# Personally Identifiable Information Processing and Transparency Policy **Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0 *Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution. > **Guidance:** The sections before and after Policy statements meet PT-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PT-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone. ## Purpose This policy states what [Organization name] requires for Personally Identifiable Information Processing and Transparency, and who is accountable for meeting those requirements. (PT-1a.1(a)) ## Scope This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PT-1a.1(a)) ## Roles and responsibilities - The [Senior privacy official] is accountable for this policy and shall approve exceptions to it. (PT-1a.1(a)) - The [Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures. Typical: senior privacy official] shall manage the development, documentation and dissemination of this policy and its procedures. (PT-1b) - Each [System owner] shall implement this policy for their system and document how in the system security plan. (PT-1a.1(a)) - Each person within scope shall follow this policy and report suspected violations to the [Senior privacy official]. (PT-1a.1(a)) ## Management commitment The [Senior leader] approves this policy and shall provide the resources needed to implement it. (PT-1a.1(a)) ## Coordination The [Senior privacy official] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PT-1a.1(a)) ## Compliance - This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (PT-1a.1(b)) - The [Senior privacy official] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (PT-1a.1(a)) - An exception to this policy shall be requested in writing, approved by the [Senior privacy official], time-limited and recorded with its compensating measures. (PT-1a.1(a)) - Violations of this policy shall be handled through the organization's sanctions process. (PT-1a.1(a)) ## Procedures The [Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures. Typical: senior privacy official] shall ensure that documented procedures exist to implement this policy and its associated controls. (PT-1a.2) ## Dissemination - The [Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures. Typical: senior privacy official] shall disseminate this policy to [Fill in: personnel or roles to whom the personally identifiable information processing and transparency policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (PT-1a) - The [Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures. Typical: senior privacy official] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the personally identifiable information processing and transparency procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (PT-1a) ## Policy statements > **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets. ### Authority to process personally identifiable information (PT-2) > **Guidance:** Processing covers the whole life cycle of personally identifiable information, from creation and collection through use, sharing and storage to disposal. Record the authority for each processing in the system's privacy impact assessment (RA-8), where the privacy office and legal counsel can check it. An organization not governed by statute can rely on its own policies, contracts and the consent of individuals, but it still needs to write the authority down. PT-2 is in the Privacy baseline only. - The [System owner] shall determine and document [Fill in: the authority to permit the processing of personally identifiable information. Typical: the law, regulation, contract or consent] that permits [Fill in: the type of processing of personally identifiable information. Typical: each collection, use, sharing, retention and disposal] of personally identifiable information by the system, and record it in the system's privacy impact assessment. (PT-2a) - The [Senior privacy official] shall confirm the authority with legal counsel before any new processing of personally identifiable information begins. (PT-2a) - The [System owner] shall restrict [Fill in: the type of processing of personally identifiable information to be restricted. Typical: all processing] of personally identifiable information to only that which is authorized. (PT-2b) #### Federal systems The Privacy Act of 1974 requires each agency to "maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order of the President" ([5 U.S.C. § 552a(e)(1)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), and forbids disclosing a record in a system of records without the individual's written request or prior written consent, except under the conditions in [subsection (b)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim). [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.b, requires agencies to limit the creation, collection, use, processing, storage, maintenance, dissemination and disclosure of personally identifiable information to that which is legally authorized, relevant, and reasonably deemed necessary for the proper performance of agency functions. As of September 2026. - The [System owner] shall record, for each system, the statute or executive order that authorizes the processing. (PT-2a) - The [System owner] shall ensure records in a system of records are disclosed only with the individual's written request or prior written consent, or under a condition of 5 U.S.C. § 552a(b). (PT-2b) ### Personally identifiable information processing purposes (PT-3) > **Guidance:** A purpose written down before collection is what lets the organization, and the individual, tell a compatible new use from an incompatible one. The same purposes appear in the privacy impact assessment, the privacy notice (PT-5) and, for federal systems of records, the system of records notice (PT-6). The change control review in CM-3(4) and the impact analysis in CM-4 are the usual monitoring points. PT-3 is in the Privacy baseline only. - The [System owner] shall