Digital SBA, SBA guidance, AI inventory, Made in America waivers, and more.
Digital SBA
Learn about SBA’s efforts to improve its online capabilities and offerings.
SBA guidance
Learn about SBA guidance documentation and find quick guidance links.
AI inventory
Executive Order 14110 directs government agencies to list any uses of artificial intelligence.
Made in America waivers
SBA is required to post any Made in America law waivers, along with detailed explanations.
SMS terms and conditions
Learn how SBA uses text messages to communicate, our terms, and how to opt out if needed.
SBA privacy program
SBA works to balance the government’s need for individual data with the individual’s right to protect their privacy.
Privacy Act System of Record Notices (SORNs)
This list serves as SBA’s notice of each system of records that it maintains.
Privacy Act request guide
Use this guide to get familiar with the procedures for submitting a Privacy Act request to SBA.
Digital SBA
The following efforts support the federal government’s aim to enable more efficient and coordinated delivery of digital information across the federal space.
In 2012, the federal Chief Information Officer (CIO) released a directive entitled “Digital Government: Building a 21st Century Platform to Better Serve the American People,” which aims to deliver the general public and our government workforce access to government information and services on demand and on any device.
The SBA Strategic Plan is working to provide better access to information and to improve customer outreach and education. The SBA Information Resources Management (IRM) Strategic Plan directly aligns with goals from the SBA Strategic Plan and reflects the agency’s dedication to optimizing and maintaining SBA’s IT infrastructure, identifying areas for IT efficiency and innovation, and investing in the IT workforce. SBA’s efforts in increasing use of digital services and automation, in many instances, has been at the forefront and will build upon the U.S. Digital Government Strategy issued on May 23, 2012.
The Bureau IT Leadership Directory for the Small Business Administration provides a directory of all SBA officials with the title of CIO or duties of a CIO.
| Name | Employment Type | Type of Appointment | Other Responsibilities | Eval Rating Title | Eval Reviewing Title | Key Bureau CIO |
|---|---|---|---|---|---|---|
| Hartley Caldwell | SES | General Political Appointee | Chief Information Officer | CIO | CIO | Yes |
| Hartley Caldwell | SES | General Political Appointee | Chief AI Officer | CIO | CIO | Yes |
| Doug Robertson | SES | Career | Deputy Chief Information Officer |
To support the Foundations for Evidence-based Policymaking Act (2019), Office of Management and Budget (OMB) Memo M-19-23, and the Federal Data Strategy, SBA posts information about the following officials and publishes agency data governance materials. Learn more about SBA’s program evaluation function.
| Name | Position | Type of Appointment | Official Title |
|---|---|---|---|
| Anna Maria Calcagno | Chief Data Officer | Career | Director, Office of Strategic Management and Enterprise Integrity |
| Shabori Sen | Evaluation Officer | Career | Director, Analysis and Evaluation Division |
| Anna Maria Calcagno | Statistical Official | Career | Director, Office of Strategic Management and Enterprise Integrity |
To support OMB M-19-17 on identity, credential, and access management (ICAM) that consolidates and updates previous policies, SBA has created agency-wide ICAM governance and services. These ensure secure and efficient operations by identifying, credentialing, monitoring, and managing subjects that access federal resources, including information, information systems, facilities, and secured areas across their respective enterprise.
| Name | Position | Type of Appointment | Official Title |
|---|---|---|---|
| ICAM Chair | |||
| Hartley Caldwell | ICAM Vice-Chair | General Political Appointee | Chief Information Officer |
| Nathan Davis | Core Member | Career | Chief Financial Officer |
| Mike Post | Core Member | Career | Chief Information Security Officer (Acting) |
| John Serpa | Advisory Member | Career | Chief Human Capital Officer |
| Anna Calcagno | Advisory Member | Career | Chief Data Officer |
| Nauman A. Ansari | Advisory Member | Career | Senior Procurement Executive |
The CIO governance board membership list for SBA provides information about SBA CIO’s membership in governance boards.
