Key Takeaways
- A FOIA request is a formal written request for records held by federal executive branch agencies under the Freedom of Information Act, enacted in 1966
- Anyone can file a FOIA request regardless of citizenship or residency, but the law applies only to federal agencies, not to Congress, the courts or state governments
- Nine specific exemptions protect certain records from disclosure, including classified national security information, trade secrets and personal privacy
- Federal agencies must respond within 20 business days, though actual processing often takes much longer, depending on request complexity
- Government agencies that archive electronic communications in a searchable system can respond to FOIA requests faster and with less risk of non-compliance
Introduction
Every year, federal agencies receive hundreds of thousands of FOIA requests, and many struggle to respond on time. According to the U.S. Department of Justice’s Annual FOIA Report, agencies received 1,199,699 requests in fiscal year 2023, the first time the total surpassed a million in a single year.
For the FOIA officers and records managers on the receiving end, that volume creates a constant tension between legal deadlines and operational reality.
Whether you’re a government professional responsible for processing requests or a citizen trying to access public records, understanding how the Freedom of Information Act (FOIA) works is the first step toward getting it right.
Here’s what this article covers:
- What a FOIA request is and what the law actually requires
- Who can file, and what records are eligible
- The nine exemptions that allow agencies to withhold information
- How to file a request step by step, with a sample template
- Processing times, fees and what to do if your request is denied
- Why electronic records are making FOIA compliance harder and what agencies can do about it
What Is a FOIA Request?
A FOIA request is a written request submitted to a federal agency asking for access to records under the Freedom of Information Act (5 U.S.C. § 552). The law gives any person the right to request records from executive branch agencies, and it places the burden on the agency to justify withholding, rather than on the requester to justify access.
That single design choice is what makes FOIA powerful: the default is disclosure, and the government has to argue its way out of it.
Congress enacted FOIA in 1966, and it took effect on July 5, 1967. The law was strengthened significantly through amendments in 1974, following Watergate, and has been updated several times since.
Its core principle hasn’t changed: government records are presumed open unless a specific exemption applies.
FOIA’s scope is narrower than many people assume.
The law applies to federal executive branch agencies, including departments like the Environmental Protection Agency (EPA), the Department of Justice (DOJ) and the Department of Homeland Security (DHS), the Department of Defense, and independent agencies like the Federal Trade Commission (FTC). It doesn’t apply to Congress, the federal courts or the president’s immediate staff within the Executive Office of the President.
If you’re looking for records from a state or local government, you’ll need to use that jurisdiction’s own public records law. These go by different names depending on the state: sunshine laws, public records acts, right-to-know laws or open records laws. While the principles are similar, the rules, timelines and exemptions vary, and FOIA deadlines differ by state.
Federal FOIA, the focus of this article, applies only at the federal level.
In practical terms, FOIA is a legal mechanism that lets you ask a federal agency for specific records. The agency is then required to search for those records and either release them or explain why it can’t.
Who Can File a FOIA Request?
One of the most common misconceptions about the Freedom of Information Act is that only journalists or U.S. citizens can use it. That’s not the case.
Any person can file a FOIA request, regardless of citizenship, residency or organizational status. U.S. citizens, permanent residents, foreign nationals, businesses, nonprofits, law firms and media organizations all have the same right to request records.
Requesters also don’t need to explain why they want the records. There is no requirement for them to state a purpose, justify an interest or prove a specific need, which means your office can’t screen or deprioritize a request based on who is asking or why.
In practice, the heaviest users aren’t who most people picture.
Corporations file FOIA requests for competitive research, law firms gather evidence for litigation, academic researchers study government programs, and advocacy organizations and watchdog groups file in large volumes. Journalists are part of the picture, but they are far from the whole of it. For a records team, the practical consequence is that a single high-profile matter can generate a wave of overlapping requests, each one carrying its own statutory clock.
One distinction is worth flagging for agencies that operate at both levels.
While federal FOIA has no residency requirement, some state-level public records laws do restrict access to residents of that state. If your agency handles requests under a state public records law as well, the eligibility rules may differ from the federal standard.
What Records Can Be Requested Under FOIA?
