Personally Identifiable Information Processing and Transparency Policy

Personally Identifiable Information Processing and Transparency Policy template: Ready-to-adopt Personally Identifiable Information Processing and Transparency policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Personally Identifiable Information Processing and Transparency policy states what the organization requires for personally identifiable information processing and transparency and who is accountable for it. It meets PT-1 through the sections every family policy shares, and adds one statement group per control. NIST SP 800-53B places every PT control in the Privacy baseline and none in the Low, Moderate or High baselines, so this policy has one Privacy variant. Adopt it wherever systems process personally identifiable information, alongside the security baseline of each system.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. PT-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
PT-1	Policy and Procedures				Yes
PT-2	Authority to Process Personally Identifiable Information				Yes
PT-3	Personally Identifiable Information Processing Purposes				Yes
PT-4	Consent				Yes
PT-5	Privacy Notice				Yes
PT-5(2)	Privacy Act Statements				Yes
PT-6	System of Records Notice				Yes
PT-6(1)	Routine Uses				Yes
PT-6(2)	Exemption Rules				Yes
PT-7	Specific Categories of Personally Identifiable Information				Yes
PT-7(1)	Social Security Numbers				Yes
PT-7(2)	First Amendment Information				Yes
PT-8	Computer Matching Requirements				Yes

Decisions to make first

The policy has 21 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Where is the authority and purpose for each processing of personally identifiable information recorded, and who confirms it?	PT-2, PT-3	In each system’s privacy impact assessment; the privacy office confirms the authority with legal counsel before new processing begins.	Senior privacy official, with legal counsel
When does the organization rely on consent, and how is consent recorded and withdrawn?	PT-4	Consent where law requires it or where the processing is not needed to deliver what the individual asked for; opt-in, recorded with the date and notice version, and withdrawn as easily as it was given.	Senior privacy official
Where are privacy notices published, and who approves them and their changes?	PT-5, PT-5(2)	One privacy notice on the organization’s privacy page, with short notices at each point of collection that link to it; the privacy office approves every notice and change.	Senior privacy official
Which categories of personally identifiable information need specific processing conditions?	PT-7, PT-7(1), PT-7(2)	Social Security numbers, health, financial and biometric information, and information about children, plus a ban on records of how individuals exercise First Amendment rights.	Senior privacy official
Does the organization maintain Privacy Act systems of records or take part in matching programs?	PT-6, PT-8	Federal agencies, and contractors operating systems of records for them, yes, listed on the privacy page; other organizations record that PT-6, its enhancements, PT-5(2) and PT-8 do not apply.	Senior privacy official

Record your values in the Personally Identifiable Information Processing and Transparency decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: PT pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Privacy baseline, annotated)

Guidance

The sections before and after Policy statements meet PT-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PT-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Personally Identifiable Information Processing and Transparency, and who is accountable for meeting those requirements. (PT-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PT-1a.1(a))

Roles and responsibilities

• The Senior privacy official is accountable for this policy and shall approve exceptions to it. (PT-1a.1(a))
• The Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures Typical: senior privacy official shall manage the development, documentation and dissemination of this policy and its procedures. (PT-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (PT-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Senior privacy official. (PT-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (PT-1a.1(a))

Coordination

The Senior privacy official shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PT-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (PT-1a.1(b))
• The Senior privacy official shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (PT-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Senior privacy official, time-limited and recorded with its compensating measures. (PT-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (PT-1a.1(a))

Procedures

The Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures Typical: senior privacy official shall ensure that documented procedures exist to implement this policy and its associated controls. (PT-1a.2)

Dissemination

• The Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures Typical: senior privacy official shall disseminate this policy to Fill in: personnel or roles to whom the personally identifiable information processing and transparency policy is to be disseminated Typical: everyone within its scope, through the policy library. (PT-1a)
• The Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures Typical: senior privacy official shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the personally identifiable information processing and transparency procedures are to be disseminated Typical: the people who carry them out, and the system owners. (PT-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Authority to process personally identifiable information (PT-2)

Guidance

Processing covers the whole life cycle of personally identifiable information, from creation and collection through use, sharing and storage to disposal. Record the authority for each processing in the system’s privacy impact assessment (RA-8), where the privacy office and legal counsel can check it. An organization not governed by statute can rely on its own policies, contracts and the consent of individuals, but it still needs to write the authority down. PT-2 is in the Privacy baseline only.