| Governance Board | Program Code | Bureau Code | CIO Involvment |
|---|---|---|---|
| Investment Review Board (IRB) | None | 00 | SBA developed the Business Technology Investment Council (BTIC) to serve as SBA’s IRB. In addition, the BTIC is established as the principal governance body in managing SBA IT investments. Also, the BTIC is responsible for implementing key provisions of the Clinger-Cohen Act (Information Technology Management Reform Act of 1996), 40 USC §1101 et seq and in particular, 40 USC §11312 concerning on Capital Planning and Investment Control (CPIC), and 40 USC §11315 (C) (2), which charges agencies’ CIOs with the duty to, monitor the performance of information technology programs of the agency, evaluate the performance of those programs on the basis of the applicable performance measurements and advise the head of the agency regarding whether to continue, modify or terminate a program or project. The BTIC is co-chaired by CIO and CFO. |
| Architecture Review Board (ARB) | None | 00 | The OCIO-ARB supports the process of researching, investing, architecting, and implementing IT capabilities and services. Its purpose is to review all business and technical requirements for capabilities and services related to Information Systems and to provide an efficient means of (a) acquiring new and (b) enhancing existing COTS and Custom Information Systems within SBA’s Business System environment. |
IT Reform Cost Savings/Avoidance for SBA provides information about cost savings and/or avoidances realized from IT reforms. Cost savings/avoidance are reported per OMB Circular A-131. Cost savings represent reductions in actual expenditures below the projected level of costs to achieve a specific objective. Cost avoidance represents an action taken in the immediate time frame that will decrease costs in the future.
| Year | Contract Re-scopingOMB Initiative: Other | Reduce IT Infrastructure Service & SupportOMB Initiative: Commodity IT | Data Center OptimizationOMB Initiative: Data Center | Reduce IT Infrastructure Service & SupportOMB Initiative: Software License Management |
|---|---|---|---|---|
| 2012 ($M) | 0 | 0 | 0 | 0 |
| 2013 ($M) | 0 | 0 | 0 | 0 |
| 2014 ($M) | 1 | 2 | 0 | 0 |
| 2015 ($M) | 0 | 0 | 0 | 0 |
| 2016 ($M) | 0 | 0 | 0 | 0 |
| 2017 ($M) | 0.38 | 4.697 | 0.975 | 0 |
| 2018 ($M) | 0 | 2.231 | 0.055 | 0.565 |
| 2019 ($M) | 0.2 | 0.959 | 0.171 | 0.498 |
| 2020 ($M) | 0.355 | 0 | 0.009 | 0.4 |
The DCOI Strategic Plan covers SBA efforts to transition to more efficient infrastructure, such as cloud services and inter-agency shared services; to leverage technology advancements to optimize infrastructure; and to provide quality services for the public good.
Optimization Metrics
| Fiscal year | Energy Metering Planned | Energy Metering Achieved | Virtualization Planned | Virtualization Achieved | Under-Utilized Servers Planned | Under-Utilized Servers Achieved | Availability Planned | Availability Achieved |
|---|---|---|---|---|---|---|---|---|
| FY 2019 | 1 | 1 | 204 | 204 | 134 | 89 | 99.90% | 99.93% |
| FY 2020 | 1 | 1 | 50 | 50 | 119 | 45 | 99.90% | 99.96% |
| FY 2021 | 1 | 1 | 55 | 55 | 100 | 40 | 99.90% | 99.90% |
Cost Savings (in Millions of Dollars)
| Fiscal Year | Reduced Power Consumption Planned | Reduced Power Consumption Achieved | Repurposed Contracts Planned | Repurposed Contracts Achieved | Total Planned | Total Achieved |
|---|---|---|---|---|---|---|
| FY 2016 | 0 | 0 | 0 | 0 | 0 | 0 |
| FY 2017 | 0.04 | 0.049 | 0.926 | 0.926 | 0.966 | 0.975 |
| FY 2018 | 0.065 | 0.055 | 0.926 | 0 | 0.991 | 0.055 |
| FY 2019 | 0.03 | 0.01 | 0 | 0.161 | 0.03 | 0.171 |
| FY 2020 | 0.004 | 0.009 | 0 | 0 | 0.004 | 0.009 |
| FY 2021 | 0 | 0 | 0 | 0 | 0 | 0 |
Data Center Closures by Year
| Fiscal year | # Cumulative Tiered Closures Planned | # Cumulative Tiered Closures Achieved |
|---|---|---|
| FY 2016 | 0 | 0 |
| FY 2017 | 0 | 0 |
| FY 2018 | 0 | 0 |
| FY 2019 | 1 | 1 |
| FY 2020 | 1 | 1 |
| FY 2021 | 0 | 0 |
Learn more about SBA’s activities to make data resources available for public use and to improve its online capabilities and offerings in the areas of services, mobility, engagement, and security. Access resources related to agency data and to the federal government policies and directives for opening data to the public. Find data.