FOIA covers a broad range of records created or obtained by federal agencies, in any format, and that breadth is precisely what makes the agency’s job hard.
The scope includes paper documents, electronic files, emails, text messages, audio and video recordings, photographs, datasets, contracts, inspection reports, internal memos and correspondence. If your agency created it, received it or maintains it, it is generally subject to FOIA, which means it’s generally something you may have to find, review and produce.
The scope of requestable records has expanded significantly as electronic communications now dominate government operations. Emails are now among the most frequently requested record types.
Agencies are also receiving growing numbers of FOIA requests for text messages, instant messages, social media content and messages from platforms like Microsoft Teams or Slack. Many of these requests target records captured through text message archiving for government systems.
There are limits, though. FOIA covers existing records. You can’t use it to ask an agency to answer questions, conduct research, create new documents or respond to hypothetical scenarios.
If the record doesn’t exist, the agency’s obligation is simply to say so.
Agencies must conduct a reasonable search for responsive records across all systems where those records may exist. This means searching email servers, shared drives, databases, archival systems and any other repositories where relevant records could be stored. The adequacy of that search is often a point of contention in FOIA disputes, particularly when requesters suspect that responsive records exist in systems the agency didn’t search.
For agency staff, the practical takeaway is clear: the more communication channels your organization uses, the more places you’ll need to search when a FOIA request arrives.
The Nine FOIA Exemptions Explained
FOIA creates a presumption of openness, but it also recognizes that certain types of information need protection.
Nine specific exemptions allow agencies to withhold records, though invoking them is never automatic.
Here is what each one covers:
- Exemption 1: Classified information related to national defense or foreign policy. Records must be properly classified under an executive order to qualify.
- Exemption 2: Information related solely to internal agency personnel rules and practices
- Exemption 3: Information that another federal statute specifically prohibits from disclosure. The statute must either require withholding or give the agency discretion to do so.
- Exemption 4: Trade secrets and confidential commercial or financial information obtained from a third party
- Exemption 5: Privileged inter-agency or intra-agency communications. This covers the deliberative process privilege, attorney-client privilege and attorney work product. It’s one of the most commonly invoked and most contested exemptions.
- Exemption 6: Personnel, medical and similar files whose disclosure would constitute a clearly unwarranted invasion of personal privacy
- Exemption 7: Law enforcement records that could interfere with enforcement proceedings, deprive someone of a fair trial, constitute an unwarranted invasion of personal privacy, reveal confidential sources, disclose investigative techniques or endanger someone’s physical safety
- Exemption 8: Information contained in or related to examination, operating or condition reports prepared by or for agencies that regulate financial institutions
- Exemption 9: Geological and geophysical information and data, including maps, concerning wells
These exemptions are discretionary. An agency can choose to release records that fall under an exemption if it determines that disclosure is in the public interest.
The FOIA Improvement Act of 2016 also established the “foreseeable harm” standard. This requires agencies to demonstrate that releasing the records would cause a foreseeable harm to an interest protected by the exemption.
Agencies can no longer withhold records simply because they technically fall under an exemption category. They must show that actual harm would result. In other words, fitting the category is necessary but no longer sufficient.
How a FOIA Request Moves Through Your Agency
Understanding the lifecycle of a request, from the moment it lands to the moment you close it out, is the foundation of a defensible FOIA program.
Here is how that process works and where each stage tends to create friction for the agency.
Intake and routing
FOIA requests must go to the specific federal agency that holds the records, and there is no central office that handles requests for the entire government.
In practice this means requests sometimes arrive at the wrong component, and part of your obligation is to route a misdirected request to the right office promptly rather than letting it sit.
The U.S. Department of Justice maintains a list of agency FOIA contacts, and FOIA.gov provides a directory of all federal agency FOIA offices.
Logging and acknowledgment
Once a request arrives, the statutory clock starts, so the request needs to be logged and assigned a tracking number quickly.
Most agencies provide online tracking so requesters can check status, which cuts down on follow-up inquiries that otherwise consume staff time.
A clean intake record here is also your first piece of documentation if the request is later disputed.
