Summary. A subpoena arriving at a company that is not a party to the lawsuit is an operational problem before it is a legal one, and the choices made in the first two weeks determine what the response costs. The recipient has rights most companies never exercise: a written objection alone shifts the burden of going forward to the issuing party, significant expenses must be shifted on any order compelling production, and the issuing lawyer carries an affirmative duty to avoid undue burden. This guide walks the response from the moment the envelope opens — validating service, issuing a hold, identifying whose privilege is implicated, drafting an objection, negotiating scope and cost, and producing defensibly. It also covers government demands and testimony.

The subpoena lands in the accounts payable inbox, or with the receptionist, or in a general counsel's email from a process server. It commands production of "all documents concerning" a former customer, in eleven days, at an address in another state, in a lawsuit the company has never heard of.

Most companies do one of two things, and both are wrong. They ignore it, on the theory that they are not involved — which risks contempt. Or they comply completely and immediately, producing everything responsive without objection, without a protective order, without notifying the customer whose contract terms are in the production, and without asking anyone to pay for the two hundred hours it took.

The correct response takes about ninety minutes of work in the first week and saves most of the cost. This guide is that ninety minutes, expanded.

Day one: triage

1. Date-stamp everything and identify the deadline. Two dates matter:

  • The compliance date stated on the subpoena.
  • The objection deadline — the earlier of the compliance date or fourteen days after service under Fed. R. Civ. P. 45(d)(2)(B).

Calendar both immediately, with reminders at day three and day seven.

2. Determine what kind of demand this is. The response differs completely:

  • A federal civil subpoena under Rule 45.
  • A state court subpoena, governed by that state's rules — and if issued in another state, likely domesticated under the Uniform Interstate Depositions and Discovery Act, in which case the local state's rules govern compliance and motion practice.
  • An administrative or grand jury subpoena, or a civil investigative demand from a government agency. Different rules, different deadlines, different stakes, and a different article.
  • An arbitration subpoena, whose enforceability against a nonparty is limited and jurisdiction-dependent.

3. Confirm the subpoena is valid on its face:

  • Was it served properly? Rule 45 contemplates delivery to the named person; many courts require personal service on an authorized agent for an entity.
  • Is the place of compliance within 100 miles of where the company resides, is employed, or regularly transacts business in person? A demand to produce in a distant city is defective.
  • Was a witness fee tendered, if testimony is commanded? None is required for documents alone.
  • Is the time to comply reasonable? Eleven days for years of records is not.
  • Is the court identified, and does the caption make sense?

4. Identify who inside the company owns this. One person, named, with authority. Legal if there is a legal department; otherwise the CFO or the CEO, with outside counsel engaged. The most expensive subpoena responses are the ones where three people each did part of the work.

5. Issue a preservation hold — today. The company now knows the documents are relevant to litigation. Destroying them, even by routine automated deletion, creates a spoliation problem entirely separate from the discovery dispute. The hold should:

  • identify the custodians and systems likely to hold responsive material;
  • suspend automatic deletion on email, messaging, document management, and backup systems;
  • instruct recipients not to delete or alter anything; and
  • be documented, with acknowledgments.

Preservation is broader than production. Preserve first; argue about scope afterward.

Day two through five: understand the request

Read the requests individually and map them.

For each numbered request, write down: what it asks for, where in the company that would live, roughly how much there is, who the custodians are, and what the collection would cost. A one-page table. This document does three things — it drives the objection, it supports a burden showing, and it becomes the basis for a cost estimate.

Identify the categories that create problems:

  • Privileged material. The company's own communications with its counsel, and work product.
  • Someone else's privilege. A subpoena to an accountant, a vendor, a consultant, or a former employee frequently seeks documents over which a third party holds the privilege. Notify them.
  • Trade secrets and competitively sensitive information — pricing, cost, customer lists, formulas, source code.
  • Personal data of employees or customers, which may trigger notice obligations under state privacy statutes, contractual commitments, or foreign data protection law.
  • Material subject to a confidentiality agreement with a third party, which likely contains a notice-and-cooperation provision requiring the company to tell the counterparty before producing.
  • Regulated data — protected health information under HIPAA, financial records under Gramm-Leach-Bliley and state analogues, educational records under FERPA, and communications content protected by the Stored Communications Act.
  • Material the company simply does not have, which is worth saying early and clearly.

