Privacy Act system of records vs records retention schedule: how are they different and do I need both?

A Privacy Act system of records and a records retention schedule answer two different questions about the same information. One governs how personal information may be collected, used, and disclosed; the other governs how long records are kept and what eventually happens to them. They overlap, but neither replaces the other.

What each one does

A Privacy Act system of records is a concept from the federal Privacy Act of 1974. A “system of records” is any group of records under an agency’s control from which information is retrieved by an individual’s name or another personal identifier. When an agency maintains such a system, the Privacy Act generally requires it to publish a System of Records Notice (SORN) describing what data is collected, why, who can access it, and the routine uses for which it may be disclosed. Its purpose is protecting individual privacy and limiting misuse of personal data.

A records retention schedule is a records-management instrument. It identifies categories of records and specifies how long each must be retained and its final disposition, whether destruction or transfer to an archive. Its purpose is ensuring records exist as long as they are legally, operationally, or historically needed, and are not kept indefinitely without justification.

How they differ

• Authority and trigger: A SORN is triggered by retrieving information using a personal identifier. A schedule applies to records regardless of whether they contain personal data.
• Focus: The SORN focuses on privacy, access, and disclosure. The schedule focuses on time, value, and disposition.
• Coverage: Many scheduled records contain no personal data at all, so they need a schedule but no SORN.

Do you need both?

Often, yes. If a system contains personal information retrieved by identifier, you typically need a SORN to satisfy privacy obligations and a retention schedule to lawfully keep and dispose of those same records. A SORN may state a retention period, but it does not substitute for an approved schedule, and a schedule does not satisfy Privacy Act notice and disclosure requirements. Treat them as complementary controls: privacy governance plus lifecycle governance, working together over the same data.

For more on managing personal information across its lifecycle, see the privacy and PII topic hub.