(a) Each system manager identified in the “Notice of Systems of Records” must establish a system of accounting for all disclosures of information or records under the Privacy Act made outside NCUA. Accounting procedures may be established in the least expensive and most convenient form that will permit the system manager to advise individuals, promptly upon request, of the persons or agencies to which records concerning them have been disclosed.

(b) Accounting records, at a minimum, shall include the information disclosed, the name and address of the person or agency to whom disclosure was made, and the date of disclosure. When records are transferred to the National Archives and Records Administration for storage in records centers, the accounting pertaining to those records shall be transferred with the records themselves.

(c) Any accounting made under this section shall be retained for at least five years or the life of the record, whichever is longer, after the disclosure for which the accounting is made.