Find out what the case is about. Pull the docket. A twenty-minute review of the complaint tells you whether the request is targeted or a fishing expedition, who the parties are, whether the company has a business relationship with either, and whether the material is available from a party — which is the single most effective objection.

Check for a protective order. Most cases have one. Get a copy from counsel for either side and read it before producing anything. Confirm that a nonparty may designate, that there is an attorneys'-eyes-only tier if the material is competitively sensitive, and that materials must be returned or destroyed at the end.

Day five through fourteen: object

This is the step that most companies skip and that does the most work.

What a timely written objection accomplishes. Under Rule 45(d)(2)(B), once a written objection is served, the party that issued the subpoena may not inspect or copy the materials except pursuant to a court order. The burden of going forward shifts entirely. The company does not need to move to quash; it can object and wait.

Serve the objection on the party or attorney designated in the subpoena, in writing, before the deadline. Send by email and by mail, and keep proof.

Structure of a good objection letter:

  1. Identification — the subpoena, its date, the date of service, and the responding entity.
  2. A statement of nonparty status and a reservation of all rights under Rule 45, including the right to seek costs and a protective order.
  3. General objections stated once: to the extent the requests seek privileged material; material available from a party; material not in the company's possession, custody, or control; material outside a reasonable time period; and to the extent compliance would impose undue burden or significant expense.
  4. Specific objections request by request, identifying the defect concretely — "Request 4 seeks all communications with any customer over a nine-year period, without limitation to the subject matter of this litigation; the company has approximately 2.4 million such communications."
  5. A burden showing with numbers — custodians, volume, systems, estimated vendor and review cost, estimated hours. Vague assertions of burden fail; quantified ones succeed.
  6. A statement on the place of compliance if it is defective.
  7. An offer. This is what turns a dispute into a transaction: "Subject to entry of a protective order permitting the company to designate materials as Confidential and Attorneys' Eyes Only, and subject to agreement that the requesting party will bear the vendor costs of collection and processing, the company is prepared to produce the following: [narrowed set]."
  8. A meet-and-confer invitation with a proposed date.
  9. A privilege reservation stating that privileged materials will be withheld and logged in accordance with Rule 45(e)(2).

Do not, in the objection, do the following: refuse without explanation; assert boilerplate objections without specificity; commit to producing without addressing cost and confidentiality; or ignore the request entirely.

Negotiating

Most nonparty subpoenas resolve here, and the negotiation is more transactional than adversarial. The requesting party wants specific information; the company wants to spend as little as possible and to protect its confidences and its relationships.

What to negotiate, in order of value:

  • Scope. Date range, custodians, subject matter, and document types. Offer to run search terms on a defined custodian set and to report hit counts before reviewing — this is the single most effective way to demonstrate burden and to narrow productively.
  • Substitutes for full production. A declaration, a summary, a spreadsheet extracted from a system, a stipulation of facts, or a narrow set of key documents will often satisfy the actual need. Ask what the requesting party is trying to prove; frequently they will tell you, and the answer is narrower than the requests.
  • Format. Native files versus TIFF with load files, metadata fields, and de-duplication. Format choices drive cost significantly.
  • Cost sharing. See below.
  • Timing. A realistic schedule, in phases, with the most important material first.
  • Confidentiality. Entry of or accession to a protective order, with a tier appropriate to the sensitivity.
  • A business records certification under Fed. R. Evid. 902(11) in lieu of a custodian deposition — offer this proactively. It saves the company a deposition and gives the requesting party admissible evidence, so both sides benefit.
  • A commitment that this is the end. Ask for an agreement that the production satisfies the subpoena in full and that no custodian deposition will follow.

Get it in writing. A confirming email summarizing the agreed scope, format, cost arrangement, and schedule prevents the dispute that otherwise arrives when the production is delivered.

Cost recovery

Rule 45(d)(2)(B)(ii) provides that an order compelling production must protect a person who is neither a party nor a party's officer from significant expense resulting from compliance.