SBA will continue to mature and integrate effective security and privacy measures into the design and use of new technologies and solutions, including mobile devices, applications, and wireless networks. SBA is working diligently to continuously enhance the security of its data assets to protect against risks and ensure the availability, integrity, confidentiality, and continuity of its digital services and resources.
The Business Technology Investment Council (BTIC) and the Business Technology Investment Advisory Committee (BTI-AC) are the executive oversight bodies for the Small Business Administration’s (SBA) Information Technology Investment Management (ITIM) processes and transformational Business processes which constitute the agency’s Enterprise Architecture (EA). In direct response to the Digital Strategy Milestone #4.2 outlined in the, May 23, 2012 Digital Government: Building a 21st Century Platform to Better Serve the American People strategy document, SBA has decided to incorporate digital services into these two governing bodies existing policies and procedures. Both the BTIC and BTI-AC have updated their defined scope of authority, core principles and roles and responsibilities to reinforce the establishment of the agency’s commitment to digital services governance structure to:
- Set specific measurable goals for delivering better services at lower costs
- Establish agency-wide standards for content lifecycle management, adoption of third-party online tools, mobile application delivery and sharing (infrastructure and digital information)
Currently, SBA is developing a supplemental document for formal review and approval that will serve as an appendix to our existing BTIC Charter. This document will serve as both a process document and a checklist that the BTIC membership will use to review all existing and new investments to ensure that they provide valued services, interoperability, and openness to provide the best tools and information to the American public.
SBA guidance
About SBA guidance
SBA’s guidance documents provide important background on applicable policies, help clarify standards and expectations for various agency audiences, and offer suggested best practices related to SBA’s mission.
Guidance documents represent SBA’s current thinking on a topic. Unless otherwise provided in statute, regulation, or contract/agreement, guidance documents lack the force and effect of law.
When SBA develops a significant guidance document, the public will be afforded the opportunity to provide comments on the draft document. If you would like to comment on a specific guidance document, contact GuidanceDocuments@sba.gov. Please be sure to include the title and number of the document you are commenting on.
This page was created in compliance with Executive Order 13891, which calls for agencies to provide a searchable public index of all relevant guidance documents.
The following types of guidance documents are made available to the public but are typically prepared for lenders, SBA employees, and various agency partners:
- Standard Operating Procedures (SOPs): SOPs are permanent directives that set forth the policies and procedures relating to SBA’s programs and activities.
- Policy notices: Policy notices are used to convey a change in policy. Policy notices may be temporary or permanent.
- Procedural notices: Procedural notices are used to convey a change in process or procedures. Procedural notices may be temporary or permanent.
- Other guidance: These consist of other guidance such as SBA Program Guides, certain Federal Register publications, and SBIC TechNotes.
