Document type: Toolkit Practice area: Technology — Data and Privacy Jurisdiction: United States (federal) and international Last reviewed: 5 September 2026
How to use this toolkit
The failures in this practice are operational. Nobody loses a case here on a subtle reading of 18 U.S.C. § 2703; they lose it by producing content on a subpoena, missing a nondisclosure expiry, answering a fraudulent emergency request, or letting a demand sit in a support queue for three weeks.
So this is a set of forms, letters, and trackers. Adapt the language freely; keep the structure, because the structure is what catches the errors.
Tool 1 — Intake log
DEMAND LOG
ID | Date recvd | Method | Issuing authority | Country | Process type
| Account ID(s) | Data sought (content / non-content / subscriber)
| Response deadline | NDO? (Y/N, expiry) | Branch | Owner
| Validated (date) | Scope negotiated (Y/N) | Produced (date)
| Withheld & basis | Customer notified (date) | Closed
PROCESS TYPE VALUES
US-WARRANT · US-2703(d) · US-SUBPOENA · US-PEN/TRAP · US-WIRETAP
PRESERVATION · FOREIGN-ORDER · CIVIL-SUBPOENA · 1782 · EMERGENCY
NSL/FISA (separate secured file — log ID only)
BRANCH VALUES
1 US criminal · 2 Foreign · 3 Civil · 4 §1782 · 5 Emergency
6 National security
Annotation. Two fields do disproportionate work. NDO expiry is what drives the customer notification that most providers never send, because nobody tracked when the order lapsed. Withheld & basis is what lets you answer, a year later, the question of whether the company has been consistent — which is the question that determines whether its objections are credible. Note also that national security matters get a log ID and nothing else; the substance lives elsewhere.
Tool 2 — Validation form
LEGAL PROCESS VALIDATION Demand ID: __________
FACIAL SUFFICIENCY
[ ] Signed [ ] Dated [ ] Complete w/ attachments
[ ] Issuing authority identifiable and named: ______________
[ ] Court / agency has jurisdiction over us? Y / N / unclear
PROCESS TIER (18 U.S.C. § 2703)
Data sought:
[ ] Basic subscriber info (name, address, session times/durations,
length and types of service, identifier, means/source of
payment) → SUBPOENA sufficient
[ ] Other non-content records
→ COURT ORDER on specific and
articulable facts
[ ] CONTENTS of communications
→ ** WARRANT on probable cause **
Process presented: ______________________
** MATCH? YES / NO ** If NO → Objection Letter A
ACCOUNT
[ ] Identifier(s) as stated: ______________________
[ ] Account exists and matches? Y / N
[ ] Any ambiguity that could produce the wrong customer's data?
SCOPE
[ ] Date range stated: ____________ [ ] Categories stated
[ ] Accounts limited [ ] Scope objection warranted?
NONDISCLOSURE
[ ] NDO attached? Y / N Statutory basis: ______________
[ ] What EXACTLY is prohibited: ______________________
[ ] Duration / expiry: ____________ ** CALENDARED ** [ ]
OTHER
[ ] Return date realistic? Extension needed?
[ ] Preservation request rather than production demand?
[ ] MLAT-derived? (US process disconnected from a US matter)
Validated by: ____________ Date: ________ Branch: ______
Annotation. The process tier block is the highest-value part of this toolkit. In a typical portfolio a meaningful share of demands seek content on a subpoena, and the objection is a paragraph. Run this block on every demand mechanically, before anyone reads the substance, and the defective ones surface immediately.
Tool 3 — Routing decision tree (one page, posted)
A DOCUMENT DEMANDING CUSTOMER DATA HAS ARRIVED
|
Is it from a national security authority (NSL / FISA)?
YES → BRANCH 6. Do not read further. Escalate to
[named designated recipient] immediately.
NO ↓
Is the issuer a NON-US government authority?
YES → BRANCH 2. Escalate to counsel. Do not produce.
NO ↓
Is it from a PRIVATE PARTY (civil litigation)?
YES → Is it a § 1782 application?
