What is a custodian in eDiscovery? Definition and practical workflow

One of the first questions in any email discovery process is deceptively simple: whose email do we need?

The answer , identifying the right custodians , shapes every subsequent decision in the eDiscovery process. Get it right and you preserve the relevant record efficiently. Get it wrong and you either miss critical evidence or bury your review team in irrelevant data.

Here's what small firm attorneys need to know about custodians.

What a Custodian Is

In eDiscovery, a custodian is any person who has possession, custody, or control over potentially relevant electronically stored information. For email, this typically means anyone who sent, received, or was copied on relevant communications during the relevant time period.

Custodians are not limited to parties in the litigation. An employee who witnessed relevant events, a manager who made decisions about the matter, or an assistant who handled logistics may all be custodians whose email is relevant.

The custodian concept is important because most eDiscovery systems , and most litigation holds , are organized around custodians rather than documents. When you issue a litigation hold, you issue it to custodians. When you collect email, you collect it from custodians. When opposing counsel asks for discovery, they often ask for "email of the following custodians."

How to Identify Custodians

Custodian identification is part investigation and part judgment. Here's a framework:

Start with the key players. Who were the principal people involved in the events at issue? In an employment dispute, this typically includes the employee, their direct supervisor, HR personnel who handled any complaints, and decision-makers involved in any adverse action.

Work outward from the key players. Who did the key players communicate with about the relevant matters? Who had knowledge of the events? Who was copied on significant emails? These secondary custodians often hold important context.

Consider former employees. If relevant events occurred before someone left the organization, their email during their tenure may still be relevant. Former employees are custodians too, even if their data is in an archive.

Think about where information lives. Email is the obvious starting point, but consider whether relevant communications occurred through other channels: instant messaging, shared drives, mobile devices, personal email used for business.

Ask your client. Attorneys sometimes overlook the most direct source of custodian information: the client who was there. Who did they interact with? Who would have knowledge of the relevant events? Who cc'd them on important communications?

The Proportionality Question

Not every possible custodian needs to be included in discovery. FRCP Rule 26(b)(1) requires discovery to be proportional to the needs of the case. For custodian identification, this means thinking critically about which custodians are likely to have material information versus which would add volume without value.

A junior employee who was peripherally involved in one aspect of a matter may not need to be a custodian. A senior executive who made key decisions clearly does. The goal is complete coverage of the people whose email matters, without expanding scope unnecessarily.

In practice, the opposing party will often push for additional custodians, and you'll push back. Starting with a reasonable, well-justified custodian list , one you can explain and defend , puts you in a better position than starting with either too few (and being seen as incomplete) or too many (and creating an unmanageable review burden).

Custodian Documentation

For each custodian, document:

• Name and role at the relevant time
• Why they're a custodian , what information they likely possess and why it's relevant
• Email accounts , corporate accounts, and any personal accounts used for business
• Devices , if relevant communications occurred on a personal phone or laptop
• Dates of relevance , when they had involvement with the relevant matter
• Current status , still employed? Left the organization? Left on good terms?

This documentation serves two purposes: it helps you manage the collection process, and it creates a record that the identification was thoughtful and complete.

Litigation Hold Implications

Once you've identified custodians, litigation hold notices go to each of them , and to IT, to ensure that auto-deletion is suspended for their accounts. The hold notice should explain, in terms the custodian can understand, what they need to preserve and what they must not delete.

Follow up with custodians to confirm receipt and understanding. Document the follow-up. One of the most common spoliation fact patterns involves a hold notice that was issued but never confirmed, and then emails deleted because a custodian didn't understand they were supposed to preserve them.

Over-Identification vs. Under-Identification

Both errors are costly, in different ways.

Over-identification , including too many custodians , drives up collection, processing, and review costs. It creates a larger privilege review burden. It slows down the process. And it may give opposing counsel more material to work with than they'd otherwise have.

Under-identification , missing relevant custodians , creates risk. If it later emerges that a custodian with significant relevant information was not included in the litigation hold and their emails were deleted, that's a potential sanctions issue. Courts take gaps in custodian identification seriously when the gap appears to have resulted in the loss of relevant evidence.

The right approach is deliberate rather than reflexive in either direction. Think through who actually had relevant information, document your reasoning, and be prepared to explain and defend your custodian list.

A Practical Workflow

For a typical employment or commercial matter at a small firm:

1. Interview your client about who was involved and who would have relevant information
2. Draft an initial custodian list with each person's role and basis for inclusion
3. Issue the litigation hold to all identified custodians and IT
4. Collect email from each custodian for the relevant time period
5. Review the collected email , often you'll find references to additional custodians you hadn't identified
6. Expand the custodian list as needed and issue supplemental holds
7. Disclose your custodian list to opposing counsel as required and be prepared to defend it

Custodian identification is iterative. You rarely get it completely right in the first pass. Building a process that allows you to refine your list as the case develops , without losing preservation coverage , is what good practice looks like.

FAQ

What is a custodian in eDiscovery?

A custodian is a person or system that may possess, control, or have access to information relevant to a legal matter.

How do you identify email custodians?

Start with the disputed events, then identify people who sent, received, approved, stored, or managed relevant communications and systems.

Can a system be a custodian?

Yes. In practical discovery work, shared mailboxes, HR systems, ticketing tools, CRM systems, and archives may function as important sources even when they are not individual people.

Related reading

• Litigation hold letter template
• Email chain of custody
• Email subpoena response guide
• Document employee misconduct email

The screenshot above is a product example of the timeline view these articles describe: messages in order, source context preserved, and export or sharing controls available when the record is ready.