DD Form 2923 Privacy Act Cover Sheet: Use, Storage, and Disposal

The DD Form 2923 Privacy Act cover sheet is a preprinted yellow page you put on top of any document containing personally identifiable information so that anyone who sees the file sees the warning first, not a Social Security number. It carries a bold “For Official Use Only” notice and restricts the underlying pages to people with a direct need-to-know. Filling it out is trivial. Using it correctly, every single time PII leaves a locked drawer, is the whole point.

What the Form Is and Where to Download It

DD Form 2923 is issued by the Department of Defense as a physical safeguard for Privacy Act records. The current edition is posted on the DoD Executive Services Directorate site under the DD Forms 2500–2999 index.¹ Download the PDF and open it in Adobe Acrobat Reader so the fields render correctly. Printed stacks are often kept in installation admin offices and mail rooms, but check the edition number against the ESD listing before you use one, because outdated versions still circulate.

When You Have to Use It

The Privacy Act of 1974 requires federal agencies to safeguard any system of records that retrieves information about an individual by name, Social Security number, or other unique identifier.² DoDI 5400.11 directs DoD components to maintain administrative, technical, and physical safeguards for records containing PII, and the cover sheet is one of those physical safeguards.³

Use the cover sheet whenever Privacy Act records are outside a GSA-approved security container or a locked office. Typical situations:

Walking a personnel folder between buildings or to a mail facility.
Setting records on a desk or in an unlocked bin, so anyone passing by sees the warning before any data.
Sending documents through internal mail, with the cover sheet on the stack and the whole package inside an opaque envelope.
Handing records to another person, since the form’s printed instructions require delivery directly to the intended reader and not to a third party.⁴

What counts as PII for this purpose: Social Security numbers, dates of birth, home addresses, medical records, financial account numbers, and biometric data. A name by itself may not trigger protection, but a name paired with any of those identifiers does. The Army’s PII User’s Guide treats the cover sheet as a best practice for all printed material containing PII.⁵

Using It on Paper

Place the DD Form 2923 as the first page of the stack so nothing sensitive is visible underneath. If the papers are loose, clip the cover sheet to them or drop everything into a manila folder so it does not shift in transit. Anyone glancing at the file should see the yellow warning, not a name and SSN.

For mail, put the whole covered stack inside an opaque envelope that will not reveal the contents in strong light. Deliver directly to the intended recipient. If the recipient is not there, bring the package back rather than leaving it on a desk or with a coworker who is not authorized to see the records.⁴

Using It With Digital Files and Email

The cover sheet works as a PDF leading page. Embed the scanned or fillable version of DD Form 2923 as the first page of the file so the Privacy Act warning appears the moment the document opens, before anyone scrolls to the protected content.

Email adds separate requirements. DoD policy requires digital signatures and encryption for any email containing PII, with encryption tied to the recipient’s public-key certificate so only the intended reader can decrypt the message. Attachment file names should include the label “FOUO: PRIVACY SENSITIVE,” and the email body and each attachment should carry the statement: “FOUO: PRIVACY SENSITIVE. Any misuse or unauthorized disclosure may result in both criminal and civil penalties.”⁶

PII documents now also fall under Controlled Unclassified Information marking rules. Each page needs “CUI” in the header and footer, and the first page needs a CUI Designation Indicator Block identifying the controlling organization, the CUI category, and a point of contact.⁷ The cover sheet supplements those markings; it does not replace them.

Handling and Storage on the Desk

While documents sit in a workspace, the cover sheet stays on top. If papers go into an unlocked temporary bin, the yellow sheet stays visible so anyone near the bin knows the contents are restricted.⁸ At end of day the records go back into a locked drawer, filing cabinet, or GSA-approved security container. Leaving them out overnight with the cover sheet is not a safeguard.

Destroying the Documents

When the underlying records are no longer needed, destroy them with an approved method. Cross-cut shredding is the standard for paper PII. NSA/CSS Specification 02-01 requires particles no larger than 1 mm by 5 mm, but that spec applies to classified and high-sensitivity material; a typical office cross-cut shredder produces larger particles and is acceptable for routine PII disposal.⁹

Shred the cover sheet itself along with the documents if it has been marked with office names or other identifying notations. A blank, unmarked cover sheet can be reused.

What to Do if PII Is Exposed

If Privacy Act records are lost, stolen, or seen by someone without authorization, report it immediately. DoD policy requires notification to the United States Computer Emergency Readiness Team within one hour of discovering the breach.¹⁰ One hour is short. Waiting to figure out exactly what happened before you report can put you past the deadline.

The formal report is filed on DD Form 2959, which captures the date the breach was discovered, the date reported to US-CERT, details of the compromised information, and a point of contact. The form also tracks whether affected individuals were notified within ten working days.¹⁰ Also notify your component privacy officer. If you do not know who that is, contact the Office of the Assistant to the Secretary of Defense for Privacy, Civil Liberties, and Transparency.

Penalties for Mishandling PII

The Privacy Act carries criminal and civil consequences. A federal officer or employee who knowingly and willfully discloses individually identifiable information to someone not entitled to receive it commits a misdemeanor punishable by a fine of up to $5,000. The same penalty applies to anyone who willfully maintains a system of records without publishing the required public notice, or who obtains records from an agency under false pretenses.¹¹

The threshold matters. Gross negligence is not enough for criminal prosecution; courts have held that the government must prove the disclosure was willful, meaning the employee knew the material was protected and released it anyway.¹² Carelessness still has consequences on the administrative side, where agencies can impose reprimand, suspension, or removal for failing to follow safeguarding procedures.

On the civil side, an individual whose records are mishandled can sue the agency in federal court. If the court finds the agency acted intentionally or willfully, the government owes actual damages with a guaranteed minimum of $1,000, plus attorney fees and litigation costs.¹¹

1
Department of Defense Executive Services Directorate. DD Forms 2500-2999
2
Defense Logistics Agency. Privacy Act of 1974
3
Department of Defense. DoDI 5400.11 – DoD Privacy and Civil Liberties Programs
4
Commander, Navy Installations Command. DD Form 2923 Privacy Act Data Cover Sheet
5
Department of the Army. PII User’s Guide
6
National Defense University. Transmitting PII and Sensitive Data
7
Department of the Navy CIO. Revised DON Guidance for Marking Documents Containing PII
8
U.S. Army MWR. DD Form 2923 Privacy Act Data Cover Sheet
9
National Security Agency. NSA/CSS Requirements for Paper Shredders
10
WHS Executive Services Directorate. DD Form 2959 – Breach of Personally Identifiable Information Report
11
Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals
12
U.S. Department of Justice. Overview of the Privacy Act 2020 Edition – Criminal Penalties