YES → BRANCH 4 (escalate)
NO → BRANCH 3 (template objection, same day)
NO ↓
Is it a request for VOLUNTARY disclosure citing an
emergency (danger of death / serious physical injury)?
YES → BRANCH 5. On-call responder. VERIFY BY CALLBACK.
NO ↓
Is it a PRESERVATION request only?
YES → Preservation tracker. No production. 90 days.
NO ↓
BRANCH 1 — US criminal process. Validate (Tool 2).
Content demanded? → escalate to counsel
High-profile account? → escalate to counsel
Novel or unclear process?→ escalate to counsel
Otherwise → response team
Annotation. Print it. The purpose is that a person holding an envelope at 4:45 on a Friday can place it in ninety seconds. The first question is national security precisely because the handling failure there begins the moment the wrong person reads the document.
Tool 4 — Scope negotiation script
CALL, DO NOT WRITE FIRST.
"Hello, this is ____ from ____. I'm calling about the [warrant/
order/subpoena] you issued on [date] regarding account ____. We're
working on it and I wanted to check a couple of things with you so
we get you what you actually need."
THEN, IN ORDER:
1. Confirm the account identifier. ("Just so we produce the right
account — you're looking for ____, correct?")
2. Confirm the period. ("The order doesn't specify a date range.
The account goes back to 2019. What period matters?")
3. Confirm the categories. ("We can produce ____, ____, and ____.
Do you need all of it, or is ____ what you're after?")
4. Offer the alternative. ("If what you need is ____, we can get
that from the non-content records, which we can produce on the
order you already have.")
5. Offer staging. ("We can get you ____ this week and the rest by
____ if you still need it.")
CLOSE:
"I'll send you an email confirming what we agreed so we both have
it. If anything changes, call me directly at ____."
THEN SEND THE EMAIL. Same day. Attach to the file.
Annotation. This resolves more demands than every objection letter in this toolkit combined. Investigators generally want relevant material, not maximum material, and an over-broad demand is usually a drafting shortcut rather than a position. The call also builds the relationship that makes the next objection land. Note the sequence: identifier first, because a wrong-account demand is the error that produces the worst outcome for everyone.
Tool 5 — Objection letter A: subpoena seeking content
[Date]
[Issuing authority]
Re: [Subpoena] dated [date] — Account [____]
Dear [ ]:
[Company] is in receipt of the above [subpoena], which seeks the
contents of communications associated with the referenced account.
Under 18 U.S.C. § 2703, the contents of communications held by a
provider may be compelled only by a warrant issued under the Federal
Rules of Criminal Procedure or an equivalent State warrant.
Section 2702 separately prohibits [Company] from divulging such
contents absent a statutory exception. [Company] therefore cannot
produce contents in response to the [subpoena].
[Company] will produce, in response to the [subpoena], the
following non-content records for the account: [list]. That
production will be made by [date].
If a warrant issues, [Company] will process it promptly. In the
interim, [Company] will preserve the account contents pursuant to
18 U.S.C. § 2703(f) for ninety (90) days from the date of this
letter.
If it would be useful to discuss what records are available and
what process would reach them, please contact me directly at
[number].
Very truly yours,
Annotation. The last two paragraphs are what make this letter effective rather than merely correct. It preserves, so nothing is lost while the warrant is obtained; it states what will be produced now; and it offers a conversation. An objection that ends at "we cannot produce" generates a motion. This one generates a warrant.
Tool 6 — Objection letter B: civil subpoena
[Date]
[Issuing counsel]
Re: Subpoena dated [date] in [Case], No. [____] — Account [____]
Dear Counsel:
[Company] has received your subpoena seeking records associated
with the referenced account, including the contents of
communications.
The Stored Communications Act, 18 U.S.C. § 2702, prohibits a
provider from divulging the contents of communications, and
contains no exception for civil discovery. Courts have accordingly
held that a civil litigant may not obtain the contents of
communications from a provider by subpoena. [Company] therefore
objects to the subpoena to the extent it seeks contents.
