When Responding to Litigation Holds FOIA Requests Investigations or Inquiries You Must Provide All Responsive Records—Here Is How That Duty Actually Works

When responding to litigation holds, FOIA requests, investigations, or inquiries you must provide all responsive records, meaning you must identify, preserve, collect, and produce every document or data item that falls within the stated scope and is in your custody, control, or possession. The duty attaches at the moment you reasonably anticipate the matter, not when the formal request arrives.

That sentence is the whole obligation in miniature. The rest of this explainer is about why the obligation is so much harder to satisfy than the sentence suggests, where it breaks down in practice, and what concrete steps reduce the risk of an incomplete response.

The preservation trigger and the legal hold mechanism

The preservation duty is anticipatory. Courts have long treated the duty as arising when litigation is "reasonably anticipated," not when a complaint is filed. A demand letter, a regulatory inquiry, or a credible internal whistleblower report can start the clock. Once triggered, the organization must suspend routine destruction of potentially relevant data, notify custodians, and document the suspension.

A litigation hold is not a request for records yet. It is a notice to custodians that responsive material must survive. The hold typically names the matter, defines the scope, names custodians, and instructs recipients to stop deleting email, chat, and local files. It should be issued in writing, acknowledged by each custodian, and tracked. A verbal reminder is not a hold.

FOIA and records requests run on a different mechanism. Under the federal Freedom of Information Act (5 U.S.C. § 552) and its state analogs, an agency must search for records reasonably likely to contain responsive material and release them, subject to enumerated exemptions. FOIA does not impose a general litigation hold, but agencies may not destroy responsive records after a request is received, and some state laws explicitly bar destruction during the pendency of a request.

Investigations and inquiries—whether by a regulator, an inspector general, or a congressional committee—usually arrive with their own preservation language. Treat any such notice as a preservation trigger even if it is styled as a "voluntary request."

The collection pipeline: why "reasonably likely" is doing heavy lifting

Courts apply a reasonableness standard to the search, not a perfection standard. A responding party must conduct a reasonable, good-faith search and produce responsive material in its custody, control, or possession. Whether a search was reasonable depends on scope, method, and the responding party's sophistication. That is the counterintuitive detail: the leading standard rewards documented process more than exhaustive result. A documented, defensible search can survive even if it misses a stray file; an undocumented search that happens to be complete is far harder to defend.

A workable pipeline has four stages:

Trigger and scope: define the matter, the date range, the custodians, and the data sources before collection begins. Identification: use key terms, custodial interviews, and system inventories to find likely sources. Preservation: image or copy source data before review, and log chain of custody. Collection and review: deduplicate, apply privilege filters, and log every exclusion with a reason.

Two failure modes dominate. The first is under-identification: the team searches email but ignores chat, shared drives, mobile devices, and third-party SaaS data. The second is over-collection without review discipline: terabytes are copied but never searched, and responsive material is buried.

Quantified context: data volume and retention windows

Modern organizations hold vastly more data than the pre-digital records regimes assumed. Industry surveys routinely put average employee email volume in the tens to low hundreds of messages per day, and enterprise message stores in the terabytes. A single custodian's mailbox can contain hundreds of thousands of messages spanning years. Multiply by a handful of custodians and the corpus easily reaches millions of items.

The Federal Rules of Civil Procedure, particularly Rule 37(e) as amended in 2015, tie sanctions for lost electronically stored information (ESI) to whether the loss prejudiced the other side and whether the party acted with intent to deprive. That amendment narrowed the harshest sanctions to cases of intentional spoliation. It does not eliminate the duty to preserve; it changes the consequence of failing to preserve.

Retention schedules compound the problem. Many systems auto-delete email after 30 to 90 days unless a hold is applied. Chat platforms may retain messages for 24 hours to a year depending on configuration and tier. A hold issued on day 45 of a 60-day retention window preserves only what survived; earlier material may already be gone unless the platform kept backups. That is why the trigger date matters more than the hold date.

Where the duty breaks: edge cases

Several scenarios reliably produce incomplete responses.

Ephemeral messaging. Disappearing-message features and auto-delete settings can eliminate responsive content before a hold is even contemplated. Some platforms allow retention overrides at the workspace level; check before assuming messages are gone.

