PT-6 System of Records Notice is one of the controls that is mostly about US federal agencies. It applies to systems that process information kept in a Privacy Act system of records. If you are a private company, you will usually be asked about it only if you operate a system on an agency's behalf.
What it means in practice
The statement asks for three things. Draft system of records notices under OMB guidance and submit new or significantly modified ones to OMB and the appropriate congressional committees for advance review. Publish them in the Federal Register. Keep them accurate, current and scoped.
The guidance explains that the Privacy Act requires an agency to publish such a notice when it creates or changes a system of records, meaning a group of records from which information is retrieved by a name or identifier. The record lists two enhancements: PT-6.1 Routine Uses and PT-6.2 Exemption Rules.
Evidence to collect
If it applies to you through a contract, ask the agency's privacy office which notice covers your system, and keep a copy and the date of its last review.
Common gaps
- A contractor builds a system and does not know which notice covers it.
- Notices go stale after the system changes.
How to implement it
Confirm with your customer whether a notice exists. If you are not in federal work, document that PT-6 is not applicable and why.
Quick check
Does a commercial company publish these notices?
No. They are published by federal agencies in the Federal Register. A contractor supports the agency by describing the system accurately.
