PRIVACY TRAINING FOR FEDERAL CONTRACTORS
FEDERAL ACQUISITION REGULATION
This privacy training for federal contractors course (~15 minutes) is designed to meet the requirements of the Federal Acquisition Regulation (FAR). According to the FAR rule regarding privacy training, federal contractors are required to have “initial training” for their workforce on privacy as well as “annual training thereafter.” The training should cover the provisions of the federal Privacy Act, penalties for violating the act, appropriate handling and safeguarding of personally identifiable information (PII), authorized uses of PII, and procedures to be followed in the event of an incident or data breach. The full relevant provision of the FAR is quoted beneath the form below. This course contains 5 quiz questions. Also available in Spanish.
Learning Objectives
- Understand the scope and applicability of the federal Privacy Act
- Learn how to appropriately handle and safeguard personally identifiable information (PII)
- Understand authorized uses of PII
- Learn the procedures to follow when there is an incident or data breach involving PII
COURSE OUTLINE
1. THE IMPORTANCE OF PROTECTING PRIVACY
Prevent Harm
Trust and Reputation
Legal and Contractual Compliance
2. THE MECHANICS OF THE PRIVACY ACT
Applicability and Scope
Personally Identifiable Information (PII)
Penalties for Violations
3. APPROPRIATE HANDLING AND SAFEGUARDING OF PII
Limitations on Disclosure of PII
Permitted Disclosures
Preventing Accidental Disclosures of PII
Accounting for Disclosures
Maintaining and Using Only Relevant and Necessary PII
Appropriate Access to PII
System of Records Notice (SORN)
Security of PII
Accuracy, Relevance, Timeliness, and Completeness
Right to Access and Correct Records
4. RESPONDING TO INCIDENTS AND DATA BREACHES
What Is an “Incident”?
What is a “Breach”?
Incident and Breach Response
NOTE: The full relevant provision of the FAR is quoted below the form.
Please Contact Us to Evaluate this Program or Others
We can provide you with a login so you can evaluate the programs.
FEDERAL ACQUISITION REGULATION
PRIVACY TRAINING
As provided in the Federal Register, 81 FR 93476 (Dec. 20, 2016) (effective Jan. 19, 2017):
Subpart 24.3—Privacy Training
24.301 Privacy training.
(a) Contractors are responsible for ensuring that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who—
(1) Have access to a system of records;
(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of the agency; or
(3) Design, develop, maintain, or operate a system of records (see FAR subpart 24.1 and 39.105).
(b) Privacy training shall address the key elements necessary for ensuring the safeguarding of personally identifiable information or a system of records. The training shall be role-based, provide foundational as well as more advanced levels of training, and have measures in place to test the knowledge level of users. At a minimum, the privacy training shall cover—
(1) The provisions of the Privacy Act of 1974 (5 U.S.C. 552a), including penalties for violations of the Act;
(2) The appropriate handling and safeguarding of personally identifiable information;
(3) The authorized and official use of a system of records or any other personally identifiable information;
(4) The restriction on the use of unauthorized equipment to create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise access personally identifiable information;
(5) The prohibition against the unauthorized use of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information; and
(6) Procedures to be followed in the event of a suspected or confirmed breach of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information (see Office of Management and Budget guidance for Preparing for and Responding to a Breach of Personally Identifiable Information).
(c) The contractor may provide its own training or use the training of another agency unless the contracting agency specifies that only its agency-provided training is acceptable (see 24.302(b)).
(d) The contractor is required to maintain and, upon request, to provide documentation of completion of privacy training for all applicable employees.
(e) No contractor employee shall be permitted to have or retain access to a system of records, create, collect, use, process, store, maintain, disseminate, disclose, or dispose, or otherwise handle personally identifiable information, or design, develop, maintain, or operate a system of records, unless the employee has completed privacy training that, at a minimum, addresses the elements in paragraph (b) of this section.
About TeachPrivacy and Our Training Philosophy
TeachPrivacy was founded by Professor Daniel J. Solove, the leading expert on privacy and data security law. He is deeply involved in the creation of all training programs because he believes that training works best when made by subject-matter experts and by people with extensive teaching experience.
According to Professor Solove: “Great training isn’t about slickness or tricks. It is about teaching. The goal is to make people understand, care, and remember. Great training is made with genuine passion – to make people love training, it must be made with love. Excellent substance is essential. The material must be explained clearly, understandably, and concretely. The content must be short and to the point – and it must be engaging. Slickness and gimmicks can’t compensate for lackluster substance.”
TeachPrivacy provides privacy awareness training, information security awareness training, phishing training, HIPAA training, FERPA training, PCI training, as well as training on many other privacy and security topics.
Professor Solove is a law professor at George Washington University Law School. He has taught privacy law every year since 2000, has published 10 books and more than 50 articles, including the leading textbook on information privacy law and a short guidebook on the subject. His LinkedIn blog has more than 1 million followers. Click here for more information about Professor Solove.