• The System owner shall determine and document Fill in: the authority to permit the processing of personally identifiable information Typical: the law, regulation, contract or consent that permits Fill in: the type of processing of personally identifiable information Typical: each collection, use, sharing, retention and disposal of personally identifiable information by the system, and record it in the system’s privacy impact assessment. (PT-2a)
• The Senior privacy official shall confirm the authority with legal counsel before any new processing of personally identifiable information begins. (PT-2a)
• The System owner shall restrict Fill in: the type of processing of personally identifiable information to be restricted Typical: all processing of personally identifiable information to only that which is authorized. (PT-2b)

Federal systems

The Privacy Act of 1974 requires each agency to “maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order of the President” (5 U.S.C. § 552a(e)(1)), and forbids disclosing a record in a system of records without the individual’s written request or prior written consent, except under the conditions in subsection (b). OMB Circular A-130 (July 28, 2016), Appendix II, section 5.b, requires agencies to limit the creation, collection, use, processing, storage, maintenance, dissemination and disclosure of personally identifiable information to that which is legally authorized, relevant, and reasonably deemed necessary for the proper performance of agency functions. As of September 2026.

• The System owner shall record, for each system, the statute or executive order that authorizes the processing. (PT-2a)
• The System owner shall ensure records in a system of records are disclosed only with the individual’s written request or prior written consent, or under a condition of 5 U.S.C. § 552a(b). (PT-2b)

Personally identifiable information processing purposes (PT-3)

Guidance

A purpose written down before collection is what lets the organization, and the individual, tell a compatible new use from an incompatible one. The same purposes appear in the privacy impact assessment, the privacy notice (PT-5) and, for federal systems of records, the system of records notice (PT-6). The change control review in CM-3(4) and the impact analysis in CM-4 are the usual monitoring points. PT-3 is in the Privacy baseline only.

• The System owner shall identify Fill in: the purpose(s) for processing personally identifiable information Typical: the specific, explicit purposes of the system or program for processing personally identifiable information, and document them in the system’s privacy impact assessment. (PT-3a)
• The Senior privacy official shall ensure the purposes are described in the organization’s public privacy notices and policies. (PT-3b)
• The System owner shall restrict Fill in: the processing of personally identifiable information to be restricted Typical: all use, sharing and retention of personally identifiable information to only that which is compatible with the identified purposes. (PT-3c)
• The System owner shall monitor changes in the processing of personally identifiable information. (PT-3d)
• The System owner shall implement Fill in: mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements Typical: a privacy review of each proposed change through change control, with an updated privacy impact assessment (CM-3, CM-4, RA-8) to ensure any change in processing is made in accordance with Fill in: requirements for changing the processing of personally identifiable information Typical: approval by the senior privacy official, an updated privacy notice before the change takes effect, and the consent of individuals where the new purpose is not compatible with the original one. (PT-3d)

Federal systems

Under the Privacy Act, a routine use is “the use of such record for a purpose which is compatible with the purpose for which it was collected” (5 U.S.C. § 552a(a)(7)), and each system of records notice lists the routine uses and their purposes (subsection (e)(4)(D)). A new or changed routine use needs Federal Register notice and a chance for public comment at least 30 days before publication under paragraph (4)(D) (subsection (e)(11)). As of September 2026.

• The Senior privacy official shall ensure a new or changed purpose for records in a system of records is published as a routine use, with the notice and comment period 5 U.S.C. § 552a(e)(11) requires, before records are disclosed for it. (PT-3d)

Consent (PT-4)

Guidance

Consent works when individuals can understand what they agree to and have a real choice. Where processing is required by law or is needed to deliver what the individual asked for, consent is often the wrong basis, and other controls such as purpose limits (PT-3) do more. Laws in some jurisdictions require consent, or set how it is obtained and withdrawn, for particular data or people; settle those rules with legal counsel. PT-4 is in the Privacy baseline only.