identify [Fill in: the purpose(s) for processing personally identifiable information. Typical: the specific, explicit purposes of the system or program] for processing personally identifiable information, and document them in the system's privacy impact assessment. (PT-3a) - The [Senior privacy official] shall ensure the purposes are described in the organization's public privacy notices and policies. (PT-3b) - The [System owner] shall restrict [Fill in: the processing of personally identifiable information to be restricted. Typical: all use, sharing and retention] of personally identifiable information to only that which is compatible with the identified purposes. (PT-3c) - The [System owner] shall monitor changes in the processing of personally identifiable information. (PT-3d) - The [System owner] shall implement [Fill in: mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements. Typical: a privacy review of each proposed change through change control, with an updated privacy impact assessment (CM-3, CM-4, RA-8)] to ensure any change in processing is made in accordance with [Fill in: requirements for changing the processing of personally identifiable information. Typical: approval by the senior privacy official, an updated privacy notice before the change takes effect, and the consent of individuals where the new purpose is not compatible with the original one]. (PT-3d) #### Federal systems Under the Privacy Act, a routine use is "the use of such record for a purpose which is compatible with the purpose for which it was collected" ([5 U.S.C. § 552a(a)(7)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), and each system of records notice lists the routine uses and their purposes ([subsection (e)(4)(D)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). A new or changed routine use needs Federal Register notice and a chance for public comment at least 30 days before publication under paragraph (4)(D) ([subsection (e)(11)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). As of September 2026. - The [Senior privacy official] shall ensure a new or changed purpose for records in a system of records is published as a routine use, with the notice and comment period 5 U.S.C. § 552a(e)(11) requires, before records are disclosed for it. (PT-3d) ### Consent (PT-4) > **Guidance:** Consent works when individuals can understand what they agree to and have a real choice. Where processing is required by law or is needed to deliver what the individual asked for, consent is often the wrong basis, and other controls such as purpose limits (PT-3) do more. Laws in some jurisdictions require consent, or set how it is obtained and withdrawn, for particular data or people; settle those rules with legal counsel. PT-4 is in the Privacy baseline only. - The [Senior privacy official] shall ensure [Fill in: the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information. Typical: opt-in consent forms and settings that record the date and the version of the notice shown, and let individuals withdraw consent as easily as they gave it] are implemented for individuals to consent to the processing of their personally identifiable information before it is collected. (PT-4) - Each request for consent shall use plain language and explain what will be processed, for what purpose and with whom it will be shared, so that individuals can make an informed decision. (PT-4) - The [System owner] shall keep a record of each consent given and withdrawn. (PT-4) ### Privacy notice (PT-5) > **Guidance:** Most organizations publish one privacy notice on their privacy page (PM-20) and add short notices where information is collected, such as on a form or a sign-up screen, that link to it. Keep the notice consistent with the purposes and authorities in the privacy impact assessment (PT-2, PT-3). The [privacy notice template](https://kston83.github.io/nist-guide/templates/forms/privacy-notice/) has a full notice, a short notice for points of collection, and a register of where each is posted. PT-5 is in the Privacy baseline only. - The [Senior privacy official] shall ensure individuals are given notice about the processing of their personally identifiable information. (PT-5) - The notice shall be available to individuals when they first interact with the organization, and again at [Fill in: the frequency at which a notice is provided to individuals after initial interaction with an organization. Typical: each later collection of personally identifiable information, and whenever the notice changes materially]. (PT-5a) - The notice shall be clear and easy to understand, expressing information about the processing of personally identifiable information in plain language. (PT-5b) - The notice shall identify the authority that authorizes the processing of personally identifiable information. (PT-5c) - The notice shall identify the purposes for which personally identifiable information is to be processed. (PT-5d) - The notice shall include [Fill in: information to be included with the notice about the processing of personally identifiable information. Typical: what information is collected, with whom it is shared, the choices individuals have and how to exercise them, how individuals can access and correct their information, how long it is kept, how it is protected, and how to contact the privacy office]. (PT-5e) - The [Senior privacy official] shall approve each privacy notice, and each change to one, before it is published. (PT-5) #### Federal systems [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.a, requires agencies to maintain and post privacy policies on all agency websites, mobile applications and other digital services, in accordance with the E-Government Act and OMB policy. [Section 208(c) of the E-Government Act of 2002](https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.htm) (Pub. L. 107-347) directs OMB to issue guidance under which a privacy notice on an agency website addresses what information is collected, why, the