The material you seek is available from the party. A party in
possession of its own communications may be required to produce
them under Federal Rules of Civil Procedure 26 and 34. In addition,
§ 2702 permits disclosure with the lawful consent of the subscriber.
If you provide [Company] with the account holder's written consent,
[Company] will process a production request in the ordinary course.
[Company] does not object to producing its own business records
concerning the account relationship, to the extent the subpoena
seeks them and subject to [Company]'s remaining objections, and is
prepared to discuss scope.
[Company] will preserve the account pending resolution.
Very truly yours,
Annotation. Three deliberate features. It distinguishes content (barred) from the company's own business records (not barred) — providers that refuse everything lose credibility. It names the consent route, which is how these actually get resolved. And it offers preservation, which removes the urgency that otherwise drives a motion to compel.
Tool 7 — Foreign government demand response
[Date] — via [local counsel] / [official channel]
[Foreign authority]
Re: [Order] dated [date] — Account [____]
We write on behalf of [Local Entity] and [US Parent] in response to
the above Order.
1. LOCATION OF THE DATA AND CONTROL. The records sought are held
by [US Parent], a United States entity. [Local Entity] does not
possess, control, or have technical access to those records.
2. UNITED STATES LAW. [US Parent] is subject to 18 U.S.C. § 2702,
which prohibits a provider from divulging the contents of
communications and from divulging subscriber records to a
governmental entity, except in enumerated circumstances.
Violation exposes [US Parent] to civil liability under
18 U.S.C. § 2707. The Order does not fall within an enumerated
exception.
3. AVAILABLE ROUTES. [US Parent] can lawfully produce the records
sought if any of the following applies:
(a) an order issued under an executive agreement between
[Country] and the United States under the CLOUD Act;
(b) United States legal process obtained through mutual legal
assistance, transmitted via [Country]'s central authority
to the United States Department of Justice, Office of
International Affairs;
(c) the lawful consent of the account holder; or
(d) an emergency involving danger of death or serious
physical injury, on the facts of which [US Parent] would
need to be satisfied.
4. COOPERATION. [US Parent] wishes to assist within the limits of
the law applicable to it and will process promptly any request
arriving through the routes above. Please contact [name] at
[contact] to discuss.
Respectfully,
Annotation. Paragraph 4 is not decoration. The realistic risk in these matters is enforcement pressure on the local entity and its people, and the tone of the response affects that risk. A letter that explains the bind, offers four concrete routes, and names a person to call reads as cooperation constrained by law. A letter that simply refuses reads as defiance, and the consequences fall on employees.
Tool 8 — Emergency request form
EMERGENCY DISCLOSURE REQUEST — 18 U.S.C. § 2702 EXCEPTION
TO BE COMPLETED BY THE REQUESTING AGENCY
Agency: ______________________ Case/incident no.: __________
Requesting officer: ______________ Title: ______________
Agency email (agency domain): ______________
Agency phone (main switchboard, not direct): ______________
Nature of the emergency:
[ ] Danger of death [ ] Serious physical injury
Describe the specific danger and to whom: ________________
________________________________________________________
Why disclosure is required WITHOUT DELAY: _________________
Account identifier(s): ______________________
Specific data requested (be precise): ______________________
________________________________________________________
Signature / date: ______________________
---------------- TO BE COMPLETED BY [COMPANY] ----------------
Received: ____ (date/time) Responder: ______________
** VERIFICATION **
[ ] Agency phone number obtained INDEPENDENTLY from the agency's
own public directory — NOT from this request
Number used: ______________
[ ] Callback placed at ____ ; officer confirmed by ____________
[ ] Requester's identity confirmed
[ ] Email domain checked against agency's known domain
** GOOD-FAITH ASSESSMENT **
Does the request describe an emergency involving danger of death
or serious physical injury? YES / NO
Does disclosure appear required without delay? YES / NO
Basis for my good-faith belief: ______________________________
______________________________________________________________
DECISION: [ ] Disclose (narrowed to: ______________________)
[ ] Decline — reason: ______________________
Approved by: ______________ Time: ________
POST-HOC
[ ] Counsel review completed (date): ________
[ ] Customer notified (date / or basis for not notifying): ______
Annotation. The verification block is the most valuable control in this entire toolkit. Fraudulent emergency requests — spoofed agency domains, urgent language, a plausible officer name — are a documented and recurring attack, and the callback-on-an-independently-obtained-number rule defeats nearly all of them at a cost of five minutes. Make it mandatory, with no exception for urgency, because urgency is exactly what the attack manufactures.
