(a) Requirements—(1) Compliance. Contractors shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to 44 U.S.C. chapters 21, 29, 31, and 33, NARA regulations at 36 CFR chapter XII, subchapter B, and those policies associated with the safeguarding of records covered by Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

(2) Applicability. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended, and must be managed and scheduled for disposition only as permitted by relevant records management laws and regulations and DOT Order 1351.28, Departmental Records Management Policy.

(3) Records maintenance. While DOT records are in a contractor's custody, the contractor is responsible for preventing the alienation or unauthorized destruction of the DOT records, including all forms of mutilation. Records may not be removed from the legal custody of DOT or destroyed except in accordance with the provisions of the agency records schedules and with the written concurrence of the DOT or Component Records Officer, as appropriate. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, the contractor must report the event to the contracting officer, in accordance with 36 CFR part 1230, for reporting to NARA.

(4) Unauthorized disclosure. Contractors shall notify the contracting officer within two hours of discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Contractors shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of the information, data, documentary material, records and/or equipment accessed, maintained, or created. Contractors shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government's behalf, without the express written permission of the contracting officer or contracting officer's representative. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to DOT control or the contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the contracting officer or address prescribed in the contract. Destruction of records is expressly prohibited unless authorized.

(b) Non-public information. Contractors shall not create or maintain any records containing any non-public DOT information that are not specifically tied to or authorized by the contract.