- Business loan program improvements: 7(a) and 504 highlights
AI inventory
Artificial intelligence (AI) is a tool that can drive the growth of the United States economy and improve the quality of life of all Americans. The United States has long been at the forefront of AI innovation, driven by the strength of our free markets, world-class research institutions, and entrepreneurial spirit. Executive Order (EO) 14179, Removing Barriers to American Leadership in Artificial Intelligence, directs federal agencies to develop and submit to the President an action plan to sustain and enhance America’s global AI dominance in order to promote human flourishing, economic competitiveness, and national security.
In support of the Office of Management and Budget Memorandum M-25-21, SBA has compiled a full AI use case inventory, as well as a consolidated AI use case inventory, which contains estimated license counts across SBA-wide use case categories.
Made in America waivers
The Build America, Buy America Act (Pub. L. No. 117-58, §§ 70901-52) was created to bolster America’s industrial base, protect national security, and support high-paying jobs. It ensures that funds are not allocated for any federal financial assistance program for infrastructure unless the project uses American materials.
In some situations, agencies can issue waivers for exceptions to the Made in America Laws. Agencies must post waivers and detailed explanations online, allowing at least 15 days for public comment.
You can find more information about these policies and the waivers proposed by federal agencies at madeinamerica.gov.
Current SBA waivers
SBA does not have any waivers.
If you are a current SBA grantee and you wish to request a waiver of the Buy America requirements, please contact your SBA program office.
SMS terms and conditions
How we use SMS
SBA’s Disaster Assistance program allows you to opt in to receive text messages (SMS/MMS) to your mobile number.
These messages may include answers to inquiries you’ve made, real-time texts to ask and answer questions about our services and pricing, and appointment confirmations. The message frequency will vary depending on the conversation.
We will not use your phone number to track you or for any kind of commercial marketing. SBA will never give out your number to any outside party.
We will never charge you for text message alerts, but carrier message and data rates may apply. Carriers are not liable for delayed or undeliverable messages.
You can opt out of receiving messages by texting “STOP” to the phone number you used to sign up.
Once we receive your request, we will send you a reply to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us.
You can opt in again by texting “START” to the phone number you used to sign up, and we will resume sending SMS messages to you.
You can get help at any time by texting “HELP” to the phone number you used to sign up, or by calling our IT support help desk at 855-448-4357.
If you have any questions, please read our privacy policy or contact us at PrivacyOfficer@sba.gov
SBA privacy program
Introduction to the Privacy Act
The purpose of the Privacy Act is to balance the government’s need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy resulting from the collection, maintenance, use, and disclosure of personal information. In general, the Privacy Act focuses on four basic policy objectives:
- To restrict disclosure of personally identifiable records maintained by agencies
- To grant individuals increased rights of access to agency records maintained on them
- To grant individuals the right to seek amendment of agency records maintained on them upon showing that the records are not accurate, relevant, timely, or complete
- To establish a code of “fair information practices” which requires agencies to comply with statutory norms for collection, maintenance, and dissemination of records
The Privacy Act applies only to U.S. citizens and aliens who are lawfully admitted for permanent residence in the United States. It applies only to personal information maintained by agencies in the executive branch of the federal government.
The Privacy Act pertains only to information that is maintained in a “system of records,” which the Act defines as a group of agency-controlled records from which information is retrieved by a unique identifier, such as an individual’s name, date of birth, social security number, or employee identification number. The Privacy Act further defines a “record” as any individually identifiable set of information that an agency might maintain about a person. Such records may include a wide variety of personal information including, but not limited to, information about education, financial transactions, medical history, criminal history, or employment history. However, the Privacy Act explicitly states that agencies may not maintain information about how individuals exercise their First Amendment rights, unless maintenance of that information is specifically authorized by statute, by the individual about whom the record is maintained, or relates to a law enforcement activity.
SBA’s System of Records Notices (SORNs) are published in the Federal Register and are available online at the GPO govinfo website.
The Computer Matching and Privacy Protection Act of 1988 further expands the matching of records established in the Privacy Act. Federal agencies are required to enter into written agreements with other agencies before disclosing records for use in the computer matching programs. Matching must be done with at least two automated systems and excludes certain programs and conditions.
