• Federal contractors whose employees have access to or work with personally identifiable information (PII) must be properly trained in how to safeguard such information. Employees who do not complete the appropriate training may not handle PII.

The Federal Acquisition Regulation 24.301 requires federal contractors to provide training to employees who:

• Have access to records under the control of a federal agency where information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying item assigned to an individual;
• Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle PII on behalf of the federal agency; or
• Design, develop, maintain, or operate a system of records as part of work for a federal agency.

This training must help employees understand how to safeguard personally identifiable information (PII) and must be tailored to the roles of individual employees. Such training must address:

• The provisions of the Privacy Act of 1974, including penalties for violating the Act;
• How to appropriately handle PII;
• What constitutes authorized and unauthorized use of applicable records and PII; and
• Procedures to be followed if a data breach is suspected or confirmed.

Employees of federal contractors who do not complete this training may not handle PII or design, maintain, or operate a system of records. The training must be provided for newly hired employees and annually thereafter.