United States · Privacy Act of 1974

The Privacy Act of 1974: the right to see, and correct, your own federal record

AccessPoint runs first-party access and amendment under the Privacy Act of 1974 (5 U.S.C. § 552a) — acknowledgment within 10 working days, review of a refusal, and the statement of disagreement that travels with the record — pre-configured for federal systems of records and running inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

United States — Privacy Act at a glance

Access & amendment: Access records about yourself and request amendment (5 U.S.C. § 552a(d)(1)-(2))
Amendment acknowledgment: Acknowledged in writing within 10 working days; review of a refusal within 30 working days (§ 552a(d)(2)-(3))
If amendment is refused: File a statement of disagreement, noted on the record and disclosed with it (§ 552a(d)(3)-(4))
Exemptions: General exemptions (§ 552a(j)) and specific exemptions (§ 552a(k))
Charges: Copying costs only — no fee to search for or review the record (§ 552a(f)(5))
Oversight & remedies: DOJ Office of Privacy and Civil Liberties (OPCL) guidance; civil action in US district court (§ 552a(g))
Languages: English

Governing legislation

Privacy Act of 1974

5 U.S.C. § 552a

An individual's right to access and request amendment of records about themselves held in a federal "system of records", and limits on how agencies disclose those records

Access, amendment, and review

5 U.S.C. § 552a(d)

Access to your record (d)(1); a written amendment request acknowledged within 10 working days (d)(2); review of a refusal within 30 working days (d)(3); and a statement of disagreement noted on the record and provided to prior and future recipients (d)(4)

Oversight

US Department of Justice, Office of Privacy and Civil Liberties (OPCL)

OPCL provides legal advice, policy guidance, and training to federal agencies on the Privacy Act, but it does not decide individual requests. The Act is ultimately enforced by the individual: under § 552a(g) a person may bring a civil action in US district court, where access and amendment are reviewed de novo, with actual damages of at least $1,000 plus costs and attorney fees for intentional or wilful violations.

Built for United States — Privacy Act

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

First-party access and amendment

Run an individual's request to see and correct records about themselves in a federal system of records (§ 552a(d)) — the access, the amendment request, and the agency's decision — all on Microsoft 365.

Statement of disagreement

When an agency refuses to amend, run the § 552a(d)(3) review and capture the individual's concise statement of disagreement, which § 552a(d)(4) requires be noted on the record and sent to prior and future recipients.

The working-day clock

Acknowledge an amendment request within 10 working days and complete a review of a refusal within 30 working days (§ 552a(d)(2)-(3)) — computed and reminded for you.

(j) and (k) exemptions

Apply the general exemptions of § 552a(j) — CIA and criminal law-enforcement systems — and the specific exemptions of § 552a(k) line by line, on a colour-coded, audit-trailed redaction record.

FOIA / Privacy Act dual processing

Because § 552a(t) bars using a FOIA exemption to deny Privacy Act access — and the reverse — AccessPoint processes a first-party request under both statutes and records which one grants each release, for the broadest access.

In your own tenant

Every request and record stays inside your own Microsoft 365 and Azure tenant — no third-party cloud, no vendor access, and no cross-border transfers.

Access, amendment, and the statement of disagreement

The Privacy Act doesn't just let people see their federal records — it lets them correct them, and be heard when you say no.

The Privacy Act gives an individual the right to access records about themselves in a federal system of records and to request that records that are inaccurate, irrelevant, untimely, or incomplete be amended. The agency must acknowledge the request within ten working days and, if it refuses, review that refusal. If it still refuses, the individual may file a concise statement of disagreement — and § 552a(d)(4) requires the agency to note the disputed portion and disclose that statement to anyone who receives the record thereafter. AccessPoint runs that full chain and records every step.

Access your own record See records about yourself in a federal system of records (§ 552a(d)(1)).

Amend or be heard Request a correction; on a refusal, seek review (§ 552a(d)(2)-(3)).

The statement travels The § 552a(d)(4) statement of disagreement, sent to every later recipient.

Configured out of the box

Installing the us-privacy-act configuration pack seeds your tenant with everything this regime needs — a starting point you can adjust, not a lock-in.

Related guide: FOI Workflow Quick Check

The Privacy Act of 1974 (5 U.S.C. § 552a) as the legal-authority and citation spine
The federal-holiday calendar and the working-day clocks — 10 working days to acknowledge an amendment request, 30 to review a refusal
The access, amendment, review, and statement-of-disagreement workflow of § 552a(d), with the disputed-record notation and downstream-recipient notices
The general (§ 552a(j)) and specific (§ 552a(k)) exemptions, colour-coded for redaction
FOIA / Privacy Act dual-processing under § 552a(t), recording which statute grants each release
System-of-records handling — routing a first-party request to records retrieved by the individual's name or identifier (§ 552a(a)(5))
Privacy Act correspondence templates — acknowledgment, amendment decision, review, and statement-of-disagreement letters
Timeliness tracking and an audit trail built for a § 552a(g) civil action or an OPCL review

United States — Privacy Act Questions

How quickly must a federal agency act on a Privacy Act amendment request?

The agency must acknowledge the amendment request in writing within 10 working days of receipt and promptly make the correction or refuse it (§ 552a(d)(2)). If it refuses, the individual may seek review, which the agency must complete within 30 working days (extendable for good cause) (§ 552a(d)(3)). AccessPoint computes both clocks from intake and drives the workflow to a defensible close.

What makes the Privacy Act different — the statement of disagreement?

Yes. When an agency refuses to amend after review, the individual may file a concise statement of disagreement, and § 552a(d)(4) requires the agency to note the disputed portion of the record and provide that statement to anyone the record is disclosed to thereafter. Because § 552a(t) also bars relying on a FOIA exemption to deny Privacy Act access — and the reverse — AccessPoint processes each first-party request under both statutes.

What can an agency charge?

For a Privacy Act request the agency may charge only the direct cost of making the copies provided to the individual — there is no fee to search for or review the record (§ 552a(f)(5)). AccessPoint computes the copying charge and keeps it separate from any parallel FOIA fee.

Where does data reside?

Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, and audit history never leave your control — no third-party cloud, no vendor access, and no cross-border data transfers.

Run the Privacy Act of 1974 in One Platform

Try AccessPoint free for 30 days, pre-configured for the United States Privacy Act. No credit card required.

Start Free Trial