How to use it:

  • Raise it in the objection, before producing. A company that produces voluntarily and then asks for money has weakened its position considerably.
  • Quantify. Vendor collection and processing fees, hosting, attorney review time, and internal employee time diverted from other work. Provide an estimate with a basis.
  • Propose a mechanism — the requesting party engages and pays the vendor directly, or reimburses on invoice, or a fixed fee.
  • Recognize the limits. Courts weigh whether the nonparty has an interest in the outcome, its resources, and whether the requesting party's need justifies the cost. A large institution producing routine records will usually be expected to absorb them. A small company asked to run a forensic collection will not. Courts also differ on whether privilege review time is recoverable, with many limiting recovery to review necessary for compliance.
  • If the requesting party refuses, that fact goes into the opposition to any motion to compel, along with the burden showing. Courts are notably unsympathetic to a party that demanded extensive nonparty discovery and refused to contribute anything.

Protecting other people's interests

A nonparty frequently holds material that belongs, in a meaningful sense, to someone else.

Whose privilege is it. If the company is a vendor, an accountant, a consultant, or a former employer, the material may include communications privileged as to a client, a customer, or a former employer. The privilege holder must assert it; the custodian cannot waive it, but can destroy it by producing. Notify the holder promptly, in writing, with a deadline, and state that absent an objection the company will produce.

Contractual notice obligations. Most confidentiality agreements require the recipient to notify the disclosing party before producing pursuant to legal process, to cooperate in any effort to obtain protection, and to produce only the portion legally required. Search the contract database for the counterparty and comply. Failure is a breach independent of anything in the litigation.

Employees. A subpoena seeking personnel files, compensation data, or an employee's communications implicates the employee's interests and, in some states, statutory notice requirements. Several states require notice to the employee or consumer before producing employment or consumer records in response to a subpoena, with a waiting period. Check before producing.

Customers. Producing a customer's contract, pricing, or usage data without notice damages a commercial relationship even when it is legally permissible. Notify, and if the customer objects, tell the requesting party that the customer objects and let them resolve it.

Regulated categories. For protected health information, obtain the qualified protective order or the assurances required by 45 C.F.R. § 164.512(e). For financial records, follow the applicable state notice statute. For communications content, the Stored Communications Act generally bars a provider from producing it in a civil case, and the correct response is to say so.

Privilege

Log what you withhold. Rule 45(e)(2)(A) requires that a person withholding subpoenaed information under a claim of privilege expressly make the claim and describe the nature of the withheld material sufficiently to enable an assessment.

Practical approach:

  • Negotiate the log's scope first. Many parties agree to exclude communications with counsel after the litigation began, to log by category rather than document by document, or to use a metadata-based log. Each saves substantial cost.
  • Include the elements: date, author, recipients including copies, type, general subject matter, and the privilege asserted. Enough to evaluate, not enough to disclose.
  • Get a Federal Rule of Evidence 502(d) order or confirm the case's existing order covers nonparty productions. A 502(d) order provides that production does not waive privilege in that or any other proceeding, and it is the single most valuable protection available. Ask for it explicitly.
  • Confirm clawback procedures and use them promptly if something slips.

Producing

  • Produce to the agreed specification, with a cover letter identifying the Bates range, the requests each production responds to, and the confidentiality designations.
  • Designate before producing, not afterward. Apply the protective order's legend.
  • Keep a complete production copy with the load files and a log of what was produced when and to whom.
  • Preserve the collection, including the raw collected data and the search term reports, for the life of the case. If a dispute arises about completeness, this is the evidence.
  • Document the process — custodians, sources, search terms, date ranges, exclusions, and who did what. A one-page declaration written contemporaneously is worth days of reconstruction later.
  • Supplement if necessary, and say so.

Testimony

If the subpoena commands a deposition, additional considerations apply.

For an organization, the subpoena should describe the matters for examination with reasonable particularity, and the organization must designate and prepare one or more witnesses — the Rule 30(b)(6) obligation, which for a nonparty is a substantial burden and a legitimate basis for negotiating the topics down.