- Computer Matching Agreement Between U.S. Small Business Administration and U.S. Department of Homeland Security, Federal Emergency Management Agency
- Computer Matching Agreement Between U.S. Small Business Administration and U.S. Department of Veteran Affairs (VA)
- U.S. Small Business Administration Computer Matching Program Waiver with Bureau of the Fiscal Service, U.S. Department of the Treasury’s Do Not Pay Working System
As of March 2024, the Computer Matching Agreement between Department of Housing and Urban Development and U.S. Small Business Administration Loan Systems has expired. New efforts are suspended until further notice.
SBA conducts assessments of all new and revised information systems. These Privacy Impact Assessments detail how SBA addresses privacy concerns and safeguards information.
There are two general and seven specific exemptions in the Privacy Act. The two general exemptions cover:
- All records maintained by the Central Intelligence Agency (not applicable to SBA)
- Selected records maintained by an agency or component thereof which performs as its principal functions any activity pertaining to the enforcement of criminal laws (only used by SBA’s Office of the Inspector General)
In addition, the Privacy Act provides seven specific exemptions:
- Information that is properly classified in the interest of national defense or foreign policy.
- Investigatory material compiled for law enforcement purposes not covered by the general exemptions. The specific law enforcement exemption is limited when—as a result of the maintenance of the records — an individual is denied any right, privilege, or benefit to which he or she would be entitled by federal law or for which he or she would otherwise be entitled. In such cases, disclosure is required except where it would reveal the identity of a confidential source who furnished information to the government under an express promise that the identity of the source would be held in confidence.
- Information maintained in connection with providing protective services to the President of the United States or other individuals who receive protection from the Secret Service.
- Information required by statute to be maintained and used solely as statistical records.
- Investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for federal civilian employment, military service, federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence.
- Testing or examination material used solely to determine individual qualifications for appointment or promotion in the Federal Service, but only to the extent that the disclosure of such material would compromise the objectivity or fairness of the testing or examination process.
- Evaluation material used to determine potential for promotion in the armed services, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence.
We take your privacy seriously and have created a process by which you can formally file a complaint with our Chief Privacy Officer.
Privacy complaints we can help with
We accept written complaints about:
- How SBA collects or uses personal information
- How, when, and with whom SBA shares personal information
- The type(s) and/or amount of personal information SBA collects
- Any other concern(s) you may have about how SBA handles personal information and/or its impact(s) on personal privacy
Complaints about the privacy of a business entity, a corporation, or any entity other than a person are not covered by our privacy complaint procedures.
Please keep in mind that Privacy Act requests for access, amendment, or correction are not privacy complaints – filing a complaint does not negate or replace your right to seek judicial relief under the Privacy Act or other federal laws for violations of individual privacy rights.
Submit a privacy complaint
To submit a complaint, you can write a letter that includes:
- Your name
- A summary of your complaint or a written description of the specific circumstances
- A summary of other steps taken, if any, by you or SBA to resolve this complaint
- A preferred method of contact about your complaint — a mailing address, telephone number, email address or fax number
Send us the letter by email to Privacyofficer@sba.gov or by regular mail to:
U.S. Small Business Administration
Attention: Privacy Officer
409 3rd St. SW, Fourth floor
Washington, DC 20416
Evaluation procedure
We will send you an acknowledgement letter within five business days of our receipt of your complaint. We will review and categorize the complaint as: Process and procedural, redress, operational or referral (we will refer it to the right office or federal agency if we’re not the right ones to address the issue).
The Chief Privacy Officer will recommend any necessary actions in response to the complaint. We’ll let you know once your complaint is closed and, in general, include what, if any, action we’re taking in response to the complaint.
Our goal is to review and close complaints within 20 business days. For complaints that we’ll need more than the normal time to close, we’ll contact you to give a status update.
