System of Records Notice (SORN)

A System of Records Notice (SORN) is the formal, publicly published description an agency issues when it maintains a “system of records” — any group of records from which information is retrieved by an individual’s name or a personal identifier. The notice explains the system’s purpose, the categories of individuals and data covered, the routine uses for which information may be disclosed, and the applicable retention and disposition practices.

SORNs matter in recordkeeping because they tie privacy accountability directly to how PII is collected, retrieved, retained, and eventually destroyed or transferred. A records program cannot manage an in-scope system lawfully until its SORN is current, and changes to data elements or uses generally require an updated notice before the system operates.

For example, a personnel database searchable by employee name is a system of records and needs a SORN, while a building log filed only by date — not retrievable by person — typically is not. This distinction, retrievability by identifier, is the practical test that separates covered systems from ordinary files.