Practical steps:

  • Object to overbroad topics in writing before the deposition, and meet and confer. Do not simply produce a witness and object at the deposition.
  • Choose the witness for knowledge, not seniority, and prepare them on the designated topics — including on the boundaries of what they are designated for.
  • Prepare on privilege: the witness should know which subjects involve legal advice and should stop rather than answer.
  • Have counsel present. A nonparty witness without counsel is at a genuine disadvantage, and the company's interests are not represented by either party's lawyer.
  • Negotiate duration and location. Seven hours is the default; a nonparty with narrow relevant knowledge should ask for less, and remote depositions have removed most travel objections.
  • Seek costs. Some courts will award a nonparty its reasonable expenses of preparing and appearing where the burden is substantial.
  • Offer a declaration instead. For a narrow factual point, a sworn declaration frequently satisfies the requesting party and eliminates the deposition entirely.

If you have to litigate

Motion to quash or modify goes to the court for the district where compliance is required — not the issuing court. Grounds the court must grant, under Rule 45(d)(3)(A): unreasonable time to comply, exceeding the geographic limits, requiring disclosure of privileged matter, or subjecting a person to undue burden. Grounds the court may grant, under (d)(3)(B): trade secrets and other confidential commercial information, and unretained expert opinion.

Motion for protective order under Rule 26(c) is an alternative or a supplement, and is the right vehicle for confidentiality terms.

Opposing a motion to compel. The moving party bears the burden on relevance and proportionality; the nonparty bears it on privilege and on the specifics of claimed burden. Support the burden with a declaration containing numbers: systems, custodians, volumes, hours, and dollars, signed by someone who actually knows.

Transfer under Rule 45(f). The compliance court may transfer the motion to the issuing court with the subpoenaed person's consent, or on exceptional circumstances. Consenting can be smart where the issuing judge has already resolved the same scope question, and it avoids inconsistent rulings — but it also moves the fight to a judge invested in the case.

Seek fees. Rule 45(d)(1) imposes a duty on the issuing lawyer to take reasonable steps to avoid imposing undue burden, and directs the court to enforce the duty and impose an appropriate sanction, which may include lost earnings and reasonable attorney's fees. Where a subpoena was facially overbroad, sought material plainly available from a party, or was pressed after a documented objection, ask.

What not to do: miss the objection deadline and then argue burden; produce partially and silently while continuing to negotiate; or simply not appear. Rule 45(g) permits contempt for failure to obey without adequate excuse — and a timely objection is an adequate excuse, which is why the objection matters so much.

Government subpoenas and investigative demands

A demand from a government agency, a grand jury, or a legislative body is a different problem and the response differs in kind.

Key differences:

  • The stakes include criminal exposure. A grand jury subpoena means someone is being investigated, possibly the recipient.
  • Objection procedures are narrower. There is no fourteen-day objection that shifts the burden; relief generally requires a motion to quash on limited grounds.
  • Obstruction risk. Destroying documents after receiving a government demand — or after learning of an investigation — is a felony under 18 U.S.C. § 1519 and related provisions, regardless of intent to obstruct a specific proceeding in some formulations. Issue the hold immediately and confirm suspension of automated deletion in writing.
  • Privilege still applies, and the crime-fraud exception is a live issue in a way it rarely is in civil discovery.
  • Cost shifting is generally unavailable.
  • Employee interviews. Agents may contact employees directly. The company should tell employees, neutrally, that they may speak or decline, that the company will provide counsel where appropriate, and that they must not destroy documents or provide false information — and must not be told what to say.
  • Parallel proceedings. A civil investigative demand may run alongside a criminal investigation and a private lawsuit, and the productions interact.

Engage counsel with government investigations experience immediately. The economics of a mistake are entirely different.

A short operational checklist

Print this and put it with the company's incident response materials.

Within 24 hours

  • Date-stamp; calendar compliance date and the fourteen-day objection deadline.
  • Identify the type of demand and the governing rules.
  • Assign a single owner and engage counsel.
  • Issue a written litigation hold and suspend auto-deletion.
  • Verify service, place of compliance, fees, and time to comply.

Within 5 days

  • Map each request to systems, custodians, volume, and estimated cost.
  • Pull the docket and read the complaint.
  • Identify third-party privilege, confidentiality, and regulated-data issues; notify affected parties.
  • Obtain and review the protective order.
  • Draft the objection and the offer.

