36 CFR §1202.54

1. (a)NARA can deny your Privacy Act request for records if the records are maintained in an exempt systems of records are described in subpart F of this part.
2. (b)A system manager may deny your request for access to your records only if:
   1. (1)NARA has published rules in the Federal Register exempting the pertinent system of records from the access requirement; and
   2. (2)The record is exempt from disclosure under the Freedom of Information Act (FOIA).
3. (c)Upon receipt of a request for access to a record which is contained within an exempt system of records, NARA will:
   1. (1)Review the record to determine whether all or part of the record must be released to you in accordance with § 1202.40, notwithstanding the inclusion of the record within an exempt system of records; and
   2. (2)Provide access to the record (or part of the record, if it is not fully releasable) in accordance with § 1202.46 or notify you that the request has been denied in whole or in part.
4. (d)If your request is denied in whole or in part, NARA's notice will include a statement specifying the applicable Privacy Act and FOIA exemptions and advising you of the right to appeal the decision as explained in § 1202.56.