertains. To qualify as a routine use, the disclosure must be for a purpose that is compatible with the purpose for which the information was originally collected. The PRIVACT requires agencies to describe each routine use of the records maintained in the system of records, including the categories of users of the records and the purpose of the use. Agencies may only establish routine uses by explicitly publishing them in the relevant system of records notice.

Determine if all routine uses published in the system of records notice are reviewed [Assignment: organization-defined frequency] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

Examine: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act system of records; privacy plan; other relevant documents or records.

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for reviewing system of records notices.

PT-6(2) Exemption Rules

Baselines: Privacy

Review all Privacy Act exemptions claimed for the system of records at [Assignment: organization-defined frequency] to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurately described in the system of records notice.

Discussion and assessment objectives for PT-6(2)

The PRIVACT includes two sets of provisions that allow federal agencies to claim exemptions from certain requirements in the statute. In certain circumstances, these provisions allow agencies to promulgate regulations to exempt a system of records from select provisions of the PRIVACT . At a minimum, organizations’ PRIVACT exemption regulations include the specific name(s) of any system(s) of records that will be exempt, the specific provisions of the PRIVACT from which the system(s) of records is to be exempted, the reasons for the exemption, and an explanation for why the exemption is both necessary and appropriate.

Determine if:

• PT-06(02)[01] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: organization-defined frequency] to ensure that they remain appropriate and necessary in accordance with law;
• PT-06(02)[02] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: organization-defined frequency] to ensure that they have been promulgated as regulations;
• PT-06(02)[03] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: organization-defined frequency] to ensure that they are accurately described in the system of records notice.

Examine: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act system of records; Privacy Act exemptions; privacy plan; other relevant documents or records.

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for Privacy Act system of records maintenance.

Assessment objectives (SP 800-53A)

Objectives and methods for PT-6

Determine if:

• PT-06a.
  • PT-06a.[01] system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records;
  • PT-06a.[02] new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records;
• PT-06b. system of records notices are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records;
• PT-06c. system of records notices are kept accurate, up-to-date, and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.

Examine: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act system of records; Federal Register notices; privacy plan; other relevant documents or records.

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for Privacy Act system of records maintenance.

Policy statement

• For each system that processes information to be maintained in a Privacy Act system of records, the Senior privacy official shall draft the system of records notice in accordance with OMB guidance. (PT-6a)
• The Senior privacy official shall submit each new or significantly modified system of records notice to OMB and the appropriate congressional committees for advance review. (PT-6a)
• The Senior privacy official shall publish each system of records notice in the Federal Register. (PT-6b)
• The Senior privacy official shall keep each system of records notice accurate, up to date and scoped in accordance with policy. (PT-6c)
• The System owner shall tell the Senior privacy official of any change to the system that could affect its system of records notice before the change is made. (PT-6c)

Federal systems

The Privacy Act requires an agency to publish a notice in the Federal Register when it establishes or revises a system of records (5 U.S.C. § 552a(e)(4)), to give at least 30 days’ notice, with a chance for comment, of any new use of the information (subsection (e)(11)), and to give OMB and the congressional committees advance notice of a proposal to establish or significantly change a system of records (subsection (r)). OMB Circular A-108 (reissued December 23, 2016) sets how: a notice drafted with the Office of the Federal Register templates in its Appendices II and III (section 6.c); a report to OMB and Congress at least 30 days before the notice is submitted for publication, with OMB’s 30-day review not running at the same time as the Federal Register publication period (section 7.b); a notice of rescindment when the agency stops maintaining the system (section 6.f); and a list of, and links to, every notice on the agency’s privacy page (section 15.a). OMB Circular A-130, Appendix II, section 5.a, requires agencies to ensure notices are published, revised and rescinded as required. As of September 2026.

