Appendix 5 - NARA Directive 1609_Initial Privacy Reviews and Privacy Impact Assessment.pdf

This is a NARA (National Archives and Records Administration) directive (NARA 1609) providing procedures and requirements for conducting Initial Privacy Reviews (IPRs) and Privacy Impact Assessments (PIAs) for IT systems and electronic information collections. The directive outlines the purpose, authorities, and process for reviewing and assessing privacy risks in NARA's information technology systems, with specific guidance for various organizational roles including the Chief Information Officer, Senior Agency Official for Privacy, and system owners.

Key requirements include conducting an IPR before connecting a system to NARA's network or collecting identifiable information, completing a PIA for all IT systems found to contain personally identifiable information (PII), and addressing specific aspects such as information collection methods, access controls, information sharing, and administrative safeguards. The directive references multiple federal statutes including the Privacy Act, Freedom of Information Act, and E-Government Act, and mandates that approved PIAs be published on NARA's privacy web page. System owners must submit draft PIAs to the Senior Agency Official for Privacy for review, with final approval from the Chief Information Officer.