What must the notice include?

The notice must state the authority for collection, whether disclosure is voluntary or required, the principal purpose(s) for the information, routine uses or SORN cross-references, and contact information for privacy inquiries. Use precise language to avoid ambiguity and enable access requests.

When must the notice be given?

Provide the advisory notice at or before the point where PII is collected from the individual. If collection purpose or routine uses change, issue an updated notice and retain proof of delivery.

Can the notice be provided electronically?

Yes. Electronic delivery is permitted when the method reliably presents the notice at collection and preserves an auditable record of delivery; follow ESIGN and applicable agency policies for consumer disclosures and consent.

How long should records of delivery be kept?

Retain notice versions and delivery logs for the duration required by agency retention schedules and applicable federal rules; keep copies at least as long as associated records and per federal or industry retention standards.

Who enforces compliance?

Agency privacy offices and oversight entities handle internal compliance; affected individuals may seek amendment or remedies under the Privacy Act, and oversight bodies may issue findings for violations.

What happens if a notice is incorrect or missing?

An incorrect or omitted notice can lead to administrative findings, litigation risk, and remediation costs. Corrective measures include revising notices, reissuing them, and documenting steps taken to mitigate harm.

Electronic Signature
Templates
Miscellaneous
Privacy Act Advisory Notice

Privacy Act Advisory Notice

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

PRIVACY ACT ADVISORY NOTICE

Agency / Organization Name Division / Unit

System of Records Notice Number: Case / File Number:

Advisory Notice

Authority: The information requested is being collected pursuant to the agency's statutory and regulatory authorities. The collection is authorized under applicable law including 5 U.S.C. 552a and other authorities as indicated below.

Statutory or Regulatory Authority (if any)

Principal Purpose

The principal purpose for collecting the requested information is to enable the agency to carry out its responsibilities, including administration, adjudication, benefit determination, investigative and enforcement functions, and recordkeeping as necessary to accomplish agency mission-related tasks.

Describe the specific purpose for which the information will be used

Routine Uses

Routine uses of the information include disclosures that are compatible with the stated purpose(s) and necessary for the agency to perform its functions. Routine uses may include, but are not limited to:

Disclosures for administrative or adjudicative purposes within the agency or to other government entities.

Disclosures to law enforcement or regulatory authorities for enforcement, investigation, or protection of public safety.

Disclosures to contractors, consultants, or agents performing services on behalf of the agency when required to carry out the agency’s functions.

Disclosures as required for litigation, administrative proceedings, or to defend the agency in legal matters.

Other routine uses (specify if applicable)

Disclosure

Your provision of the requested information is: Mandatory Voluntary

If mandatory, cite the specific statutory or regulatory requirement that mandates disclosure:

Effect of Non-Disclosure

If you choose not to provide the requested information, the agency's ability to process your request, determine eligibility for benefits, complete an investigation, or otherwise perform its statutory functions may be limited. The specific consequences are described below.

Describe consequences of refusal to provide information

Access and Amendment

You have the right to request access to records about you and to seek amendment of those records under the Privacy Act where appropriate. Requests should be directed to the agency contact identified below. The agency will respond in accordance with applicable procedures and timeframes.

Agency Contact for Access/Amendment Requests

Safeguards and Retention

Records will be safeguarded in accordance with applicable law and agency policy to protect against unauthorized access, disclosure, alteration, or destruction. Access is limited to authorized personnel with a need to know.

Records retention and disposal schedule

Certification and Acknowledgment

By signing below, I acknowledge that I have received a copy of this Privacy Act Advisory Notice, that I understand the purposes for which the information is being collected, the routine uses that may apply, and the effect of providing or withholding the requested information. I understand my rights to access and amend records as described above.

Relationship to Subject (if signing on behalf of individual)

Printed Name:

Signature:

Date:

What the Privacy Act Advisory Notice Is

A Privacy Act Advisory Notice is a written disclosure federal agencies must provide when collecting personally identifiable information (PII) from individuals. It explains the authority for the collection, whether furnishing the information is voluntary or mandatory, the principal purpose(s) for which the information will be used, and routine uses. The notice implements the Privacy Act of 1974 (5 U.S.C. §552a) and helps individuals understand how their records will be handled, access their records, and seek correction where appropriate.

Why Including a Proper Advisory Notice Matters

A correct Privacy Act Advisory Notice ensures legal compliance, clarifies data handling practices for individuals, and reduces later disputes over collection authority or purpose. It supports transparency and helps agencies meet statutory obligations under the Privacy Act.

Who Prepares and Receives the Notice

Individuals whose PII is collected receive the notice at or before the point of collection so they understand purpose and legal basis.

Federal agencies and component programs responsible for collection and recordkeeping.
Contractors collecting PII on behalf of an agency under a contract or SOW.
Legal, privacy, and compliance staff who draft and review collection statements.

Core Elements of a Professional Advisory Notice

A complete Privacy Act Advisory Notice is concise and clearly labeled; it must state authority, purpose, routine uses, and disclosure consequences so individuals can make informed decisions.

Authority

Cite the statute, regulation, or executive order authorizing the collection (for example, 5 U.S.C. §552a) and any supplemental authority.