• The Senior privacy official shall ensure Fill in: the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information Typical: opt-in consent forms and settings that record the date and the version of the notice shown, and let individuals withdraw consent as easily as they gave it are implemented for individuals to consent to the processing of their personally identifiable information before it is collected. (PT-4)
• Each request for consent shall use plain language and explain what will be processed, for what purpose and with whom it will be shared, so that individuals can make an informed decision. (PT-4)
• The System owner shall keep a record of each consent given and withdrawn. (PT-4)

Privacy notice (PT-5)

Guidance

Most organizations publish one privacy notice on their privacy page (PM-20) and add short notices where information is collected, such as on a form or a sign-up screen, that link to it. Keep the notice consistent with the purposes and authorities in the privacy impact assessment (PT-2, PT-3). The privacy notice template has a full notice, a short notice for points of collection, and a register of where each is posted. PT-5 is in the Privacy baseline only.

• The Senior privacy official shall ensure individuals are given notice about the processing of their personally identifiable information. (PT-5)
• The notice shall be available to individuals when they first interact with the organization, and again at Fill in: the frequency at which a notice is provided to individuals after initial interaction with an organization Typical: each later collection of personally identifiable information, and whenever the notice changes materially. (PT-5a)
• The notice shall be clear and easy to understand, expressing information about the processing of personally identifiable information in plain language. (PT-5b)
• The notice shall identify the authority that authorizes the processing of personally identifiable information. (PT-5c)
• The notice shall identify the purposes for which personally identifiable information is to be processed. (PT-5d)
• The notice shall include Fill in: information to be included with the notice about the processing of personally identifiable information Typical: what information is collected, with whom it is shared, the choices individuals have and how to exercise them, how individuals can access and correct their information, how long it is kept, how it is protected, and how to contact the privacy office. (PT-5e)
• The Senior privacy official shall approve each privacy notice, and each change to one, before it is published. (PT-5)

Federal systems

OMB Circular A-130 (July 28, 2016), Appendix II, section 5.a, requires agencies to maintain and post privacy policies on all agency websites, mobile applications and other digital services, in accordance with the E-Government Act and OMB policy. Section 208(c) of the E-Government Act of 2002 (Pub. L. 107-347) directs OMB to issue guidance under which a privacy notice on an agency website addresses what information is collected, why, the intended use, with whom it will be shared, what notice or opportunities for consent individuals have, how it will be secured, and the rights of the individual under the Privacy Act and other privacy laws. As of September 2026.

• The Senior privacy official shall maintain and post a privacy policy on every agency website, mobile application and other digital service, as OMB Circular A-130, Appendix II, requires. (PT-5)
• Each website privacy notice shall address the elements section 208(c)(1)(B) of the E-Government Act lists. (PT-5e)

Privacy Act statements (PT-5(2))

Guidance

A Privacy Act statement is the notice the U.S. Privacy Act of 1974 requires on a form that collects information for a system of records. The Act applies to federal agencies, and to contractors that operate a system of records for an agency, whose contracts apply its requirements (5 U.S.C. § 552a(m)). An organization that maintains no Privacy Act system of records can record that this control does not apply. Part 3 of the privacy notice template is a Privacy Act statement. PT-5(2) is in the Privacy baseline only.

• Where a form collects information that will be maintained in a Privacy Act system of records, the System owner shall include a Privacy Act statement on the form, or provide it on a separate form that the individual can keep. (PT-5(2))
• The Senior privacy official shall approve each Privacy Act statement before the form is used. (PT-5(2))

Federal systems

The Privacy Act requires each agency to tell every individual it asks to supply information, on the collection form or on a separate form the individual can keep, the authority for the request and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects of not providing the information (5 U.S.C. § 552a(e)(3)). OMB Circular A-108 (reissued December 23, 2016, 81 FR 94424), section 6.l, adds a citation to the system of records notice, requires the statement whatever the medium (paper, electronic form, website, mobile application or telephone), and, for collection by telephone, requires the information to be given orally with a way to receive it in writing. As of September 2026.