Contact privacy officials
Contact Douglas Robertson, (Acting) Chief Information Officer and Senior Agency Official for Privacy by email at privacyofficer@sba.gov or regular mail at:
U.S. Small Business Administration
Attention: Privacy Officer
409 3rd St. SW, Fourth floor
Washington, DC 20416
Privacy Act System of Record Notices (SORNs)
The Privacy Act of 1974 (5 U.S.C. 552a) requires each Federal agency to publish a notice in the Federal Register of each system of records that it maintains. A system of records is any grouping of information about an individual under the control of a Federal agency from which it retrieves information by the name, Social Security number, or some other personal identifier, including number or symbol assigned to an individual.
SBA’s SORNS are published in the Federal Register and are available online at the GPO govinfo website.
- SBA 1—Administrative Claims
- SBA 2—Administrator’s Executive Secretariat Files
- SBA 3—Advisory Council Files
- SBA 4—Office of Inspector General Records Other Than Investigations Records
- SBA 5—Business and Entrepreneurial Initiatives for Small Businesses
- SBA 6—Civil Rights Compliance Files
- SBA 7—Combined Federal Campaign
- SBA 8—Correspondence and Inquiries
- SBA 9—Cost Allocation Data System
- SBA 10—Employee Identification Card Files
- SBA 11—Entrepreneurial Development–Management Information System
- SBA 12—Equal Employment Opportunity Pre-Complaint Counseling
- SBA 13—Equal Employment Opportunity Complaint Cases
- SBA 14—Freedom of Information and Privacy Acts Records
- SBA 15—Employee Disputes and Appeals
- SBA 16—Investigative Files
- SBA 17—Investigations Management Information System
- SBA 18—Legal Work Files on Personnel Cases
- SBA 19—Litigation and Claims Files
- SBA 20—Disaster Loan Case File
- SBA 20 (Mod.)—Disaster Loans Case Files
- SBA 21—Loan Systems
- SBA 22—Outside Employment Files
- SBA 23—Payroll Files
- SBA 24—Personnel Security Files
- SBA 25—Portfolio Reviews
- SBA 26—Power of Attorney Files
- SBA 27—Employee Misconduct Files
- SBA 28—Small Business Person and Advocate Awards
- SBA 29—Standards of Conduct Files
- SBA 30 – Government Contracting and Business Development
- SBA 30 (Mod.) – Government Contracting and Business Development
- SBA 31—Temporary Disaster Employees
- SBA 32—Tort Claims
- SBA 33—Travel Files
- SBA 34—Identity Management System
- SBA 35—Non-Employment Related Background Checks
- SBA 36—Suspension and Debarment Files
- SBA 38—TechNet
- SBA 39 — Veteran Programs Training and Counseling Records
- SBA 39 (Mod.) — Veteran Programs Training and Counseling Records
- SBA 40 — Small Business Investment Company Information System
- SBA 40 (Mod.) – Small Business Investment Company Information System
- SBA 41 – SBA Insider Threat Program System of Records Notice
- SBA 42 – Reasonable Accommodations, Personal Assistance Services, and Medical/Religious Exceptions
- SBA major Privacy Act SORNs revisions, 2004
Privacy Act Request Guide
SBA does not charge fees for search or review of records disclosed from a Privacy Act system of records requested by the individual to whom the record pertains, and provides a single copy free for the requester’s review. However, for copies of records disclosed from Privacy Act Systems of Records under the FOIA, fees applicable to processing FOIA requests are charged as described in SBA regulations part 102.6.
Once SBA has processed a request, a written initial determination letter will be provided. This letter will advise whether SBA is withholding any information pursuant to one or more of the exemptions to the Privacy Act (as discussed below).
There are two general and seven specific exemptions in the Privacy Act. The two general exemptions cover:
- All records maintained by the Central Intelligence Agency (not applicable to SBA)
- Selected records maintained by an agency or component thereof which performs as its principal functions any activity pertaining to the enforcement of criminal laws (only used by SBA’s Office of the Inspector General).