Assessing scope and specificity
A request must be in writing and must describe the records with enough specificity for your office to locate them.
This is where many requests create problems. Overly broad requests, like “all records related to X”, are one of the most common causes of delay, because someone has to interpret what is actually being asked for before any search can begin.
Part of good FOIA practice is reaching back to requesters to narrow vague requests, which protects your deadline and reduces the volume you have to review.
Searching for responsive records
This is the operational heart of the process.
Your office has to conduct a reasonable search across every system where responsive records might live, then gather, deduplicate and prepare them for review.
The adequacy of this search is the single most litigated element of FOIA, so how thoroughly and how defensibly you can search directly determines your legal exposure.
Review, redaction and production
Located records have to be reviewed line by line, exemptions applied where they genuinely fit, redactions made consistently, and the final set produced in the requester’s preferred format.
This is typically the most labor-intensive stage, and the one where centralized tooling makes the largest difference.
A few practices keep this process defensible and on schedule:
- Narrow overly broad requests at intake rather than searching against an ambiguous scope.
- Flag requests that qualify for expedited processing early, since the urgency to inform the public or a threat to life or safety changes your timeline.
- Document the search at each stage, so the adequacy of your response can be demonstrated later if challenged.
FOIA Request Example
Agencies process clear, specific requests far faster than vague ones, so it helps to know what a strong request looks like, both to recognize one at intake and to guide requesters toward giving you what you need.
Below is a general-purpose FOIA request letter template. For more detailed guidance on request formatting and exemption interpretation, see the DOJ Guide to the Freedom of Information Act.
The thing that separates a fast request from a slow one is specificity, and that cuts both ways for an agency.
A request that identifies concrete records, such as “all emails between [official name] and [office] regarding [program] between January 2023 and June 2023,” can be searched and closed quickly. A vague one like “all records related to [broad topic]” forces interpretation and a far wider search before you can produce anything. The more you can guide requesters toward specific records at intake, the more of your own processing time you protect.
FOIA Processing Times and Fees
Federal agencies must respond within 20 business days of receipt. The agency can extend this deadline by an additional 10 business days for “unusual circumstances,” such as requests that involve a large volume of records, records held at multiple facilities or the need to consult with another agency.
In practice, processing times frequently exceed these statutory deadlines. Many agencies maintain significant backlogs, and complex requests can take months or even years to process.
According to the DOJ’s Annual FOIA Report data, the median processing time for complex requests at some agencies exceeds 100 days.
Agencies typically sort requests into two processing tracks. Simple requests involve a small number of clearly identified records and can often be processed quickly. Complex requests involve large volumes of records, records from multiple offices, sensitive material that requires line-by-line review or consultations with other agencies.
Requesters can ask for expedited processing, and your office must grant it when there is an urgency to inform the public about government activity, or when delay could threaten someone’s life or physical safety. Requesters provide a written justification, and you are required to make a determination on that request quickly, which adds a triage step on top of your normal queue.
Fees depend on the category of requester, and applying the right category is the agency’s call.
Commercial requesters pay search, duplication and review fees. Educational and scientific institutions and representatives of the news media pay only duplication fees.
All other requesters pay search and duplication fees, with the first two hours of search time and the first 100 pages of duplication provided at no charge.
Requesters can also seek a fee waiver when disclosure primarily benefits public understanding of government operations and is not primarily commercial, and your office evaluates those requests case by case. Each of these determinations is one more decision point your staff has to make and document before a request can close.
What Happens When a Request Is Denied or Appealed
When your agency denies a request in whole or in part, the law requires you to cite the specific exemption or exemptions that justify the withholding. A denial isn’t the end of the matter, and knowing the path it can take helps you handle each stage defensibly.
The first recourse for a requester is an administrative appeal. Under the FOIA Improvement Act of 2016, agencies must allow at least 90 days from the date of an adverse determination for a requester to file one, and most agencies set the window at exactly 90 days. Importantly, the appeal has to be reviewed by a different official than the one who made the initial decision.
Agencies release additional records at the appeal stage more often than many people expect, which is worth keeping in mind: a defensible initial decision, well documented, is what keeps appeals from becoming costly reversals.