• Each Privacy Act statement shall describe, in plain language, the authority for the request and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects on the individual of not providing all or part of the information. (PT-5(2))
• Each Privacy Act statement shall cite, and link where practicable, the system of records notice for the records. (PT-5(2))
• The System owner shall provide the Privacy Act statement whatever the medium of collection, and, for collection by telephone, give it orally with a way for the individual to receive it in writing. (PT-5(2))

System of records notice (PT-6)

Guidance

A system of records notice tells the public, through the Federal Register, that a U.S. federal agency keeps a group of records about individuals retrieved by name or another identifier, and what it does with them. PT-6 applies to systems that maintain information in a Privacy Act system of records: federal agency systems, and contractor systems operated for an agency. An organization with no such system can record that this control does not apply. PT-6 is in the Privacy baseline only.

• For each system that processes information to be maintained in a Privacy Act system of records, the Senior privacy official shall draft the system of records notice in accordance with OMB guidance. (PT-6a)
• The Senior privacy official shall submit each new or significantly modified system of records notice to OMB and the appropriate congressional committees for advance review. (PT-6a)
• The Senior privacy official shall publish each system of records notice in the Federal Register. (PT-6b)
• The Senior privacy official shall keep each system of records notice accurate, up to date and scoped in accordance with policy. (PT-6c)
• The System owner shall tell the Senior privacy official of any change to the system that could affect its system of records notice before the change is made. (PT-6c)

Federal systems

The Privacy Act requires an agency to publish a notice in the Federal Register when it establishes or revises a system of records (5 U.S.C. § 552a(e)(4)), to give at least 30 days’ notice, with a chance for comment, of any new use of the information (subsection (e)(11)), and to give OMB and the congressional committees advance notice of a proposal to establish or significantly change a system of records (subsection (r)). OMB Circular A-108 (reissued December 23, 2016) sets how: a notice drafted with the Office of the Federal Register templates in its Appendices II and III (section 6.c); a report to OMB and Congress at least 30 days before the notice is submitted for publication, with OMB’s 30-day review not running at the same time as the Federal Register publication period (section 7.b); a notice of rescindment when the agency stops maintaining the system (section 6.f); and a list of, and links to, every notice on the agency’s privacy page (section 15.a). OMB Circular A-130, Appendix II, section 5.a, requires agencies to ensure notices are published, revised and rescinded as required. As of September 2026.

• The Senior privacy official shall draft each system of records notice with the Office of the Federal Register template in OMB Circular A-108. (PT-6a)
• The Senior privacy official shall report each proposal to establish or significantly modify a system of records to OMB and Congress at least 30 days before submitting the notice to the Federal Register. (PT-6a)
• The Senior privacy official shall not use a new or significantly modified routine use as the basis for a disclosure until at least 30 days after its Federal Register publication. (PT-6b)
• The Senior privacy official shall publish a notice of rescindment when the agency stops maintaining a system of records. (PT-6c)
• The Senior privacy official shall list and link every current system of records notice on the agency’s privacy program page. (PT-6c)

Routine uses (PT-6(1))

Guidance

A routine use is a disclosure outside the agency that the system of records notice announces in advance. Review each one against the purpose the records were collected for, and retire uses that are no longer needed. PT-6(1) is in the Privacy baseline only.

• The Senior privacy official shall review all routine uses published in each system of records notice Fill in: the frequency at which to review all routine uses published in the system of records notice Typical: annually to ensure they remain accurate and compatible with the purpose for which the information was collected. (PT-6(1))

Federal systems

OMB Circular A-108, section 12, requires the privacy controls for a system of records to ensure that all routine uses remain appropriate and that the recipient’s use stays compatible with the purpose of collection (12.c). It also records that the agency-wide privacy continuous monitoring program replaced the earlier OMB requirement for annual Privacy Act reviews, so the review frequency is the one the agency’s privacy continuous monitoring strategy assigns. As of September 2026.

