25 CFR §515.5

1. (a)Acknowledgement of requests. Upon receipt of a request, the Privacy Act Officer ordinarily shall, within 20 working days, send an acknowledgement letter which shall confirm the requester's agreement to pay fees under § 515.9 and provide an assigned request number.
2. (b)Grants of requests for access. Once the Privacy Act Officer makes a determination to grant a request for access in whole or in part, it shall notify the requester in writing. The notice shall inform the requester of any fee charged under § 515.9 of this part and the Privacy Act Officer shall disclose records to the requester promptly on payment of any applicable fee. If a request is made in person, the Privacy Act Officer will disclose the records to the requester directly, in a manner not unreasonably disruptive of its operations, on payment of any applicable fee and with a written record made of the grant of the request. If a requester is accompanied by another individual, the requester shall be required to authorize in writing any discussion of the records in the presence of the other person.
3. (c)Adverse determinations of requests for access. If the Privacy Act Officer makes any adverse determination denying a request for access in any respect, it shall notify the requester of that determination in writing. The notification letter shall be signed by the official making the determination and include:
   1. (1)The name and title of the person responsible for the denial;
   2. (2)A brief statement of the reason(s) for the denial, including any Privacy Act exemption(s) applied to the denial;
   3. (3)A statement that the denial may be appealed under § 515.7 and a description of the requirements of § 515.7.