In addition, the Privacy Act provides seven specific exemptions:
- Information that is properly classified in the interest of national defense or foreign policy;
- Investigatory material compiled for law enforcement purposes not covered by the general exemptions. The specific law enforcement exemption is limited when — as a result of the maintenance of the records — an individual is denied any right, privilege, or benefit to which he or she would be entitled by federal law or for which he or she would otherwise be entitled. In such cases, disclosure is required except where it would reveal the identity of a confidential source who furnished information to the government under an express promise that the identity of the source would be held in confidence.
- Information maintained in connection with providing protective services to the President of the United States or other individuals who receive protection from the Secret Service;
- Information required by statute to be maintained and used solely as statistical records;
- Investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for federal civilian employment, military service, federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence;
- Testing or examination material used solely to determine individual qualifications for appointment or promotion in the federal service, but only to the extent that the disclosure of such material would compromise the objectivity or fairness of the testing or examination process;
- Evaluation material used to determine potential for promotion in the armed services, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the government under an express promise that the identity of the source would be held in confidence.
Upon receiving SBA’s initial determination letter, a requester will have 60 calendar days to submit an appeal if SBA has decided to deny a Privacy Act request for:
- Access to records
- Amendment or correction of records
All appeals must be made in writing, directed to this office as identified in SBA’s initial determination letter, and addressed as follows:
FOI/PA Office
U.S. Small Business Administration
409 3rd St., SW
Washington, DC 20416
This office will make a determination in writing. A decision affirming an adverse determination in whole or part will include a brief statement of the reason(s), include any Privacy Act exemptions applied and inform the requester of the Privacy Act provisions for court review of the decision. If the adverse determination is reversed or modified in whole or part, we will notify the requester that their request will be reprocessed in accordance with the appellate decision.
Federal laws and guidelines
- The E-Government Act of 2002, Sec. 208 on Privacy Provisions (see Appendix B)
- The Privacy Act of 1974 (5 U.S.C. 552a)
- Office of Management and Budget (OMB) Circular A-130: Management of Federal Information Resources, Appendix I on Maintaining Records About Individuals
- Office of Personnel Management Privacy Act Regulations on Personnel Records (5 CFR 297)
- SBA’s Freedom of Information Act website
- List of Department of Justice Privacy Act resources
- Freedom Of Information Act (FOIA) references
Website privacy requirements
- OMB privacy policy for federal websites
- Federal Trade Commission guidelines on complying with the Children’s On-Line Privacy Protection Act (when websites are directed to children 13 years and under)
- OMB guidelines on the E-Government Act of 2002, Sec. 208 on Privacy Provisions
Other laws and guidelines that support the Privacy Act
Under the Privacy Act, you may request:
- Access to records pertaining to youand contained in a Privacy Act system of records,
- An accounting of SBA disclosures of your personal information to others, and/or
- Correction or amendment of records about you that are maintained in a Privacy Act system of records.
You may also make requests on behalf of a minor child if you are the child’s parent or legal guardian and demonstrate that you are acting in the child’s best interests.
To avoid delays in processing, your request should include three basic elements:
- State that access is sought or requesting correction/amendment of records under the Privacy Act (or under the Privacy Act and the FOIA, as described above).
- Include your name, address, date of birth, employee identification number (if any), signature, and proof of identity (as discussed below).
- Describe the requested records or information as specifically as possible. Whenever possible, SBA’s Privacy Act systems of records should be identified that you want the agency to search.
Where to submit a Privacy Act request
You may submit a written and signed Privacy Act request to SBA in person or by mail or facsimile (fax) to the field or program office you believe maintains the records you seek or to our office. Addresses for all SBA program and field offices are available on our website. Privacy Act requests must be submitted to each agency individually. To find the correct agency, search FOIA.gov. Privacy Act requests may be submitted via fax or hard copy, since a signature must accompany Privacy Act requests.