intended use, with whom it will be shared, what notice or opportunities for consent individuals have, how it will be secured, and the rights of the individual under the Privacy Act and other privacy laws. As of September 2026. - The [Senior privacy official] shall maintain and post a privacy policy on every agency website, mobile application and other digital service, as OMB Circular A-130, Appendix II, requires. (PT-5) - Each website privacy notice shall address the elements section 208(c)(1)(B) of the E-Government Act lists. (PT-5e) ### Privacy Act statements (PT-5(2)) > **Guidance:** A Privacy Act statement is the notice the U.S. Privacy Act of 1974 requires on a form that collects information for a system of records. The Act applies to federal agencies, and to contractors that operate a system of records for an agency, whose contracts apply its requirements (5 U.S.C. § 552a(m)). An organization that maintains no Privacy Act system of records can record that this control does not apply. Part 3 of the [privacy notice template](https://kston83.github.io/nist-guide/templates/forms/privacy-notice/) is a Privacy Act statement. PT-5(2) is in the Privacy baseline only. - Where a form collects information that will be maintained in a Privacy Act system of records, the [System owner] shall include a Privacy Act statement on the form, or provide it on a separate form that the individual can keep. (PT-5(2)) - The [Senior privacy official] shall approve each Privacy Act statement before the form is used. (PT-5(2)) #### Federal systems The Privacy Act requires each agency to tell every individual it asks to supply information, on the collection form or on a separate form the individual can keep, the authority for the request and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects of not providing the information ([5 U.S.C. § 552a(e)(3)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf) (reissued December 23, 2016, 81 FR 94424), section 6.l, adds a citation to the system of records notice, requires the statement whatever the medium (paper, electronic form, website, mobile application or telephone), and, for collection by telephone, requires the information to be given orally with a way to receive it in writing. As of September 2026. - Each Privacy Act statement shall describe, in plain language, the authority for the request and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects on the individual of not providing all or part of the information. (PT-5(2)) - Each Privacy Act statement shall cite, and link where practicable, the system of records notice for the records. (PT-5(2)) - The [System owner] shall provide the Privacy Act statement whatever the medium of collection, and, for collection by telephone, give it orally with a way for the individual to receive it in writing. (PT-5(2)) ### System of records notice (PT-6) > **Guidance:** A system of records notice tells the public, through the Federal Register, that a U.S. federal agency keeps a group of records about individuals retrieved by name or another identifier, and what it does with them. PT-6 applies to systems that maintain information in a Privacy Act system of records: federal agency systems, and contractor systems operated for an agency. An organization with no such system can record that this control does not apply. PT-6 is in the Privacy baseline only. - For each system that processes information to be maintained in a Privacy Act system of records, the [Senior privacy official] shall draft the system of records notice in accordance with OMB guidance. (PT-6a) - The [Senior privacy official] shall submit each new or significantly modified system of records notice to OMB and the appropriate congressional committees for advance review. (PT-6a) - The [Senior privacy official] shall publish each system of records notice in the Federal Register. (PT-6b) - The [Senior privacy official] shall keep each system of records notice accurate, up to date and scoped in accordance with policy. (PT-6c) - The [System owner] shall tell the [Senior privacy official] of any change to the system that could affect its system of records notice before the change is made. (PT-6c) #### Federal systems The Privacy Act requires an agency to publish a notice in the Federal Register when it establishes or revises a system of records ([5 U.S.C. § 552a(e)(4)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), to give at least 30 days' notice, with a chance for comment, of any new use of the information ([subsection (e)(11)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), and to give OMB and the congressional committees advance notice of a proposal to establish or significantly change a system of records ([subsection (r)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf) (reissued December 23, 2016) sets how: a notice drafted with the Office of the Federal Register templates in its Appendices II and III (section 6.c); a report to OMB and Congress at least 30 days before the notice is submitted for publication, with OMB's 30-day review not running at the same time as the Federal Register publication period (section 7.b); a notice of rescindment when the agency stops maintaining the system (section 6.f); and a list of, and links to, every notice on the agency's privacy page (section 15.a). [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix II, section 5.a, requires agencies to ensure notices are published, revised and rescinded as required. As of September 2026. - The [Senior privacy official] shall draft each system of records notice with the Office of the Federal Register template in OMB Circular A-108. (PT-6a) - The [Senior privacy official] shall report each proposal to establish or significantly modify a system of records to OMB and Congress at least 30 days before submitting the notice to the Federal Register. (PT-6a) - The [Senior privacy official] shall not use a new or significantly modified routine use as the basis for a disclosure until