41 C.F.R. § 105-64.406
The GSA Privacy Act Officer will consult with legal counsel and appropriate GSA officials concerning your appeal. If they decide to reject your appeal, the Privacy Act Officer will provide the Deputy Administrator with all pertinent information about the case and request a final administrative decision. The Deputy Administrator may approve your amendment, in which case the Privacy Act Officer will notify you in writing, and the system manager will amend the record and send an amended copy to you and anyone who had previously been provided with the record. If the Deputy Administrator denies the appeal, he or she will notify you in writing of the reason for denial, of your right to a judicial review, and of your right to file a Statement of Disagreement. The amendment appeal review will be made within 30 workdays after the Privacy Act Officer receives your appeal. The Deputy Administrator may extend the time limit by notifying you in writing of the reason for the extension before the 30 days are up.
41 C.F.R. § 105-64.406