Tool 9 — Nondisclosure order tracker and notification letter
NDO TRACKER
Demand ID | Statutory basis | Issued | What is prohibited (verbatim)
| Who may we tell internally? | Expiry | ** NOTIFY DATE **
| Extended? | Notified (date) | Notification method
RULES
· An order barring notice to the subscriber does NOT bar internal
communication, counsel, or aggregate transparency reporting.
Do not over-comply.
· Indefinite duration → flag for possible challenge.
· NOTIFY DATE = expiry. Calendar it the day the order arrives.
CUSTOMER NOTIFICATION LETTER
[Date]
[Customer]
Re: Legal process concerning your account
Dear [ ]:
Consistent with our commitment to notify customers of legal process
seeking their data, we are writing to inform you that on [date]
[Company] received [describe process] from [authority] seeking
[categories] relating to your account.
We were prohibited from notifying you at the time by a court order
issued under 18 U.S.C. § 2705(b). That order has now expired.
[Company] [produced the following on [date] / objected and did not
produce / produced a narrowed set following discussion with the
issuing authority, consisting of ____].
A copy of the process is enclosed[, redacted as required].
If you have questions, please contact [name] at [contact].
Very truly yours,
Annotation. Sending this letter is optional as a matter of law and close to mandatory as a matter of credibility. Providers that notify on expiry, consistently, build trust with enterprise customers that no privacy policy language can buy. The clause in your terms of service — notify except where prohibited by law — is what makes the practice both possible and expected.
Tool 10 — Preservation tracker
PRESERVATION TRACKER
Demand ID | Requesting authority | Received | Accounts | Scope
preserved (BE PRECISE) | Systems | 90-DAY EXPIRY
| Extension requested? | New expiry | Superseded by process?
| RELEASED (date) | Released by
RULES
· Preserve NARROWLY. An account request does not freeze a tenant.
· Release on expiry unless renewed or superseded. A preserved
dataset with no legal basis is a liability.
· Preservation ≠ production. It does not authorize notice and
does not itself require silence.
· DELETION CONFLICT: if a customer exercises a deletion right on
a preserved account → suspend deletion of preserved material,
document the basis, complete on release. Log it here:
Deletion request recvd: ____ Suspended: ____ Completed: ____
Annotation. The deletion-conflict line exists because the privacy team and the legal process team are usually different people looking at different systems, and the conflict surfaces only when a customer complains that a deletion request was not honored. Put the conflict in one tracker that both teams can see.
Tool 11 — Production cover letter and review sheet
PRODUCTION REVIEW (second reviewer — NOT the person who exported)
Demand ID: ______ Demand scope as narrowed: ______________
[ ] Export matches the account(s) demanded — verified
[ ] Date range matches — verified against the export, not the ticket
[ ] Categories match; nothing beyond scope included
[ ] Third-party data identified: ______________
[ ] Filtered where permitted [ ] Flagged to the authority
[ ] Privileged or otherwise protected material screened
[ ] Volume sane relative to the account
Reviewer: ____________ Date: ________
PRODUCTION COVER LETTER
[Date]
[Authority]
Re: [Process] dated [date] — Account [____] — Production
Enclosed is [Company]'s production in response to the above.
SCOPE PRODUCED. Consistent with our discussion of [date], this
production comprises [categories] for the period [dates] for
account [____].
WITHHELD. [Company] has not produced [category], on the basis
that [reason]. [Company] preserves that material pending further
process or discussion.
OBJECTIONS. [Company] preserves all objections, including [____].
