An eDiscovery custodian is a person who has possession or control over electronic records that are relevant to a lawsuit. In most cases that means the employee who wrote the email, edited the spreadsheet, or sent the text message, not the IT administrator who maintains the servers where those files happen to live. Legal teams identify custodians by their relationship to the data, not by job title or technical ownership of the hardware, because federal rules tie preservation duties, sanctions, and the scope of discovery to the people who actually controlled the information.
Why the Custodian Matters More Than the IT Owner
A custodian’s value in litigation comes from context. An IT professional can pull a backup tape, but only the person who drafted a memo or participated in a conversation can explain why it exists and what it means. The sales director who negotiated a deal knows which messages matter and what the numbers meant at the time; the database administrator who stores those messages usually does not.
That distinction shapes the whole discovery process. When lawyers reconstruct a timeline, they build it around the people who made decisions and exchanged information. The relevance of any file depends heavily on who held it, when they accessed it, and what they did with it.
How Custodians Get Identified
Figuring out who qualifies as a custodian starts with the allegations in the complaint and works backward through the organization. Counsel reviews org charts, project logs, and reporting structures to find who managed the departments or transactions at issue. The goal is to narrow hundreds of potential employees down to a core group likely to possess discoverable information about the claims or defenses.
Selecting the wrong people creates problems in both directions. Cast the net too narrow and critical evidence gets missed, inviting spoliation allegations. Cast it too wide and the legal team drowns in irrelevant data while collection and review costs climb. Teams verify which employees were active during the relevant timeframe and who had decision-making authority or direct involvement in the subject matter.
Federal Rule of Civil Procedure 26(f) requires the parties to confer early in the case and develop a discovery plan addressing preservation of electronically stored information, the forms in which it should be produced, and any privilege concerns.1Legal Information Institute. Rule 26 – Duty to Disclose; General Provisions Governing Discovery Custodian identification typically happens before or during this conference, because the custodian list drives the entire scope of what gets collected.
What Data Falls Under a Custodian’s Control
Custodians generate and manage electronic information across a surprisingly wide range of systems. The obvious sources are professional email, text messages on company-issued phones, and chat logs from platforms like Slack or Microsoft Teams. Custodians also control files stored in cloud environments like Google Drive, OneDrive, and Dropbox, along with documents on local hard drives and removable media like USB drives. A single person might have relevant data scattered across a laptop, a tablet, a smartphone, and two or three cloud services.
Metadata adds another layer. Every file carries invisible information about when it was created, who modified it, and when it was last accessed. That data often proves more valuable than the document itself because it establishes timelines and patterns a party might otherwise dispute.
Ephemeral and Auto-Deleting Messages
Apps like Signal, WhatsApp, and standard text messaging often include features that automatically delete messages after a set period. These self-destructing messages can vanish from the sender’s device, the recipient’s device, and the platform’s servers before anyone thinks to save them. When litigation is reasonably anticipated, custodians and their organizations need to disable auto-deletion settings. Failing to do so can trigger spoliation sanctions, and legal holds should explicitly cover ephemeral messaging so that custodians understand they cannot let relevant conversations disappear.
What a Custodian Is Not Responsible For
Not every piece of relevant evidence belongs to a specific person. Shared drives, SharePoint sites, enterprise databases, CRM platforms like Salesforce, and ticketing systems contain information that no single custodian controls. These are non-custodial data sources, and they fall outside the custodian framework even though they are discoverable. Treating them as a custodian’s responsibility, or ignoring them because no custodian owns them, is a common mistake. Rule 26(f) discovery plans should address non-custodial sources alongside custodial ones.1Legal Information Institute. Rule 26 – Duty to Disclose; General Provisions Governing Discovery
The Preservation Duty and Legal Holds
The duty to preserve evidence attaches the moment litigation is reasonably anticipated, not when a complaint is formally filed. Waiting for service of process risks losing data in the meantime, and courts have little patience for that excuse. Once the duty attaches, the organization issues a legal hold notice directing identified custodians to stop deleting, altering, or overwriting any potentially relevant data.2Legal Information Institute. Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions
Compliance means more than telling people to save their files. It involves suspending auto-delete features on email accounts, halting routine hardware recycling, disabling disappearing-message settings on chat apps, and pulling backup tapes containing key custodians’ data out of normal rotation. The Zubulake v. UBS Warburg decisions established that once litigation is reasonably anticipated, a company must suspend its routine document destruction policies and implement a litigation hold.3U.S. Courts. Zubulake Revisited: Pension Committee and the Duty to Preserve Custodians who ignore a legal hold put the entire organization at risk.
