Who is legally liable if an outsourced scanning vendor loses or mishandles records during digitization?

When an organization hires an outside vendor to scan its records, a common assumption is that liability moves to the vendor along with the boxes. In practice, it generally does not. The organization that owns the records remains accountable for them, even while they are in a contractor’s hands.

Accountability Stays With the Record Owner

Records laws, regulations, and standards place the duty to create, protect, and retain records on the organization that owns them, not on whoever happens to be processing them at the moment. A vendor acts as an agent or custodian carrying out work on the owner’s behalf. If records are lost, damaged, exposed, or destroyed prematurely during digitization, the owner is typically the party answerable to regulators, courts, auditors, and the public.

This is why recognized practice treats outsourced processing as a delegation of tasks, not a transfer of responsibility. Governance frameworks expect the owning organization to retain oversight of records throughout their lifecycle, regardless of where the physical handling occurs.

Two Layers of Liability

It helps to separate two distinct questions:

• Public or regulatory accountability — Obligations under recordkeeping, privacy, and disclosure laws stay with the owner. A vendor’s mistake does not excuse a missed retention requirement, a privacy breach, or a failure to produce records.
• Contractual allocation between the parties — A well-drafted services agreement can shift financial responsibility to the vendor through indemnification, liability, breach-notification, and insurance clauses. This lets the owner recover damages, but it does not relieve the owner of its underlying legal duties to outside authorities.

In short, contracts allocate cost; law allocates accountability.

How to Reduce Your Exposure

Practical safeguards include:

• Clear contract terms on custody, security, indemnification, breach notification, and certified destruction.
• Documented chain-of-custody tracking from pickup through return or disposal.
• Defined image-quality and verification standards so originals are not destroyed before scans are confirmed accurate and complete.
• Vendor due diligence and the right to audit security controls.
• Special handling rules for privacy-protected, confidential, or otherwise sensitive records.

Because liability ultimately rests with you, treat vendor selection and oversight as a core records-management responsibility rather than a purely procurement decision.

For related guidance, see the digitization and imaging topic hub.