• The Senior privacy official shall review routine uses at the frequency the agency’s privacy continuous monitoring strategy sets for this control. (PT-6(1))

Exemption rules (PT-6(2))

Guidance

The Privacy Act lets an agency exempt some systems of records, such as certain law enforcement records, from parts of the Act, but only by publishing a rule. A system that claims no exemptions meets this control by recording that. PT-6(2) is in the Privacy baseline only.

• The Senior privacy official shall review all Privacy Act exemptions claimed for each system of records Fill in: the frequency at which to review all Privacy Act exemptions claimed for the system of records Typical: annually to ensure they remain appropriate and necessary in accordance with law, have been promulgated as regulations, and are accurately described in the system of records notice. (PT-6(2))

Federal systems

The Privacy Act allows exemptions only by rules issued under the rulemaking procedures of 5 U.S.C. § 553, stating the reasons for each (5 U.S.C. § 552a(j) and (k)). OMB Circular A-108, section 11, requires each exemption rule to name the system, the provisions exempted and the reasons, and to explain why the exemption is necessary and appropriate, and requires the exemption to be identified in the system of records notice; section 12.d requires the privacy controls to ensure each claimed exemption remains appropriate and necessary. As of September 2026.

• The Senior privacy official shall ensure each exemption claimed for a system of records is issued as a rule under 5 U.S.C. § 553 and identified in the system of records notice, as OMB Circular A-108, section 11, requires. (PT-6(2))

Specific categories of personally identifiable information (PT-7)

Guidance

Some personally identifiable information carries more risk if it is misused, and laws often set extra rules for it: identification numbers, health, financial and biometric information, and information about children are common examples. The privacy risk assessment (RA-3, RA-8) is where a system shows which categories it holds. PT-7 is in the Privacy baseline only.

• The Senior privacy official shall designate the categories of personally identifiable information that need specific processing conditions, such as Social Security numbers, health, financial and biometric information, and information about children. (PT-7)
• The System owner shall apply Fill in: processing conditions to be applied for specific categories of personally identifiable information Typical: the conditions the senior privacy official sets for each designated category, such as collection only where law requires it or a documented need exists, encryption, and access limited to named roles to the designated categories of personally identifiable information. (PT-7)

Social Security numbers (PT-7(1))

Guidance

Section 7 of the Privacy Act of 1974 (Pub. L. 93-579, printed as a note to 5 U.S.C. § 552a) covers any federal, state or local government agency that asks for a Social Security number, not only federal agencies. It bars denying a right, benefit or privilege for refusing to disclose one, except where a federal statute requires disclosure or for certain systems in place before January 1, 1975, and requires the agency to say whether disclosure is mandatory or voluntary, under what authority, and how the number will be used. Other organizations adopt these statements as good practice or as other laws require. PT-7(1) is in the Privacy baseline only.

• When a system processes Social Security numbers, the System owner shall eliminate their unnecessary collection, maintenance and use, and explore alternatives to their use as a personal identifier. (PT-7(1)(a))
• The System owner shall ensure no individual is denied any right, benefit or privilege provided by law because the individual refuses to disclose their Social Security number. (PT-7(1)(b))
• The System owner shall inform each individual asked to disclose their Social Security number whether disclosure is mandatory or voluntary, by what statutory or other authority the number is requested, and what uses will be made of it. (PT-7(1)(c))

Federal systems

OMB Circular A-130 (July 28, 2016), Appendix II, section 5.b, requires agencies to take steps to eliminate unnecessary collection, maintenance and use of Social Security numbers, and to explore alternatives to their use as a personal identifier. Section 7 of the Privacy Act of 1974 (in the notes to 5 U.S.C. § 552a) sets the rules in PT-7(1)(b) and (c) for federal, state and local government agencies. As of September 2026.

• The Senior privacy official shall review the agency’s collection and use of Social Security numbers and record the steps taken to eliminate unnecessary uses, as OMB Circular A-130, Appendix II, requires. (PT-7(1)(a))

First Amendment information (PT-7(2))

Guidance

The rule comes from the U.S. Privacy Act (5 U.S.C. § 552a(e)(7)), which protects records of how people exercise freedoms such as religion, speech, the press, assembly and petition. It is a sound rule for any organization: information about what people say, believe or join is rarely needed and easily misused. PT-7(2) is in the Privacy baseline only.