Organizations should follow up with custodians who don’t acknowledge the hold within 48 hours. A hold that exists on paper but was never read by the people it targets is barely better than no hold at all.
What Happens When a Custodian Fails to Preserve
Federal Rule of Civil Procedure 37(e) governs what happens when electronically stored information that should have been preserved is lost because a party failed to take reasonable steps to keep it. The rule creates two tiers of consequences.2Legal Information Institute. Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions
The first tier applies when the lost information cannot be recovered through other discovery and another party is prejudiced by its absence. The court may order curative measures, but only measures “no greater than necessary” to address the harm. That might mean allowing additional depositions, reopening discovery on a narrow topic, or giving the jury a factual instruction about what the missing data likely contained.2Legal Information Institute. Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions
The second tier is far more severe and carries a higher threshold. A court may presume the lost information was unfavorable, instruct the jury to draw that inference, or enter a default judgment only if it finds the party acted with the intent to deprive the other side of the information. Negligence, even gross negligence, is not enough for these harsher sanctions. The court needs evidence of deliberate destruction.2Legal Information Institute. Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions
Custodian Interviews and Data Mapping
The custodian interview is a structured conversation where legal professionals ask targeted questions to figure out where a person’s relevant data actually lives. The questions go beyond “what’s in your email” and probe daily habits: Do you use a personal phone for work calls? Do you save drafts to a local folder before uploading to the shared drive? Do you communicate with colleagues on WhatsApp or Signal? Have you used personal cloud storage for work documents?
These interviews surface data locations that IT departments often don’t know about. A compliance officer keeping a personal spreadsheet of suspicious transactions on a home laptop creates a data source no server audit would reveal. Discovering a missed source after production is already underway damages credibility with the court and with opposing counsel.
After the interviews, legal teams build a data map: a written inventory connecting each custodian to specific servers, applications, devices, and cloud accounts. The map guides forensic collection specialists and helps counsel communicate the scope of discovery at the Rule 26(f) conference. It also serves as evidence of good-faith preservation efforts if the adequacy of the litigation hold is later challenged.
Personal Devices and Privacy Limits
When custodians use personal phones, tablets, or home computers for work, the line between corporate data and private life blurs fast. Courts recognize that individuals have a compelling privacy interest in the contents of their personal devices. Getting a court order to forensically image someone’s personal phone requires more than just relevance; the requesting party needs to show the exam is proportional to the needs of the case given that privacy interest.
In practice, courts require the requesting party to present reliable evidence that the custodian’s self-directed production was incomplete or misleading before ordering a forensic exam. If the volume of data produced from a phone is suspiciously small compared to the device’s storage capacity, that discrepancy can justify a deeper look. A fishing expedition through someone’s personal device just because they occasionally texted a coworker about a project is unlikely to pass judicial scrutiny.
Organizations with bring-your-own-device policies should address eDiscovery obligations in those policies before litigation arises. Establishing upfront that work-related data on personal devices is subject to preservation and production is far easier than fighting about it after a lawsuit lands.
Proportionality and the Size of the Custodian List
Adding custodians to a case is not free. Each new custodian means another round of data collection, processing, review, and production, and attorney review of collected documents dwarfs every other cost in the budget. Rule 26(b)(1) limits discovery to information that is both relevant and proportional to the needs of the case, weighing the importance of the issues, the amount in controversy, each party’s access to the information, the parties’ resources, the importance of the discovery to resolving the dispute, and whether the burden outweighs the likely benefit.1Legal Information Institute. Rule 26 – Duty to Disclose; General Provisions Governing Discovery
In a $50 million contract dispute, collecting from fifteen custodians across two departments is routine. In a $200,000 employment case, the same request would likely be challenged as disproportionate. Experienced litigators negotiate custodian lists carefully during the Rule 26(f) conference, often agreeing to start with a core group and expand only if initial review reveals gaps.