If an appeal is unsuccessful, the requester can contact the Office of Government Information Services (OGIS), which is part of the National Archives and Records Administration. OGIS provides free mediation services to help resolve FOIA disputes between requesters and agencies. It’s a non-binding process, but it can be effective.
If administrative remedies are exhausted, the requester can file suit in federal district court. This is where documentation becomes decisive. Under FOIA, the burden stays on the agency to justify its withholding, not on the requester to prove the records should be released, and a court can order production if the government cannot demonstrate that an exemption applies.
The strength of your search records and your exemption rationale is, in practical terms, your defense.
Segregability is another relevant concept here. Even when an exemption applies to part of a record, your agency is required to release any reasonably segregable, non-exempt portions. A full denial should be the exception rather than the rule, and a withholding that fails the segregability test is one of the more common reasons a court orders additional disclosure.
FOIA and Electronic Records: A Growing Compliance Challenge
FOIA applies to all agency records regardless of format. That includes emails, text messages, instant messages, social media messages, voice recordings and files shared through collaboration platforms. As government agencies adopt more communication channels, the scope of what a FOIA request can cover has expanded dramatically.
Consider what happens when a FOIA officer receives a request for all communications related to a specific policy decision over a 12-month period. That request could span email, text messages from agency-issued phones, Teams or Slack messages, social media correspondence and attachments stored across multiple platforms.
Searching for responsive records across these siloed systems is slow, error-prone and difficult to document, and every one of those qualities works against a 20-day deadline.
The challenges are practical. Agencies need to search across multiple systems, produce records in the format requested, maintain a clear chain of custody for every document produced and apply redactions consistently across different file types.
When electronic records live in separate, disconnected systems, each of these steps becomes harder and slower. Agencies that don’t have a centralized, searchable archive for electronic communications face longer processing times, higher labor costs and greater risk of producing an incomplete response.
Incomplete responses result in appeals, litigation and loss of public trust, all outcomes that FOIA officers work hard to avoid.
The fix that works for most agencies is centralized archiving: capturing communications from every channel into a single, searchable repository. When records are indexed and searchable from one interface, FOIA staff can locate responsive records in seconds instead of days.
Audit trails, legal holds and export tools built into ediscovery solutions make it easier to produce records, document the search process and defend the adequacy of the response. Dedicated FOIA management software can further streamline how agencies track, process and close out requests.
How Jatheon Can Help
For government agencies, the hardest part of FOIA compliance usually is not the law but the records.
When communications are scattered across email servers, mobile devices, chat apps and social media accounts, even a well-staffed FOIA office spends most of its time just locating what a request asks for.
Jatheon Cloud is built to remove that problem by bringing every channel into one archive that FOIA staff can actually search.
Here is how the platform maps to the specific pressure points in a FOIA workflow:
- Capture across every channel a request can reach. Jatheon archives email, text and voice (SMS, MMS, calls and voicemail from employer-issued, BYOD and CYOD devices), social media, chat, website and collaboration tools including Microsoft Teams, Slack, Google Chat and Zoom. It also captures newer channels that increasingly fall within FOIA’s scope, including AI assistant conversations such as Claude, with retroactive retrieval and visibility into deleted exchanges. A request for “all communications about a policy decision” stops being a multi-system scavenger hunt because the records already live in one place.
- Search that returns answers in seconds. Because a single FOIA request usually spans channels, Jatheon Cloud’s Unified Search lets staff query email, social media and files at the same time from one interface, with results in a single list that flags each content type and sorts by date. Layered on top is advanced multi-criteria search with Boolean, fuzzy and proximity operators, so an officer can run a wide sweep and then tighten it without switching tools or repeating the same query across separate systems. That combination is what makes a 20-day deadline realistic instead of aspirational.
- Defensible records by design. WORM storage, full audit trails and detailed action logs let you document the search process and prove the integrity of what you produced, which matters when the adequacy of a search is challenged on appeal or in court.
- Faster, more consistent production. Built-in redaction, legal hold, and export to multiple formats (PST, PDF, EML, CSV and more) help you turn a located record into a producible one without bouncing between tools.
