How do we respond to a FOIA request when the records are held by a vendor and the contract is ending?

When a public records request lands and the responsive records sit with a vendor whose contract is winding down, the central principle is simple: agency records do not stop being agency records because a contractor created, processed, or stored them. If the agency has the right to obtain or control those records, they generally remain subject to disclosure law and must be searched, reviewed, and produced as if they were held in-house.

Confirm Who Holds the Records and Who Controls Them

Start by separating custody from ownership. A vendor may physically hold data, but the agency typically retains legal control through the contract. Identify:

• Which systems, files, and formats contain potentially responsive records
• What the contract says about ownership, access, return, and destruction of records
• Whether any records qualify as agency records under your jurisdiction’s public-records definition

If the agency can demand the records under the agreement, they are within scope and a contract ending does not relieve the obligation to respond.

Act Before the Contract Closes Out

The biggest risk is losing access at transition. Treat the FOIA request as a trigger to:

• Issue a litigation/records hold to the vendor immediately, pausing any scheduled deletion
• Confirm the agreement’s data-return and transition clauses are being followed
• Require the vendor to deliver records in usable, complete formats, including metadata
• Verify nothing responsive is purged during decommissioning or migration

Even where a retention schedule would normally allow disposal, an active request or hold suspends destruction until the matter is resolved.

Process the Request Normally

Once you have the records, handle them like any other response: conduct a reasonable search, apply exemptions consistently, redact only what the law permits, and document each step. The requester is entitled to the same treatment whether records lived on an agency server or a contractor’s platform.

Prevent the Problem Going Forward

Build records obligations into procurement. Contracts should state that records remain agency property, require return in open formats, prohibit destruction without authorization, and obligate the vendor to support search and production. Coordinate records, legal, IT, and contracting staff so transitions never strand responsive material.

For related guidance, see the FOIA and public records hub.