What happens when an employee leaves the agency with records on a personal device that are needed for a FOIA request?

A record does not stop being a federal record simply because it sits on a personal phone, laptop, or email account, and it does not disappear when the employee who created it leaves. If the material meets the definition of a record and is responsive to a request, the agency generally remains obligated to search for it, retrieve it, and produce any non-exempt portions.

Why the obligation follows the record

Federal recordkeeping principles treat content based on its function, not its location or device. Work-related messages, documents, and emails created or received in the course of agency business are records regardless of whether they live on government or personal systems. Because the legal duty attaches to the record, the agency’s responsibility to capture and produce it does not end at the employee’s last day.

What a departing employee owes

Many agencies require, as a matter of policy, that employees who use personal accounts or devices for official business copy or forward those records into an official system. This is typically expected at or before separation. When an employee leaves without doing so, the agency still has a duty to make a reasonable effort to recover the material.

How agencies typically respond

When a FOIA request reaches into a former employee’s personal device, an agency will usually:

• Conduct a reasonable, good-faith search of systems and accounts likely to hold responsive records, including known personal repositories used for official work.
• Contact the former employee and request that they search for, preserve, and return any agency records in their possession or control.
• Apply normal FOIA processing, including any applicable exemptions and segregation of releasable portions, to whatever is recovered.

Preservation and litigation holds

If the records relate to anticipated or active litigation, a separate duty to preserve may apply, which can prevent deletion and require steps to secure the data before the device is wiped or returned.

The takeaway

The best protection is prevention: clear policy, training, and an offboarding checklist that captures official records out of personal accounts before access is lost. Once that window closes, recovery becomes harder, but the agency’s underlying obligation to search and produce remains.

Learn more on the FOIA and public records hub.