A custodian is a person who holds or controls data potentially relevant to a matter — typically an employee whose email, files, messages and devices fall within scope. Custodian selection is the single decision that most determines the cost and the completeness of a discovery effort.
Why the list is the whole game
Every downstream cost scales with custodian count. Each additional custodian adds collection time, processing volume, review population and privilege review. A list of forty custodians is not twice the work of twenty; after de-duplication and threading it is often somewhat less than twice, but the collection and interview effort is linear and the review population usually grows faster than anyone forecasts.
The corresponding risk is the opposite. A custodian omitted at the outset and identified in a deposition eighteen months later means re-collection, supplemental production, and a credibility problem about how the original list was drawn.
How to build the list defensibly
Start from the facts, not the org chart. The question is who was involved in the events at issue, not who reports to whom. Seniority is a poor proxy: the person who actually ran the process is frequently three levels below the executive who is named in the complaint.
Interview. Short conversations with a handful of people identify the custodians nobody thought of — the analyst who maintained the spreadsheet, the contractor who no longer works there, the assistant who scheduled everything.
Follow the systems, not just the people. Some relevant data has no natural human custodian: shared drives, departmental mailboxes, application databases, logs. These are non-custodial sources and they need their own treatment.
Write down the reasoning. The list will be challenged. A contemporaneous memo explaining why each custodian was included, and why obvious candidates were excluded, is what converts a challenge into a discussion.
Tiering
Not every custodian warrants the same treatment. A common and defensible approach is to collect fully from a core group, preserve-only for a second tier, and add from the second tier if the first produces reason to. This keeps the preservation obligation broad while keeping the review population proportionate — which is precisely the balance Rule 26(b)(1) asks for.
The ones routinely missed
- Departed employees, whose accounts and devices have often been through offboarding.
- Contractors and temporary staff, who may hold significant material on systems the company does not control.
- Executives who use assistants, where the relevant mailbox may be the assistant's.
- People who moved teams during the relevant period and whose data followed a different retention path.
- Anyone whose primary channel is chat rather than email, where retention defaults are shortest and the candid discussion usually is.
De-duplication changes what a custodian appears to have had
Global de-duplication removes a document from every custodian but one. That is efficient for review and misleading for any question about who possessed what — if the issue is whether a particular person saw a particular memo, custodial de-duplication or a preserved custodian field is required. This belongs in the ESI protocol, agreed rather than discovered.
From our work
Dealing with custodian in a live matter?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.