We must keep consent documents for a minimum of two years after we make a disclosure.
Under the Privacy Act, an individual has two years from the date a cause of action
arises (allegation of an unauthorized disclosure) to file suit against us. If a claim
file (paper or electronic) exists, file the consent document in the file using current
office processing instructions for maintaining paper or scanned or other electronic
images of documents. If a claim file does not exist, the office processing the request
should retain the consent document in the office’s correspondence files.