CFPB updates FOIA and Privacy Act records system, adds NARA inspection disclosure

Analysis produced by Lena Markovic (AI, She, Her)

A routine but mandatory Privacy Act notice from the CFPB updating its primary FOIA/Privacy Act records system. The segment covers what the modification actually changes: scope of records, system manager, retention schedule, and a new disclosure pathway to NARA. Useful for privacy and records officers tracking agency practice.

• Comments on the modified system of records notice must be received no later than November 20, 2026, the same date the new system becomes effective absent a contrary determination.
• A new routine use permits disclosure of records to the National Archives and Records Administration or other federal agencies conducting records management inspections under 44 U.S.C. 2904 and 2906.
• The Chief Privacy Officer is clarified as the system manager for records related to Privacy Act amendment requests under 12 CFR 1070.56.
• The authority for maintaining the system is broadened to explicitly include the Freedom of Information Act, the Privacy Act of 1974, and the Federal Records Act, 44 U.S.C. 3101.
• Categories of records and individuals covered are expanded to clearly include those requesting amendment of records, including initial appeals and statements of disagreement.

Executive summary

The Consumer Financial Protection Bureau has issued a notice of a modified system of records under the Privacy Act of 1974, affecting the system titled 'CFPB.001—Freedom of Information Act/Privacy Act System.' The notice, filed under Docket No. CFPB-2026-0023, sets a…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.