(a) When a contract provides for third party operation of a SOR on behalf of the NCPC to accomplish a NCPC function, the contract shall require that the requirements of the Privacy Act and the rules in this part be applied to such System.

(b) The Division Director responsible for the contract shall designate a NCPC employee to oversee and manage the SOR operated by the contractor.