at least 30 days after its Federal Register publication. (PT-6b) - The [Senior privacy official] shall publish a notice of rescindment when the agency stops maintaining a system of records. (PT-6c) - The [Senior privacy official] shall list and link every current system of records notice on the agency's privacy program page. (PT-6c) ### Routine uses (PT-6(1)) > **Guidance:** A routine use is a disclosure outside the agency that the system of records notice announces in advance. Review each one against the purpose the records were collected for, and retire uses that are no longer needed. PT-6(1) is in the Privacy baseline only. - The [Senior privacy official] shall review all routine uses published in each system of records notice [Fill in: the frequency at which to review all routine uses published in the system of records notice. Typical: annually] to ensure they remain accurate and compatible with the purpose for which the information was collected. (PT-6(1)) #### Federal systems [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf), section 12, requires the privacy controls for a system of records to ensure that all routine uses remain appropriate and that the recipient's use stays compatible with the purpose of collection (12.c). It also records that the agency-wide privacy continuous monitoring program replaced the earlier OMB requirement for annual Privacy Act reviews, so the review frequency is the one the agency's privacy continuous monitoring strategy assigns. As of September 2026. - The [Senior privacy official] shall review routine uses at the frequency the agency's privacy continuous monitoring strategy sets for this control. (PT-6(1)) ### Exemption rules (PT-6(2)) > **Guidance:** The Privacy Act lets an agency exempt some systems of records, such as certain law enforcement records, from parts of the Act, but only by publishing a rule. A system that claims no exemptions meets this control by recording that. PT-6(2) is in the Privacy baseline only. - The [Senior privacy official] shall review all Privacy Act exemptions claimed for each system of records [Fill in: the frequency at which to review all Privacy Act exemptions claimed for the system of records. Typical: annually] to ensure they remain appropriate and necessary in accordance with law, have been promulgated as regulations, and are accurately described in the system of records notice. (PT-6(2)) #### Federal systems The Privacy Act allows exemptions only by rules issued under the rulemaking procedures of 5 U.S.C. § 553, stating the reasons for each ([5 U.S.C. § 552a(j) and (k)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf), section 11, requires each exemption rule to name the system, the provisions exempted and the reasons, and to explain why the exemption is necessary and appropriate, and requires the exemption to be identified in the system of records notice; section 12.d requires the privacy controls to ensure each claimed exemption remains appropriate and necessary. As of September 2026. - The [Senior privacy official] shall ensure each exemption claimed for a system of records is issued as a rule under 5 U.S.C. § 553 and identified in the system of records notice, as OMB Circular A-108, section 11, requires. (PT-6(2)) ### Specific categories of personally identifiable information (PT-7) > **Guidance:** Some personally identifiable information carries more risk if it is misused, and laws often set extra rules for it: identification numbers, health, financial and biometric information, and information about children are common examples. The privacy risk assessment (RA-3, RA-8) is where a system shows which categories it holds. PT-7 is in the Privacy baseline only. - The [Senior privacy official] shall designate the categories of personally identifiable information that need specific processing conditions, such as Social Security numbers, health, financial and biometric information, and information about children. (PT-7) - The [System owner] shall apply [Fill in: processing conditions to be applied for specific categories of personally identifiable information. Typical: the conditions the senior privacy official sets for each designated category, such as collection only where law requires it or a documented need exists, encryption, and access limited to named roles] to the designated categories of personally identifiable information. (PT-7) ### Social Security numbers (PT-7(1)) > **Guidance:** Section 7 of the Privacy Act of 1974 (Pub. L. 93-579, printed as a note to 5 U.S.C. § 552a) covers any federal, state or local government agency that asks for a Social Security number, not only federal agencies. It bars denying a right, benefit or privilege for refusing to disclose one, except where a federal statute requires disclosure or for certain systems in place before January 1, 1975, and requires the agency to say whether disclosure is mandatory or voluntary, under what authority, and how the number will be used. Other organizations adopt these statements as good practice or as other laws require. PT-7(1) is in the Privacy baseline only. - When a system processes Social Security numbers, the [System owner] shall eliminate their unnecessary collection, maintenance and use, and explore alternatives to their use as a personal identifier. (PT-7(1)(a)) - The [System owner] shall ensure no individual is denied any right, benefit or privilege provided by law because the individual refuses to disclose their Social Security number. (PT-7(1)(b)) - The [System owner] shall inform each individual asked to disclose their Social Security number whether disclosure is mandatory or voluntary, by what statutory or other authority the number is requested, and what uses will be made of it. (PT-7(1)(c)) #### Federal systems [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.b, requires agencies to take steps to eliminate unnecessary collection, maintenance and use of Social Security numbers, and to explore alternatives to their use as a