• The System owner shall not process information describing how any individual exercises rights guaranteed by the First Amendment, unless expressly authorized by statute or by the individual, or unless pertinent to and within the scope of an authorized law enforcement activity. (PT-7(2))

Federal systems

The Privacy Act requires each agency to “maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity” (5 U.S.C. § 552a(e)(7)). The general exemptions in subsection (j) cannot remove this requirement. As of September 2026.

• The Senior privacy official shall ensure no system of records holds a record of how an individual exercises First Amendment rights except as 5 U.S.C. § 552a(e)(7) allows. (PT-7(2))

Computer matching requirements (PT-8)

Guidance

A matching program is a computerized comparison of records from U.S. federal systems of records, or of federal records with those of a state or local agency, usually to check eligibility for a federal benefit or to recover payments; the Privacy Act sets its rules. The data integrity board is the one PM-24 establishes. If the organization runs no matching programs, keep the heading and record that decision. PT-8 is in the Privacy baseline only.

• Where a system or the organization processes information to conduct a matching program, the Senior privacy official shall obtain the approval of the data integrity board before the program begins. (PT-8a)
• The Senior privacy official shall develop and enter into a computer matching agreement for each matching program. (PT-8b)
• The Senior privacy official shall publish a matching notice in the Federal Register for each matching program. (PT-8c)
• The System owner shall independently verify the information a matching program produces before any adverse action is taken against an individual, where verification is required. (PT-8d)
• The System owner shall give each individual notice and an opportunity to contest the findings before any adverse action is taken against them. (PT-8e)

Federal systems

The Privacy Act (5 U.S.C. § 552a) requires a written matching agreement stating, among other things, the purpose and legal authority, the justification and expected results, the records and data elements matched, and the verification, retention, security and redisclosure rules (subsection (o)(1)); the agreement takes effect 30 days after it is sent to the congressional committees, lasts no more than 18 months, and may be renewed once for up to one year (subsection (o)(2)); after that, the program continues only if it is re-established, with a new matching notice and report (OMB Circular A-108, section 8 and footnote 72). The data integrity board approves each agreement (subsection (u)(3)(A)). A matching notice is published in the Federal Register at least 30 days before the program is conducted (subsection (e)(12)), and OMB and Congress get advance notice (subsection (r)). No adverse action may follow until the information is independently verified, or the board makes the determination subsection (p)(1)(A)(ii) allows, and the individual has been notified and has had the period set by statute or regulation, or else 30 days, to respond (subsection (p)). OMB Circular A-108, sections 8 and 9, sets how matching notices are published and reported. As of October 2026.

• Each computer matching agreement shall contain every element 5 U.S.C. § 552a(o)(1) lists, and be sent to the congressional committees at least 30 days before it takes effect. (PT-8b)
• The data integrity board shall set each agreement’s term at no more than 18 months, and renew it no more than once, for up to one year, as 5 U.S.C. § 552a(o)(2)(D) and OMB Circular A-108, section 8, allow. (PT-8b)
• The Senior privacy official shall publish the matching notice at least 30 days before the matching program is conducted. (PT-8c)
• The System owner shall allow the individual the period set by statute or regulation, or else 30 days from the notice, to respond before taking adverse action. (PT-8e)

Review and update

• The Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures Typical: senior privacy official shall review and update this policy Fill in: the frequency at which the current personally identifiable information processing and transparency policy is reviewed and updated Typical: annually and following Fill in: events that would require the current personally identifiable information processing and transparency policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (PT-1c.1)
• The Fill in: an official to manage the personally identifiable information processing and transparency policy and procedures Typical: senior privacy official shall review and update the procedures that implement this policy Fill in: the frequency at which the current personally identifiable information processing and transparency procedures are reviewed and updated Typical: annually and following Fill in: events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (PT-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PT-1a.1(b))