• The Senior privacy official shall draft each system of records notice with the Office of the Federal Register template in OMB Circular A-108. (PT-6a)
• The Senior privacy official shall report each proposal to establish or significantly modify a system of records to OMB and Congress at least 30 days before submitting the notice to the Federal Register. (PT-6a)
• The Senior privacy official shall not use a new or significantly modified routine use as the basis for a disclosure until at least 30 days after its Federal Register publication. (PT-6b)
• The Senior privacy official shall publish a notice of rescindment when the agency stops maintaining a system of records. (PT-6c)
• The Senior privacy official shall list and link every current system of records notice on the agency’s privacy program page. (PT-6c)

PT-6(1) Routine uses

• The Senior privacy official shall review all routine uses published in each system of records notice Fill in: the frequency at which to review all routine uses published in the system of records notice Typical: annually to ensure they remain accurate and compatible with the purpose for which the information was collected. (PT-6(1))

Federal systems

OMB Circular A-108, section 12, requires the privacy controls for a system of records to ensure that all routine uses remain appropriate and that the recipient’s use stays compatible with the purpose of collection (12.c). It also records that the agency-wide privacy continuous monitoring program replaced the earlier OMB requirement for annual Privacy Act reviews, so the review frequency is the one the agency’s privacy continuous monitoring strategy assigns. As of September 2026.

• The Senior privacy official shall review routine uses at the frequency the agency’s privacy continuous monitoring strategy sets for this control. (PT-6(1))

PT-6(2) Exemption rules

• The Senior privacy official shall review all Privacy Act exemptions claimed for each system of records Fill in: the frequency at which to review all Privacy Act exemptions claimed for the system of records Typical: annually to ensure they remain appropriate and necessary in accordance with law, have been promulgated as regulations, and are accurately described in the system of records notice. (PT-6(2))

Federal systems

The Privacy Act allows exemptions only by rules issued under the rulemaking procedures of 5 U.S.C. § 553, stating the reasons for each (5 U.S.C. § 552a(j) and (k)). OMB Circular A-108, section 11, requires each exemption rule to name the system, the provisions exempted and the reasons, and to explain why the exemption is necessary and appropriate, and requires the exemption to be identified in the system of records notice; section 12.d requires the privacy controls to ensure each claimed exemption remains appropriate and necessary. As of September 2026.

• The Senior privacy official shall ensure each exemption claimed for a system of records is issued as a rule under 5 U.S.C. § 553 and identified in the system of records notice, as OMB Circular A-108, section 11, requires. (PT-6(2))

From the Personally Identifiable Information Processing and Transparency Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PT-6 applies to systems that process information kept in a Privacy Act system of records. For each one, draft the system of records notice in line with OMB guidance and send new and significantly changed notices to OMB and the congressional committees for advance review (a), publish the notice in the Federal Register (b), and keep it accurate, up to date and scoped in line with policy (c). PT-6 is in the SP 800-53B Privacy baseline only.

NIST’s PT-6 discussion explains when a notice is needed: as a general matter, when an agency maintains a group of records under its control from which information is retrieved by an individual’s name or other identifier. The notice describes the system, its purposes, the authority for keeping the records, the categories of records and of individuals, the routine uses, and the further details OMB Circular A-108 sets out.

The Privacy Act binds U.S. federal agencies, and contractors that operate a system of records for an agency through their contracts (5 U.S.C. § 552a(m)). The PT decision worksheet asks whether the organization maintains systems of records; any other organization records that PT-6 and its enhancements do not apply, and keeps that decision in the privacy plan.

Common implementations. The PT-6 clause of the PII Processing and Transparency policy gives drafting, submission, publication and upkeep to the senior privacy official, and has the system owner report any change that could affect the notice before the change is made. In practice:

• The federal table in the privacy impact assessment asks whether a system of records is being created or changed, and for its notice; section 208(b)(2)(B)(ii) of the E-Government Act requires every federal assessment to address that question
• An inventory maps each system to the notices that cover it, so a change to the system can be checked against its notice
• The change request form asks, in Part B5, whether a system of records notice needs updating
• Every current notice is listed and linked on the privacy page (PM-20)

Keeping a notice scoped (c) means one notice describes one system of records clearly: neither so broad it hides what the records are for, nor split so finely that the public cannot see how records link.

Organization-defined parameters. PT-6 has none. Its clause leaves these choices open, with typical values your organization may set differently:

Choice	Typical value
Who drafts, submits and publishes notices	The senior privacy official (the clause)
Who reports changes that could affect a notice	The system owner, before the change is made (the clause)
How often each notice is checked for accuracy and scope (c)	Annually, or at the frequency the privacy continuous monitoring strategy sets, and with every significant change
Where the decision is recorded if the organization keeps no system of records	The privacy plan, and the PT decision worksheet

Evidence assessors ask for.

