First, identify what kind of subpoena it is
A subpoena for business records can come from a party in a private lawsuit, a government agency, or a grand jury, and the response differs for each. Civil subpoenas usually allow objections and negotiation over scope with the lawyer who issued them. Agency subpoenas and civil investigative demands carry the issuing authority's own enforcement procedures. Grand jury subpoenas belong to criminal investigations and call for particular care, including asking whether the company is simply a witness or something more. Some subpoenas arrive with an order or instruction not to disclose them, so check before telling customers or employees outside the response team. The return date is often close, and asking for more time is common, but any extension should be confirmed in writing.
Preserve, then collect
As soon as the subpoena arrives, make sure the records it describes are not deleted under routine retention schedules, including email, chat messages, and files on personal devices used for work. Identify who in the company knows where the records are kept, and keep a log of what was searched and how. Some categories of records may carry privacy protections, such as health information and certain financial records, and producing them may require notice to the people involved, a court order, or a protective order. Documents covered by attorney-client privilege should be withheld and listed in the form the rules require, rather than quietly left out. Review everything before it goes out, since what you produce can travel beyond the immediate case.
How a response gets decided
Producing in full, negotiating a narrower request, serving written objections, and moving to quash or modify are all possible responses, and the choice depends on the type of subpoena and the burden it imposes. Many courts allow a records custodian to provide a certification instead of appearing to testify, which can save the company time. The cost of collecting large volumes of data can sometimes be shifted or shared, depending on the rules that apply. In our first review, we read the subpoena itself, identify who issued it and in what proceeding, estimate the volume involved, and assess whether the company faces any exposure of its own. That last question decides whether the response should be routine or treated as the opening of something larger.