- Role-based access for sensitive material. With 60+ permission settings, you can keep tight control over who can view, search or export records, which is essential when FOIA material overlaps with privacy-protected or law enforcement content.
On top of those core capabilities, Jatheon’s AI layer is built to remove the manual effort that slows FOIA work down:
- AI FOIA Request Automation automates the manual review that normally starts every request. You upload the request as a PDF or TXT file, and the system reads it to generate structured search predicates and relevant date ranges, then saves those criteria in a dedicated FOIA category so staff can review, refine and run the search instead of rebuilding queries from scratch. For agencies handling high request volumes or a recurring backlog, this is where the largest share of the manual effort gets removed.
- A broader AI toolset compounds those savings across the rest of the workflow: Liya, a conversational AI assistant, lets staff chat with archived email, social and file content and generate summaries that shorten review; AI data classification filters out noise like newsletters, out-of-office replies and bounced messages so reviewers focus on what matters; AI transcription and OCR make audio and scanned content searchable alongside everything else; and AI-driven action logs with justification reports document the defensibility of the process as you go.
Jatheon is SOC 2 and ISO 27001 aligned, GDPR and HIPAA ready, and backed by 24/7 in-house technical support, which matters for public-sector teams that cannot afford gaps in coverage or chain-of-custody. For agencies that need to keep data on-site, the same archiving and ediscovery capabilities are available through Jatheon’s on-premises appliance.
Conclusion
FOIA’s promise has not changed since 1966: records are open by default, and the agency carries the burden of justifying any withholding. What has changed is the scale.
More than a million requests now arrive each year, and a single one can span email, text, chat, social media and collaboration platforms, yet the law still expects a response in 20 business days.
That gap between a fixed deadline and an expanding scope isn’t really a legal problem but a records problem. Agencies that can search every channel from one place, document the search as they go, and produce clean records on time meet their obligations without the fire drills. The strength of your archive, more than anything else, decides which experience your team has.
FAQ
What does FOIA request mean?
A FOIA request is a formal written request for access to records held by a federal executive branch agency, made under the Freedom of Information Act. Any person has the legal right to obtain these records, and the agency carries the burden of justifying any withholding.
What happens if an agency misses the 20-day deadline?
If an agency fails to make a determination within 20 business days, or within the extended period when it has properly invoked unusual circumstances, the requester is deemed to have exhausted administrative remedies and can file suit in federal district court without first filing an administrative appeal. An agency that misses the deadline also generally loses the ability to charge search or duplication fees for that request. This is why processing time isn’t just an operational metric but a legal exposure. A missed deadline hands the requester an immediate path to court.
What counts as an adequate search under FOIA?
The standard is reasonableness, not perfection. An agency must conduct a search reasonably calculated to uncover all responsive records, which means searching every system and location where responsive records are likely to exist and being able to describe that effort. A search is not judged by whether it found every document, but by whether the method was thorough and logical. When adequacy is challenged, courts look at the agency’s description of where and how it searched, which is why documenting the search process matters as much as running it.
Do agencies have to search text messages and Teams or Slack messages?
Yes, when those messages are agency records. FOIA applies to records regardless of format or platform, so text messages, instant messages, and content in collaboration tools like Microsoft Teams and Slack are subject to the same search and production obligations as email. The practical difficulty is that these channels are often stored separately from email, which makes a complete search harder unless the agency captures everything in one place.
How long does a FOIA request take?
By statute, agencies must respond within 20 business days, with a possible 10-day extension for unusual circumstances. In practice, simple requests may be completed within weeks, while complex requests involving large volumes of records or sensitive material can take several months or longer due to agency backlogs.
Does FOIA apply to state and local governments?
No. The federal Freedom of Information Act applies only to federal executive branch agencies. State and local governments are governed by their own public records laws, which go by various names such as sunshine laws, open records acts and right-to-know laws. Rules, timelines and exemptions vary by jurisdiction.
Read Next:Data Governance Risk and Compliance: What It Is, How It Works and Why Archiving Matters What Is Data Archiving? Definition, Benefits, and Best Practices |