• The inventory of systems of records, mapped to systems and their notices
• The published notices, with their Federal Register citations
• For a recent new or changed notice, the report to OMB and Congress and its date (a)
• Records of the last review of each notice, and changes made since (c)
• Change records for a sample of systems, checked against whether the notice needed revising

Inheritance. PT-6 is carried out by the agency’s privacy office for the whole organization; a system inherits it but must report changes that affect its notice. Contractor-operated systems rely on the agency’s notice and the Privacy Act clauses in their contract.

Common findings.

• A system retrieving records by name or identifier with no notice, because nobody recognized it as a system of records.
• Notices years old that no longer describe the categories of records, the location or the routine uses.
• A cloud migration or new interface treated as routine, without considering whether it was a significant change to the notice.
• Notices missing from the privacy page.

Enhancements in the Privacy baseline. PT-6(1) asks you to review every routine use in each notice at a set frequency, to make sure it is still accurate and compatible with the purpose of collection. NIST’s discussion explains that a routine use is a disclosure outside the agency, an exception to the Privacy Act’s rule against disclosure without consent, and exists only if published in the notice. The PT-6(1) clause gives the review to the senior privacy official; the typical frequency (pt-06.01_odp) is annually. Compare each routine use with the disclosures the system actually makes, from section 6 of its privacy impact assessment and its accounting of disclosures (PM-21). Retire uses no one relies on, and revise ones that no longer describe what happens.

PT-6(2) asks you to review every Privacy Act exemption claimed for the system at a set frequency, to make sure it is still appropriate and necessary under law, was issued as a regulation, and is accurately described in the notice. The PT-6(2) clause gives the review to the senior privacy official; the typical frequency (pt-06.02_odp) is annually. A system that claims no exemptions meets PT-6(2) by recording that. A common finding is a notice that claims an exemption with no final rule behind it, or a rule naming a system by a different name than its notice.

Federal systems (as of October 2026). The Privacy Act (5 U.S.C. § 552a) requires a Federal Register notice of the existence and character of each system of records on establishment or revision, with the contents listed in subsection (e)(4)(A) to (I), and 30 days’ notice and comment for any new use (subsection (e)(11)). Subsection (r) requires advance notice to OMB and the congressional committees of any proposal to establish or significantly change a system of records. Under subsection (i)(2), an officer or employee who willfully maintains a system of records without meeting the notice requirement commits a misdemeanor.

OMB Circular A-108 sets how. Section 6.b lists examples of significant changes that need a revised notice, among them more categories of individuals or records, a changed purpose or authority, a change that creates substantially greater access, and a new or changed routine use. Section 6.c requires the Office of the Federal Register templates in its appendices, and 6.e makes a notice effective on publication except for new or significantly changed routine uses, which wait at least 30 days. Section 6.f requires a notice of rescindment when the agency stops maintaining a system, 6.h sets the factors for scoping, and 6.j covers systems operated by contractors. Section 7.b requires the report to OMB and Congress at least 30 days before the notice goes to the Federal Register, with OMB’s 30-day review not running at the same time as publication. Section 12 has the controls for each system of records keep notices accurate, up to date, appropriately scoped and published (12.b), routine uses appropriate and compatible (12.c), and exemptions appropriate and necessary (12.d). It also says the agency-wide privacy continuous monitoring program replaced OMB’s earlier requirement for annual Privacy Act reviews, so the PT-6(1) and PT-6(2) frequencies are the ones the agency’s privacy continuous monitoring strategy assigns.

For PT-6(1), section 6.k requires the agency to stop all disclosures under a routine use it finds no longer necessary or appropriate and publish a revised notice rescinding it. For PT-6(2), exemptions are issued only by rule under 5 U.S.C. § 553, stating the reasons (subsections (j) and (k)). Section 11 of A-108 requires each rule to name the system, the provisions exempted and the reasons, and to explain why the exemption is necessary and appropriate. The notice must identify the exemption, and agencies exempt only the records for which it is necessary.

Artifacts

• Personally Identifiable Information Processing and Transparency Decision Worksheet
• Personally Identifiable Information Processing and Transparency Policy