CERTIFICATION / CUSTODIAN. [If a certificate of authenticity is
required, attach it here.]
Please contact [name] at [contact] with any questions.
Very truly yours,
Annotation. The review sheet's first line — a second reviewer who did not build the export — is the single control that prevents over-production, which is the most common substantive error in this practice and the only one that cannot be undone.
Tool 12 — Transparency report template
[COMPANY] TRANSPARENCY REPORT — [Period]
GOVERNMENT DEMANDS FOR USER DATA
+---------------------------+-------+----------+---------+
| Type | Recvd | Accounts | Produced|
+---------------------------+-------+----------+---------+
| Search warrants | | | |
| Court orders (§ 2703(d)) | | | |
| Subpoenas | | | |
| Pen register / trap&trace | | | |
| Wiretap orders | | | |
| Preservation requests | | | |
| Emergency requests | | | |
| Foreign gov't demands | | | |
| § 1782 applications | | | |
| Civil subpoenas | | | |
+---------------------------+-------+----------+---------+
OUTCOMES
Produced in full ____ In part ____ ** Rejected ____ **
Narrowed after discussion ____
Emergency requests declined ____
Emergency requests found NOT genuine ____
BY COUNTRY OF ISSUING AUTHORITY
[table]
NATIONAL SECURITY PROCESS
Reported only in the bands permitted by law:
[permitted disclosure]
** Reviewed by counsel before publication — every time. **
NOTES ON METHODOLOGY
[Counting conventions: per demand or per account; what counts as
"produced in part"; how preservation is treated.]
Annotation. The two boxed numbers — rejected, and emergency requests found not genuine — are the ones that make a transparency report worth publishing. Anyone can report demands received. Reporting how many you refused is what demonstrates that a process exists. And the national security line is the one that gets a company in real trouble if published outside the permitted bands; route it through counsel every single time.
Tool 13 — Contract clauses the program depends on
NOTIFICATION. Provider will notify Customer promptly of any legal
process, subpoena, warrant, court order, or governmental demand
seeking Customer Data, and will provide a copy, EXCEPT where
prohibited by applicable law or court order, or where Provider
reasonably believes notice would be counterproductive to an
emergency involving danger of death or serious physical injury.
Where notice is prohibited for a period, Provider will notify
Customer promptly upon expiration of the prohibition.
OPPORTUNITY TO OBJECT. Where notice is permitted, Provider will,
to the extent the deadline in the demand reasonably allows, afford
Customer an opportunity to seek a protective order or other relief
before producing Customer Data.
NARROW PRODUCTION. Provider will seek to narrow any demand that is
overbroad and will produce only the narrowest set of Customer Data
responsive to the demand as narrowed.
COSTS. Provider will bear its ordinary costs of responding. Where
Customer requests Provider to oppose or litigate a demand, Customer
will reimburse Provider's reasonable external costs.
DATA LOCATION. Customer Data is processed in [locations].
Customer acknowledges that the location of data does not by itself
determine which legal authorities may compel its disclosure.
TRANSPARENCY REPORTING. Provider may include demands in aggregate
statistical transparency reporting that does not identify Customer.
Annotation. The final sentence of the notification clause is the one to insist on: the commitment to notify when the prohibition expires. Most notification clauses stop at "except where prohibited," which lets a provider stay silent forever once any order issues. And the data location clause deliberately declines to imply that residency is a legal shield — because under the CLOUD Act it is not, and a contract that suggests otherwise creates a misrepresentation problem the company does not need.
Related documents
- Cross-Border Government Demands for Data: The Stored Communications Act, the CLOUD Act, and MLATs
- Responding to a Cross-Border Data Demand: A Practical Guide
- Cross-Border Data Demand Response Checklist: A Practical Checklist
- Privacy and Data Protection Toolkit: Building and Running a Privacy Program
- Cloud and SaaS Agreements: Service Levels, Data Rights, Security, and Exit
- International Data Transfers After Schrems II: Standard Contractual Clauses and Transfer Impact Assessments
This toolkit is general information, not legal advice, and does not create an attorney-client relationship.