Purpose

Explain the principal purpose(s) for which the PII will be used, described in plain language so the subject understands how the agency will process the information.

Voluntary or Mandatory

State whether providing the information is voluntary or required by law, and note the legal consequences of refusal if applicable.

Routine Uses

List routine uses or cross-references to published System of Records Notices (SORN) explaining potential disclosures to other federal agencies or third parties.

Access and Correction

Tell individuals how to access their records and the process to request amendment under the Privacy Act and agency procedures.

Contact

Provide a named office, mailing address, phone number, or email for privacy questions and administrative appeals.

Required Information Summary

Authority: Statute or regulation

Purpose: Clear principal use

Disclosure: Voluntary or mandatory

Routine Uses: Published SORN refs

Access Rights: How to request

Contact: Privacy office info

Step-by-Step: Preparing and Issuing the Notice

Follow these practical steps to draft, review, and deliver the Privacy Act Advisory Notice at point of collection.

01

Draft Notice: Assemble authority, purpose, routine uses.
02

Legal Review: Have counsel or privacy office verify citations.
03

Placement: Provide at or before collection point.
04

Recordkeeping: Store the notice version and delivery method.

Customizing and Automating the Notice Online

Design workflows so the advisory notice appears automatically where PII is collected and routes change requests to the privacy office.

Field	Configuration
Trigger	Show notice on collection form load
Authentication	Use agency login or guest option
Delivery	Inline display plus downloadable copy
Audit Trail	Log delivery timestamp and user

Where to Send or Submit Notices and Records

Route notices and related records to the appropriate offices and systems to support access, correction, and auditability.

Privacy Office: Primary repository for privacy inquiries and logs
Records Management: Store official copies per agency retention schedules
Contract File: Place contractor-delivered notices in contract records
System of Record: Ensure SORN cross-reference is recorded with data

Digital Signing, eSubmission, and Platform Considerations

Ensure chosen platform meets federal security and accessibility requirements and preserves evidence of delivery and consent for recordkeeping.

Formats Supported: PDF, DOCX, HTML
Authentication: Email, SMS code, or agency SSO
Audit Trail: Timestamp, IP, and delivery log

Timing: When the Advisory Notice Must Be Given

Provide the advisory notice at or before the point of collection and retain evidence of delivery. Timely notice ensures informed participation and supports legal compliance.

At Collection:

Deliver the notice when PII is first collected from the individual

Prior to Consent:

Provide notice before any required consent or authorization is obtained

Policy Updates:

Issue updated notices when collection purpose or routine uses change

Record Retention:

Log delivery date and method for audit trails

Access Requests:

Maintain copies to support any Privacy Act access or amendment requests

Penalties and Risks of an Incorrect or Omitted Notice

Legal Liability: Civil damages and litigation

Administrative Sanctions: Internal corrective actions

Program Delay: Delays from rework or audits

Loss of Trust: Public and stakeholder confidence harmed

Regulatory Findings: Investigations by oversight offices

Data Misuse: Unauthorized disclosures risk harm

How This Notice Compares with a HIPAA Privacy Notice

Compare scope and applicability to understand when a Privacy Act Advisory Notice is required versus a HIPAA Notice of Privacy Practices.

Criteria	Privacy Act	HIPAA Notice
Applies To	federal agencies	covered entities
Primary Focus	records systems	protected health information
Legal Basis	5 u.s.c. §552a	hipaa rules
Consumer Rights	access/amendment rights	access/amendment + complaint procedures

eSignature Vendor Pricing Snapshot for Delivering Advisory Notices

Use eSignature platforms to deliver and record advisory notices. The table compares baseline pricing and common features across leading vendors; signNow is listed first as the initial column.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No trial	No trial	Yes, limited	Yes, limited
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About the Privacy Act Advisory Notice

Answers to common questions help ensure correct drafting, delivery, and retention of advisory notices.

Need help? Contact support

What must the notice include?
The notice must state the authority for collection, whether disclosure is voluntary or required, the principal purpose(s) for the information, routine uses or SORN cross-references, and contact information for privacy inquiries. Use precise language to avoid ambiguity and enable access requests.
When must the notice be given?
Provide the advisory notice at or before the point where PII is collected from the individual. If collection purpose or routine uses change, issue an updated notice and retain proof of delivery.
Can the notice be provided electronically?
Yes. Electronic delivery is permitted when the method reliably presents the notice at collection and preserves an auditable record of delivery; follow ESIGN and applicable agency policies for consumer disclosures and consent.
How long should records of delivery be kept?
Retain notice versions and delivery logs for the duration required by agency retention schedules and applicable federal rules; keep copies at least as long as associated records and per federal or industry retention standards.
Who enforces compliance?
Agency privacy offices and oversight entities handle internal compliance; affected individuals may seek amendment or remedies under the Privacy Act, and oversight bodies may issue findings for violations.
What happens if a notice is incorrect or missing?
An incorrect or omitted notice can lead to administrative findings, litigation risk, and remediation costs. Corrective measures include revising notices, reissuing them, and documenting steps taken to mitigate harm.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now