Within 14 days

  • Serve the written objection with specific grounds, a quantified burden showing, and a narrowed proposal.
  • Propose a meet-and-confer date.
  • Raise cost shifting with an estimate.

Thereafter

  • Negotiate scope, format, cost, timing, and confidentiality; confirm in writing.
  • Obtain a Rule 502(d) order.
  • Collect defensibly and document the process.
  • Review, designate, log privilege, and produce with a cover letter.
  • Offer a Rule 902(11) certification in lieu of a custodian deposition.
  • Retain the production set, load files, and process documentation.
  • Release the hold only when the matter is fully concluded, in writing.

The framing that helps

The instinct on receiving a subpoena is that someone has done something to the company. That framing produces either paralysis or over-compliance.

The better framing is that a stranger has asked the company to do unpaid work, and that the rules give the company substantial leverage to define how much work, on what terms, and at whose expense. Rule 45 is written from exactly that premise: a nonparty is entitled to protection from significant expense, a written objection stops the process cold, and the lawyer who issued the subpoena has an affirmative and sanctionable duty of restraint.

Companies that understand this respond within two weeks, produce a narrowed set in sixty days, get the vendor bill paid by someone else, and never appear in the case again. Companies that do not spend six months and a great deal of money, and frequently produce more than anyone wanted.

Six recurring scenarios

The company is a vendor to a party. The most common case. The requests seek the contract, the statements of work, invoices, communications with the customer's personnel, and the deliverables. Issues: the customer's confidentiality rights under the master agreement, the customer's privilege where in-house counsel was copied on project emails, and the risk of damaging a live commercial relationship. Approach: notify the customer immediately, invite them to assert, produce the contract and invoices readily, and negotiate the communications set with search terms.

The company is a former employer of a party or a witness. Requests seek the personnel file, compensation records, performance reviews, the separation agreement, and the employee's email. Issues: employee privacy and state notice statutes, the confidentiality of the separation agreement, and other employees' information within the same records. Approach: notify the employee, redact third parties, produce the file subject to the protective order, and object to a wholesale mailbox collection absent a narrowed showing.

The company is a competitor. Requests seek pricing, cost, market share, or customer information for use in an antitrust, false advertising, or damages analysis. Issues: acute competitive harm. Approach: insist on attorneys'-eyes-only treatment, propose aggregated or anonymized data as a substitute, propose an independent expert as the only recipient, and be prepared to move for a protective order — this is the paradigm case for Rule 45(d)(3)(B)(i).

The company is a bank, insurer, or record-keeper. Requests seek account records, claim files, or transaction histories. Issues: customer notice statutes, volume, and cost. Approach: these organizations usually have a subpoena compliance function; if yours does not, build one. Standardize a response letter, a fee schedule, a customer notice, and a business records certification, and the marginal cost per subpoena drops to near zero.

The company holds the parties' communications as a platform or service provider. Issues: the Stored Communications Act generally bars disclosure of content to private parties. Approach: decline as to content, citing 18 U.S.C. § 2702, and tell the requesting party the correct route is through the account holder. Non-content subscriber records may be a different analysis.

The subpoena is really aimed at the company. Occasionally a nonparty subpoena is reconnaissance for a claim against the recipient, or leverage in an unrelated dispute. Signals: requests far broader than the case requires, requests about the company's own conduct rather than the parties', and timing that coincides with something else. Approach: engage counsel who evaluates the company's own exposure, not merely the discovery question, and be deliberate about what the production reveals.

Building a standing process

Companies that receive subpoenas more than twice a year should stop treating each one as an event.

  • A single intake address published to registered agents and reception, routing to one owner.
  • A standard acknowledgment letter sent on receipt.
  • A template objection with the general objections, the reservation of rights, and the cost provision already drafted.
  • A litigation hold template and a distribution list by department.
  • A cost schedule — per-hour and per-gigabyte rates the company charges, prepared in advance so that the cost demand is not improvised.
  • A relationship with an e-discovery vendor and pre-negotiated rates.
  • A standing Rule 902(11) certification form.
  • A log of every subpoena received, its disposition, what was produced, and what it cost. This becomes the burden evidence for the next one and shows a pattern of consistent treatment.

