How long does an agency legally have to respond to a mandatory declassification review request?

Mandatory declassification review (MDR) is a process that lets any requester ask an agency to review specific classified records and determine whether they can be declassified and released. It is governed primarily by the executive order on classified national security information and the implementing directives overseen by the Information Security Oversight Office (ISOO). Because timelines under MDR work differently from the better-known Freedom of Information Act (FOIA) clock, it helps to understand the framework rather than memorize a single number.

The general timeline

Under the governing executive order and its directives, agencies are expected to acknowledge and act on MDR requests within a reasonable period and to complete review “as soon as practicable.” In practice, the implementing rules direct agencies to make a declassification determination within about one year of receiving a request, when feasible. This is a target, not an absolute guarantee, and complex requests may take longer.

Several factors commonly extend the timeline:

• Equity referrals — if the records contain information originated by another agency, the reviewing agency must refer those portions for the other agency’s determination.
• Volume and complexity — large or highly sensitive collections take longer to review line by line.
• Backlogs — popular topics and limited review staff can create queues.

What the requester can do

If an agency does not respond or denies declassification, the requester generally has the right to appeal within the agency. Final appeals concerning many agencies’ decisions can be brought to the Interagency Security Classification Appeals Panel (ISCAP), an interagency body that reviews classification decisions and can order release.

MDR is not FOIA

A key point for records and information-governance professionals: MDR and FOIA are separate authorities with separate timelines and appeal paths. FOIA has its own statutory response deadlines, while MDR’s timing comes from the classification executive order and ISOO directives. A requester may pursue either, or both, depending on the records sought.

For more context on the classification lifecycle and related processes, see the declassification topic hub.

Because specific deadlines and appeal procedures can change with new executive orders or agency regulations, always confirm the current rules and your agency’s published MDR procedures before relying on a particular timeframe.