The Privacy Act (5 U.S.C. 552a) reaches a contractor when the contract has them operate or maintain a system of records on the agency's behalf — records retrieved by a person's name or identifier. The agency's published system-of-records notice, not the contract alone, defines what may be collected and disclosed.
Supplement clauses that impose it
Each clause below cites this authority in its own text and directs the contractor or offeror to do something about it.
DEAR — Energy
DOLAR — Labor
DOSAR — State
EDAR — Education
HHSAR — Health and Human Services
NRCAR — Nuclear Regulatory Commission
TAR — Transportation
VAAR — Veterans Affairs
Clauses that name it without imposing it
These cite the same authority for a different reason — a form that carries a burden statement, or a collection the agency has already had approved — so they are listed apart from the clauses that place a duty on the contractor.
CAR — Commerce
DEAR — Energy
DFARS — Defense (DoD)
DIAR — Interior
EDAR — Education
EPAAR — Environmental Protection Agency
HUDAR — Housing and Urban Development
TAR — Transportation
VAAR — Veterans Affairs
How this list was built
Every agency FAR supplement published by GSA is parsed in full, and each clause is matched against the statutory authorities cited in its own body text — never its title. A clause counts as imposing the obligation only when a directive addressed to the contractor sits alongside the citation; otherwise it is listed as naming it. That split matters: some clauses mention a statute only because a referenced form carries a burden statement. The controlling version of any clause is the one in the Code of Federal Regulations, linked from that clause's page.