What the production actually costs, and how to talk about it

Companies consistently underestimate the cost of a document production, and the objection's credibility depends on getting the estimate right. A realistic breakdown for a moderate response:

Collection. Forensic or targeted collection of email and files from five custodians, plus a database export: typically several thousand dollars in vendor fees plus internal IT time. Collections from legacy systems, departed employees' archived mailboxes, or mobile devices cost substantially more and take longer.

Processing and hosting. Vendors charge per gigabyte to process and per gigabyte per month to host. A collection that yields 40 GB is not unusual for five custodians over three years, and the processing fee alone will be four figures with monthly hosting on top for the life of the case.

Search and culling. De-duplication, date filtering, and search terms typically reduce a collection by 80% or more. This step is where cost is actually controlled, and it is why negotiating search terms is worth more than negotiating almost anything else.

Review. The dominant cost. At a conservative rate of fifty documents per hour for a responsiveness and privilege review, a post-cull set of 8,000 documents is 160 hours. Even at contract-reviewer rates that is meaningful; at law firm rates it is the entire budget. Technology-assisted review reduces it substantially on larger sets and is worth proposing.

Privilege logging. Frequently underestimated. A 300-entry log prepared document by document is a week of work.

Production. Endorsement, formatting, and quality control — modest, but not nothing.

How to present this. A short table in the objection letter with volumes and dollar estimates, sourced to a vendor quote where possible, transforms an assertion into evidence. It also gives the requesting party a reason to narrow: a lawyer who learns that Request 4 costs $60,000 and Requests 1 through 3 cost $6,000 will usually drop Request 4 rather than fund it.

And say what you will do for free. Offering to produce the contract, the invoices, and a defined set of key documents at the company's own expense, while conditioning the broad email collection on cost sharing, is a reasonable position that courts respect and that most requesting parties accept.

Finally, close the loop. When the matter ends, confirm in writing that the production is complete, ask the requesting party to confirm no further compliance is expected, and calendar the protective order's return-or-destroy deadline. Then release the litigation hold in writing and confirm that automated deletion has resumed for the affected systems. Holds that are never released accumulate, and a company carrying nine years of unreleased holds is preserving everything forever at real cost — and will be asked, in the next case, why it did so.

One more habit worth adopting. Ask the requesting party, in the first conversation, what they are actually trying to establish. Lawyers issuing nonparty subpoenas often draft broadly because they do not know what exists, not because they want everything. A recipient who says "we can tell you which of these three things is true, and here is the one document that shows it" frequently ends the matter in a week, at almost no cost, with goodwill on both sides that pays off the next time.

Primary authority

  • Fed. R. Civ. P. 45 — service, the 100-mile geographic limit in Rule 45(c), the fourteen-day objection window in Rule 45(d)(2)(B), mandatory and discretionary quash grounds in Rule 45(d)(3), the form-of-production and privilege-log duties in Rule 45(e), and contempt under Rule 45(g).
  • Fed. R. Civ. P. 26(b)(1) and 26(b)(2)(B) — proportionality, and the not-reasonably-accessible ESI objection with its cost-shifting corollary.
  • Fed. R. Civ. P. 26(c) — protective orders, including confidentiality designations and allocation of the responding party's expenses.
  • Fed. R. Evid. 502(b) and 502(d) — inadvertent disclosure, and the order that makes non-waiver enforceable in other proceedings.
  • 18 U.S.C. §§ 2701–2712 — the Stored Communications Act, which bars a provider from producing content in civil litigation.
  • 29 U.S.C. § 1132(a) and 45 C.F.R. § 164.512(e) — HIPAA's requirements for producing protected health information in response to a subpoena, including the qualified protective order route.
  • 20 U.S.C. § 1232g(b)(2) — FERPA's notice requirement before producing education records.
  • 15 U.S.C. § 1681b(a)(1) — consumer report disclosure by court order.
  • Fed. R. Civ. P. 37(e) — the preservation standard that governs the litigation hold the subpoena obligates you to implement.

Related articles

This guide is provided for general informational purposes and does not constitute legal advice. Subpoena practice differs between federal and state courts and among states, and sector-specific statutes impose additional notice and consent requirements. Consult qualified litigation counsel promptly on receipt of a subpoena; the fourteen-day objection window is short and consequential.