When our office receives a Privacy Act request, we will provide the requester with a written acknowledgment of receipt of their request. The letter will indicate the name and telephone number of the SBA office where their request is being referred and whom they should contact if there are questions regarding the processing and/or status of the request. An SBA program or field office that receives a request directly will process it if it determines that it is the correct office. If the receiving office determines that it is not the best office to process the request, the requester will be notified as to which SBA office(s) will respond to their request.
Processing depends on whether the requester is seeking access to, or requesting correction/ amendment of your records, as follows:
- Access to records: The system manager for the Privacy Act system(s) of records identified in the request or who is likely to have the responsive records will search for responsive records. Ordinarily the search will include only those records that are in the possession of the office as of the date that office begins its search for them. The system manager will determine whether access can be granted, prepare the agency response that is sent and provide a copy of any releasable records; and,
- Corrections or amendments: The system manager who has control of the record(s) sought for correction or amendment, shall determine whether to authorize or deny the request and prepare the agency response that is sent.
The Privacy Act does not impose a response time for agency responses to requests. However, SBA’s regulations establish that it will send a written acknowledgement of receipt of a request within 10 working days and that a requester will be notified of the agency determination on their Privacy Act request within 30 working days of receipt of the request. SBA has a statutory responsibility to respond to a correction or amendment request within 10 working days.
If a requester is still in disagreement with the agency’s decision regarding their appeal of a denial related to correction or amendment of the specified record(s), they may submit a written statement of disagreement to the office that maintains the record involved. That office will mark the original record to indicate that the information is disputed, that a statement of disagreement exists, and where the statement of disagreement is located within the system of records.
If a requester has filed an appeal and/or a statement of disagreement, but they still believe that SBA has not handled their request in accordance with the Privacy Act, they have the right to challenge the agency’s decision in a lawsuit. The appellate response from this office will inform the requester that they may file their suit in the district court of the United States in the district in which they reside or have a principal place of business, the district in which the relevant agency records are maintained, or the District of Columbia.
The Privacy Act also provides a civil remedy whenever an agency fails to maintain records in a manner that is accurate, complete, timely, and/or relevant, as is necessary to ensure fairness in any agency determination, in the event that the agency makes a determination that is adverse to an individual’s interests. They may also sue an agency for failing to comply with any other provision of the Privacy Act in a manner that adversely affects them.
The privacy regulations for this office are set forth in Title 13, Part 102, Subpart B, of the Code of Federal Regulations.
An individual may submit a Privacy Act request for information only if they are a U.S. citizen or an alien who has been lawfully admitted for permanent residence in the United States.
In addition, they may only request information from SBA that is maintained in any of SBA’s Privacy Act Systems of Records Notices. These systems contain information regarding various categories of individuals including, but not limited to, current and former SBA employees, contractors, consultants, clients, applicants, and licensees.
An individual may request access to records concerning a minor child, if they are the child’s parent or legal guardian and demonstrate that they are acting in the child’s best interests. In addition, an individual may request access to records concerning another eligible individual, as long as they can provide verifiable written authorization from that person designating them as a representative acting on his or her behalf. However, any individual who willfully requests or obtains any information under false pretenses is guilty of a misdemeanor and may be fined up to $5,000, pursuant to 5 U.S.C. 552a(i)(3).
This office has responsibility for both the Privacy Act and the Freedom of Information Act (FOIA), which establishes a presumption that any person has the right to request access to records in the possession of the executive branch of the federal government.
While the two acts are considered companion acts, they have different procedures and exemptions. Consequently, information that is exempt from disclosure under one act may be disclosable under the other. In order to take maximum advantage of both acts, you should cite both laws when requesting access to SBA records that contain information only about yourself. When requesting records that contain information about other individuals or entities, only the FOIA applies.
It is SBA’s policy to automatically handle requests in a manner that maximizes the amount of information that is releasable. If there is any doubt about which act to use in requesting information from SBA, you should cite both acts.
While neither act grants an absolute right to examine government documents, both acts give the right to request records and to receive a response to a request also provide a right to appeal the denial and, if necessary, to challenge it in court (as discussed elsewhere in this guide).
