FAR and DFARS › FAR Part 39: Acquisition of Information Technology › Subpart 39.1
FAR 39.105 Privacy.
The codified text (eCFR, as of 2026-10-02). Under the Revolutionary FAR Overhaul ↗, agencies follow class deviations with new text for many parts while the formal rules go through the Federal Register: check the solicitation and your contract's clauses, which rule.
In plain English
This section requires agencies to ensure that contracts for information technology protect privacy under the Privacy Act and FAR part 24. For contracts involving a system of records, the contract must include specific items such as agency rules of conduct, a list of threats, required safeguards, and Government inspection requirements. This matters because contractors working on such systems must follow these privacy protections.
Applies to: Agencies awarding contracts for information technology, especially those for a system of records using commercial IT services or support services.
What it requires
- Follow agency rules of conduct.
- Guard against anticipated threats and hazards.
- Provide specific safeguards.
- Allow Government inspection during contract performance.
Key terms: Privacy Act · system of records · information technology · rules of conduct · safeguards
Written by AI from this section's text. A guide, not legal advice: the text below rules.
The text
Agencies shall ensure that contracts for information technology address protection of privacy in accordance with the Privacy Act (5 U.S.C. 552a) and part 24. In addition, each agency shall ensure that contracts for the design, development, or operation of a system of records using commercial information technology services or information technology support services include the following:
(a) Agency rules of conduct that the contractor and the contractor's employees shall be required to follow.
(b) A list of the anticipated threats and hazards that the contractor must guard against.
(c) A description of the safeguards that the contractor must specifically provide.
(d) Requirements for a program of Government inspection during performance of the contract that will ensure the continued efficacy and efficiency of safeguards and the discovery and countering of new threats and hazards.
← 39.104 Information technology services. · 39.106 Contract clause. →
Rule changes for FAR Part 39
- Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 1, 2, 4, 33, 39, 40, and 53 ↗ · proposed 2026-06-23 · comments due 2026-07-23
- Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and Services ↗ · proposed 2026-02-17 · comments due 2026-04-20
- Federal Acquisition Regulation: Strengthening America's Cybersecurity Workforce ↗ · proposed 2025-01-03 · comments due 2025-03-04
- Federal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign Entities ↗ · final rule 2024-12-30
- Federal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign Entities ↗ · final rule 2024-11-12 · effective 2024-11-12
- Federal Acquisition Regulation; Technical Amendments ↗ · final rule 2024-04-22 · effective 2024-05-22
- Federal Acquisition Regulation: Sustainable Procurement ↗ · final rule 2024-04-22 · effective 2024-05-22
Source: eCFR, 48 CFR chapters 1 and 2 (GPO GovInfo bulk data) ↗. Plain words for the terms: glossary.