personal identifier. Section 7 of the [Privacy Act of 1974](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim) (in the notes to 5 U.S.C. § 552a) sets the rules in PT-7(1)(b) and (c) for federal, state and local government agencies. As of September 2026. - The [Senior privacy official] shall review the agency's collection and use of Social Security numbers and record the steps taken to eliminate unnecessary uses, as OMB Circular A-130, Appendix II, requires. (PT-7(1)(a)) ### First Amendment information (PT-7(2)) > **Guidance:** The rule comes from the U.S. Privacy Act (5 U.S.C. § 552a(e)(7)), which protects records of how people exercise freedoms such as religion, speech, the press, assembly and petition. It is a sound rule for any organization: information about what people say, believe or join is rarely needed and easily misused. PT-7(2) is in the Privacy baseline only. - The [System owner] shall not process information describing how any individual exercises rights guaranteed by the First Amendment, unless expressly authorized by statute or by the individual, or unless pertinent to and within the scope of an authorized law enforcement activity. (PT-7(2)) #### Federal systems The Privacy Act requires each agency to "maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity" ([5 U.S.C. § 552a(e)(7)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). The general exemptions in subsection (j) cannot remove this requirement. As of September 2026. - The [Senior privacy official] shall ensure no system of records holds a record of how an individual exercises First Amendment rights except as 5 U.S.C. § 552a(e)(7) allows. (PT-7(2)) ### Computer matching requirements (PT-8) > **Guidance:** A matching program is a computerized comparison of records from U.S. federal systems of records, or of federal records with those of a state or local agency, usually to check eligibility for a federal benefit or to recover payments; the Privacy Act sets its rules. The data integrity board is the one PM-24 establishes. If the organization runs no matching programs, keep the heading and record that decision. PT-8 is in the Privacy baseline only. - Where a system or the organization processes information to conduct a matching program, the [Senior privacy official] shall obtain the approval of the data integrity board before the program begins. (PT-8a) - The [Senior privacy official] shall develop and enter into a computer matching agreement for each matching program. (PT-8b) - The [Senior privacy official] shall publish a matching notice in the Federal Register for each matching program. (PT-8c) - The [System owner] shall independently verify the information a matching program produces before any adverse action is taken against an individual, where verification is required. (PT-8d) - The [System owner] shall give each individual notice and an opportunity to contest the findings before any adverse action is taken against them. (PT-8e) #### Federal systems The Privacy Act ([5 U.S.C. § 552a](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)) requires a written matching agreement stating, among other things, the purpose and legal authority, the justification and expected results, the records and data elements matched, and the verification, retention, security and redisclosure rules (subsection (o)(1)); the agreement takes effect 30 days after it is sent to the congressional committees, lasts no more than 18 months, and may be renewed once for up to one year (subsection (o)(2)); after that, the program continues only if it is re-established, with a new matching notice and report ([OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf), section 8 and footnote 72). The data integrity board approves each agreement (subsection (u)(3)(A)). A matching notice is published in the Federal Register at least 30 days before the program is conducted (subsection (e)(12)), and OMB and Congress get advance notice (subsection (r)). No adverse action may follow until the information is independently verified, or the board makes the determination subsection (p)(1)(A)(ii) allows, and the individual has been notified and has had the period set by statute or regulation, or else 30 days, to respond (subsection (p)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf), sections 8 and 9, sets how matching notices are published and reported. As of October 2026. - Each computer matching agreement shall contain every element 5 U.S.C. § 552a(o)(1) lists, and be sent to the congressional committees at least 30 days before it takes effect. (PT-8b) - The data integrity board shall set each agreement's term at no more than 18 months, and renew it no more than once, for up to one year, as 5 U.S.C. § 552a(o)(2)(D) and OMB Circular A-108, section 8, allow. (PT-8b) - The [Senior privacy official] shall publish the matching notice at least 30 days before the matching program is conducted. (PT-8c) - The [System owner] shall allow the individual the period set by statute or regulation, or else 30 days from the notice, to respond before taking adverse action. (PT-8e) ## Review and update - The [Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures. Typical: senior privacy official] shall review and update this policy [Fill in: the frequency at which the current personally identifiable information processing and transparency policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current personally identifiable information processing and transparency policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (PT-1c.1) - The [Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures. Typical: senior privacy official] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current personally identifiable information processing and transparency procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (PT-1c.2) ### Federal systems For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources. - Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PT-1a.1(b))