How should responsibilities be split when digitization is outsourced to a third-party scanning vendor?

When you outsource digitization to a third-party scanning vendor, the work is shared but accountability is not. The organization that owns the records remains responsible for their authenticity, completeness, and proper management. A clear division of responsibilities, captured in a written contract or statement of work, keeps both sides aligned and protects the integrity of the resulting digital records.

What the records owner keeps

Certain duties should never be delegated, because they flow from the organization’s legal and policy obligations:

• Defining requirements — image resolution, file formats, color profiles, metadata fields, and indexing rules, ideally tied to recognized technical guidelines.
• Setting retention and disposition — deciding what is digitized, what the disposition of originals will be, and whether records may be destroyed after imaging.
• Final acceptance — reviewing samples, approving quality, and formally accepting the digital records as the official version.
• Compliance and privacy — ensuring the project meets applicable recordkeeping laws and protects sensitive or personal information.

What the vendor typically performs

The vendor executes the production work against your specifications:

• Document preparation, scanning, and image capture.
• Optical character recognition, indexing, and metadata entry as specified.
• Quality control on their own output before delivery.
• Secure handling, storage, and return or certified destruction of originals.

Shared responsibilities to negotiate

Several areas require explicit agreement so nothing falls through the cracks:

• Chain of custody — documented tracking of records from pickup through return, so completeness can be proven.
• Quality assurance — the vendor performs first-pass QC; the records owner conducts independent acceptance sampling.
• Security and access controls — physical and information security standards, background screening, and breach notification.
• Data ownership and exit — confirm the organization owns all images and metadata, and define how data is delivered if the relationship ends.

Put it in writing

A strong contract specifies measurable quality thresholds, error-correction obligations, timelines, confidentiality, and audit rights. Building requirements on established standards and digitization specifications gives both parties an objective benchmark and makes the resulting records easier to defend and preserve.

For related guidance, see the digitization and imaging topic hub.