(a) If the Privacy Act of 1974 (Privacy Act) applies to a contract, the contracting officer must specify in the contract the disposition to be made of the system or systems of records upon completion of performance. For example, the contract may require the contractor to completely destroy the records, to remove personal identifiers, to turn the records over to ED, or to keep the records but take certain measures to keep the records confidential and protect the individual's privacy.

(b) If a notice of the system of records has not been published in the Federal Register, the contracting officer may proceed with the acquisition but must not award the contract until the notice is published, unless the contracting officer determines, in writing, that portions of the contract may proceed without maintaining information subject to the Privacy Act. In this case, the contracting officer may—

(1) Award the contract, authorizing performance only of those portions not subject to the Privacy Act; and

(2) After the notice is published and effective, authorize performance of the remainder of the contract.