Personal devices and accounts. Bring-your-own-device policies, personal email used for work, and personal text messages can contain responsive material. Custody and control analysis determines whether these must be collected. Courts have required production of work-related messages on personal devices when the employee used them for company business.

Third-party custodians. Contractors, vendors, and cloud providers hold data the organization may control. A hold notice to the vendor and a contractual preservation clause are the practical tools.

Legacy systems and backups. Backups are generally not "reasonably accessible" under proportionality rules, but a hold must still cover live systems. Restoring backups for every matter is disproportionate and courts have said so repeatedly.

Agency records and FOIA. Government agencies must search systems of record, but FOIA does not require creating new records or compiling data that does not already exist in record form. Personal notes, drafts, and material outside agency records are typically outside scope.

Red flags to watch:

A hold issued weeks after the triggering event, with no explanation for the delay. Custodians who were never interviewed and whose systems were never inventoried. Chat, text, and mobile data omitted from collection scope without a documented reason. Auto-deletion settings left active on systems covered by the hold. A single legal hold email with no acknowledgment tracking. Production logs that list files collected but not the search terms or exclusions applied.

Common misconceptions

The most persistent myth is that "responsive" means "helpful to our position." It does not. Responsive means within scope. Material harmful to your case must be produced if responsive; withholding it is the error that gets sanctioned.

A second misconception treats the legal hold as a one-time event. Holds must be refreshed as custodians change roles, as scope evolves, and as new data sources appear. A hold issued once and never revisited is a common weakness.

A third is that a broad privilege designation cures over-collection. A privilege log is required to withhold responsive material on privilege grounds, and blanket assertions are routinely rejected.

A fourth is that deleting after a request is fine if the deletion was scheduled. Auto-deletion after a preservation trigger can constitute spoliation even if the schedule predates the matter, because the duty suspends the schedule.

A fifth, specific to FOIA, is that the agency's search obligation is satisfied by searching only the obvious system. Agencies must search all systems of record reasonably likely to contain responsive records, and FOIA requesters can challenge the adequacy of the search.

Comparing record-request regimes

The regimes differ in who bears the duty and what happens on failure, but the preservation expectation is common to all.

Timeline: how a matter typically unfolds

Timing varies widely with scope and jurisdiction; the pattern, not the exact days, is what to track.

Practical actions with thresholds

Issue the hold within days of the trigger, not weeks. A written hold issued within 10 business days of a reasonably anticipated matter is a defensible practice; a hold issued 60 days later invites questions.

Inventory data sources before collection. At minimum, list email, chat, shared drives, local devices, mobile devices, SaaS applications, and third-party custodial data. If a source is excluded, document why.

Set retention overrides on covered systems the day the hold is issued. Confirm the override in writing with the platform administrator.

Interview each custodian. Ask what systems they use, what they stored where, and what they deleted. A 15-minute interview per custodian catches sources that key-term searches miss.

Apply search terms and log them. Record the terms, the date range, and the hit counts. If a term produces an unmanageable volume, refine it and log the refinement.

Deduplicate and privilege-filter with a defensible method. Log every withheld item and the basis.

Refresh the hold when custodians change roles, when scope expands, or when new systems are adopted. A hold review every 90 days is a reasonable cadence for active matters.

For FOIA, search every system of record, document the search terms and the systems searched, and provide the requester a basis to evaluate the search's adequacy.

For regulators and investigators, confirm scope in writing where possible, and coordinate production format and privilege protocol before producing.

Limitations and what this cannot tell you

This explainer describes general mechanisms, not jurisdiction-specific rules. Preservation triggers, FOIA exemptions, and sanction standards vary by state, court, and agency. The 2015 Rule 37(e) amendment applies in federal civil cases; state rules may differ. FOIA's nine exemptions and its fee and timeline provisions are specific to the federal statute; state public records laws differ substantially.

The volume and retention figures above are illustrative industry ranges, not exact measurements for any particular organization. They should not be used to estimate a specific corpus without local data.

Responsive-record obligations also intersect with privacy law, data-protection rules, and contractual confidentiality obligations, which may affect how material is collected and produced even when production is required. Those intersections are outside this article's scope.

This article is general educational information about records-preservation and records-request practices. It is not a legal opinion and does not create an attorney-client relationship, and it does not promise any particular outcome in litigation, an investigation, or a FOIA proceeding. For a specific hold, request, or inquiry, consult a qualified attorney or records professional in your jurisdiction before acting.