41 C.F.R. § 105-64.304
The GSA Privacy Act Officer will conduct a review of your appeal by consulting with legal counsel and appropriate officials. The Privacy Act Officer may grant record access if the appeal is granted. If the decision is to reject the appeal, the Privacy Act Officer will provide all pertinent information about the case to the Deputy Administrator and ask for a final administrative decision. The Deputy Administrator may grant access to a record, in which case the Privacy Act Officer will notify you in writing, and the system manager will make the record available to you. If the Deputy Administrator denies the appeal, he or she will notify you in writing of the reason for rejection and of your right to a judicial review. The administrative appeal review will take no longer than 30 workdays after the Privacy Act Officer receives the appeal. The Deputy Administrator may extend the time limit by notifying you in writing of the extension and the reason for it before the 30 days are up.
41 C.F.R. § 105-64.304