24.302
Contract clause
Include the Privacy Training clause in contracts where contractor employees handle PII or systems of records, and use Alternate I if only agency-provided training is allowed.
Overview
FAR 24.302 requires contracting officers to include the clause at FAR 52.224-3, Privacy Training, in solicitations and contracts when contractor employees will handle personally identifiable information (PII) or have access to systems of records on behalf of the agency. This includes situations where contractors access, create, process, or manage PII, or are involved in the design, development, maintenance, or operation of systems of records. If the agency mandates the use of its own privacy training, the clause must be used with Alternate I.
Key Rules
- Clause Inclusion Requirement
- The Privacy Training clause (FAR 52.224-3) must be included in contracts where contractor employees handle PII or systems of records.
- Alternate I Usage
- If only agency-provided privacy training is acceptable, the clause must be used with Alternate I.
Responsibilities
- Contracting Officers: Must ensure the correct clause (and Alternate I, if applicable) is included in relevant solicitations and contracts.
- Contractors: Must comply with privacy training requirements as specified in the contract clause.
- Agencies: Must specify if only agency-provided training is acceptable and oversee compliance.
Practical Implications
- This section ensures that contractor employees are properly trained to handle sensitive personal information, reducing the risk of privacy breaches.
- Contractors must be prepared to provide or participate in privacy training as a condition of contract performance.
- Failure to include the correct clause or comply with training requirements can result in noncompliance and potential contract issues.