This guide explains FAR Part 24 of the Federal Acquisition Regulation (FAR), with practical examples for federal contractors.
Watch the FAR Part 24 video
FAR Part 24: privacy and public records
This guide covers the Federal Acquisition Regulation, FAR Part 24: Protection of Privacy and Freedom of Information. FAR Part 24 answers two separate questions: how contracts must protect personal information about individuals, and when government records may be released to the public. Keep three rule sets apart. Privacy law governs personal information. The Freedom of Information Act governs public records requests. Cybersecurity is a separate set of rules for protecting systems.
One caution. These are the baseline rules in the codified FAR, current through Federal Acquisition Circular 2026-01. Your agency may issue a deviation that changes how a rule applies, so always check your contract. Start with definitions in FAR 24.101. Personally identifiable information, or PII, is information that can distinguish or trace an individual's identity, alone or combined with other information linked to that person.
Think of a name, a Social Security number, a date of birth, or a home address. One item may identify someone, and several items together often can. Next, a system of records. Under FAR 24.101, it is a group of records under agency control from which information is retrieved by an individual's name, or by another identifying number, symbol, or identifier. Retrieval is the key.
Privacy Act clauses and role-based training
Application files pulled by applicant name form a system of records. The same papers, searched only by subject, are a different situation. Now applicability. FAR 24.102 covers an agency contract for the design, development, or operation of a system of records on individuals, on the agency's behalf, to accomplish an agency function. For that kind of contract, Privacy Act requirements extend to the contractor. Three conditions matter: records about individuals, work on the agency's behalf, and an agency function.
An ordinary internal business database is not automatically an agency system of records. Ownership alone is not the test. The test is whether the contractor is performing the agency's work with the agency's records. The contract must say so. FAR 24.104 points to clauses 52.224-1 and 52.224-2. Privacy Act obligations depend on the law and the required work, not only on clause presence, so read the clauses closely at award.
Training comes next, in FAR 24.301. Covered employees must complete initial privacy training before covered access or work, as the applicable clause requires, and then every year. Who is covered? Employees who have access to a system of records, who handle PII on the agency's behalf, or who design, develop, maintain, or operate those systems. Training must be role based. A developer, a case processor, and a help desk analyst touch personal information differently, so their training should match their duties.
FOIA does not mean automatic disclosure
It must also address breach procedures: what to do when personal information may have been compromised, and who must be told. Finally, completion must be documented. Keep records showing which covered employees finished the initial and annual training. Now the Freedom of Information Act, or FOIA. FAR 24.202 deals with a special case: competitive proposals that the government holds. A competitive proposal in the government's possession is not disclosed under FOIA.
That protects what offerors submit in response to a solicitation. There is one specific exception. Parts of a proposal that are incorporated into the resulting contract are not covered by that protection. Do not read that as automatic public release. It means the prohibition does not apply to those parts. The agency still handles the request under FOIA. So who decides? The agency makes FOIA decisions.
A contractor cannot unilaterally release agency records on its own. It should send the request to the agency through the channel named in its contract. Here is a worked example. An agency hires a contractor to run an online benefits application system. Applicants submit names, birth dates, and addresses, and staff retrieve files by applicant name. Step one, FAR 24.101. The data is PII, and retrieval by name makes the application files a system of records.
Protect personal information during performance
Step two, FAR 24.102. The contractor operates the system on the agency's behalf for an agency function, so Privacy Act requirements extend to it. Check that clauses 52.224-1 and 52.224-2 are in the contract. Step three, FAR 24.301. Developers, processors, and administrators with access complete role-based privacy training, including breach procedures, then repeat it annually. The contractor documents completion. Step four, FOIA. A reporter asks the contractor for application files.
The contractor does not decide. It forwards the request to the agency, which makes the FOIA determination. Now your action checklist. First, ask whether PII or a system of records is involved. Second, confirm whether FAR 24.102 applies and whether the clauses are in the contract. Third, identify covered employees and confirm role-based initial and annual training, breach procedures, and completion records. Fourth, send FOIA requests to the agency, and never release proposals or agency records yourself.
Fifth, check for any agency deviation. Remember: privacy, FOIA, and cybersecurity are separate rules. Meeting one does not satisfy the others. This is general education, not legal advice. Check your contract and agency guidance.
Official sources
Explore GovAssessment to build your business-readiness baseline. General education, not legal or tax advice. No certification or award guarantee.
