The 9 FOIA Exemptions: Rules and Record Examples

What are the 9 exemptions to a FOIA request? They are the nine categories in subsection (b) of the federal Freedom of Information Act that allow an executive-branch agency to protect specified information from compelled public disclosure. They cover properly classified national-security information, internal personnel rules, information protected by another statute, confidential business information, privileged interagency communications, personal privacy, law-enforcement interests, financial-institution supervision, and geological information about wells. The current statutory text lists all nine categories in 5 U.S.C. section 552(b).

An exemption is not a label for anything an agency would prefer to keep private. The agency must connect the withheld information to the elements of the cited exemption. It must also consider foreseeable harm and release reasonably segregable nonexempt material, subject to the statute’s rules for information that another law prohibits from disclosure. DOJ’s Office of Information Policy explains the current foreseeable-harm and partial-release requirements.

This guide explains the exemptions in plain language, gives record-level examples without predicting a result in any individual case, and shows how to review a partial or full denial. For the submission process itself, use the federal FOIA filing guide. If you need wording for the initial letter, see the FOIA request example.

Quick answer

• Federal FOIA contains nine exemptions, but an agency may withhold only information that fits the cited exemption and satisfies the other applicable statutory requirements. Read subsection (b) and the withholding rule in 5 U.S.C. section 552.
• Exemption 7 is one exemption with six separate harm provisions, labeled 7(A) through 7(F). The agency must first show that the information was compiled for a law-enforcement purpose. DOJ’s current Exemption 7 guide explains the threshold and six subparts.
• A partial release is often the legally relevant outcome. FOIA requires release of every reasonably segregable nonexempt portion after protected material is deleted. The statute states the segregability and deletion-marking rules directly.
• Exemption 3 works differently from the other exemptions because the withholding rule comes from another qualifying federal statute. The response should identify that statute, not merely cite “b(3).” DOJ maintains current Exemption 3 resources and statute lists.
• Exemption 5 is not a blanket for internal emails or drafts. It incorporates recognized civil-discovery privileges, and the deliberative-process privilege does not cover records created 25 years or more before the request date. See the current text of Exemption 5.
• A requester may administratively appeal an adverse determination. The agency must allow at least 90 days from the determination date, although the letter and agency regulations govern the actual filing instructions. DOJ OIP describes the statutory appeal minimum and agency-specific procedures.

What do the nine FOIA exemptions protect?

The exemptions protect defined interests, not entire subjects. A contract file can contain releasable terms, confidential pricing inputs, private contact information, privileged legal advice, and final agency decisions in the same folder. The agency reviews information within responsive records and may apply more than one exemption to different passages.

The table is a screening tool, not a substitute for the statute. DOJ’s Office of Information Policy updates its detailed legal guide by chapter as significant developments occur; the master page was updated on May 28, 2026. Open the current DOJ Guide to the Freedom of Information Act.

Are FOIA exemptions automatic reasons to withhold?

No. Coverage by an exemption and lawful withholding are related but distinct questions. The statute directs an agency to withhold only when it reasonably foresees that disclosure would harm an interest protected by an exemption or when disclosure is prohibited by law. It also directs the agency to consider partial disclosure and take reasonable steps to segregate nonexempt information. These duties appear in 5 U.S.C. section 552(a)(8).

DOJ OIP says the foreseeable-harm requirement applies to every exemption except Exemption 3, where another statute supplies the nondisclosure rule. OIP also instructs agencies not to rely on speculative fears, abstract concerns, or embarrassment. The analysis should connect a particular harm to the information withheld, although like records may sometimes be evaluated by category. Read OIP’s updated foreseeable-harm guidance.

Some exemptions contain harm concepts in their own elements. Proper classification under Exemption 1 requires an identified or described national-security damage. Exemptions 6 and 7 contain privacy or other harm standards in their text. Exemption 4 requires qualifying confidential information. That does not eliminate the need for an agency to make a defensible, record-specific determination.

Most exemptions permit rather than compel withholding. OIP encourages discretionary release when the law allows it and the protected harm is unlikely. That discretion is limited when disclosure is prohibited by another statute or when information remains properly classified. OIP distinguishes discretionary releases from legally prohibited disclosure.

What does FOIA Exemption 1 protect?

Exemption 1 protects information that is authorized to be kept secret under executive-order criteria for national defense or foreign policy and is in fact properly classified under that order. A sensitive topic alone is not enough. The statutory test appears in 5 U.S.C. section 552(b)(1).

Executive Order 13526 supplies the classification framework used in the current official guidance. Original classification requires all four conditions: an authorized classifier, United States Government ownership or control, a protected subject category, and an identifiable or describable national-security damage that could reasonably follow unauthorized disclosure. National Archives publishes the executive order and its four-part classification standard.

The protected categories include military plans, foreign-government information, intelligence activities and methods, foreign relations, national-security science or technology, nuclear-material safeguards, security vulnerabilities, and weapons of mass destruction. OGIS lists the eight classification subject categories and links the governing order. An operational intelligence report might therefore be released with source identifiers, collection methods, or foreign-government details removed.

Do not assume that information is declassified because a similar statement appeared in a news report or an unauthorized leak. Executive Order 13526 says unauthorized disclosure of identical or similar information does not automatically declassify the official information. See section 1.1(c) of Executive Order 13526. A requester can challenge the application of Exemption 1 through the agency’s appeal process, but the record and classification rationale matter more than the sensitivity of the general subject.

What does FOIA Exemption 2 protect?

Exemption 2 protects records related solely to an agency’s internal personnel rules and practices. The modern scope is narrow: it concerns employee relations and human-resources matters, not every internal manual or operational instruction. DOJ’s Exemption 2 chapter explains the Supreme Court’s current text-based approach.

The DOJ guide states a three-part test. The information must relate to personnel rules or practices, relate solely to those matters, and be internal, meaning the agency typically keeps it for its own use. See DOJ’s post-Milner three-part analysis. Examples can include rules about hiring, firing, work assignments, discipline, compensation, benefits, parking, leave, or employee conduct.

This boundary matters when an agency cites older “high 2” reasoning for techniques, security material, or instructions about carrying out the agency’s public mission. The Supreme Court’s 2011 decision in Milner v. Department of the Navy rejected a broader circumvention-based reading of Exemption 2. OGIS summarizes the 2011 narrowing and its human-resources focus. Another exemption may protect some operational information, but Exemption 2 does not expand to cover it merely because employees use it internally.

What does FOIA Exemption 3 protect?

Exemption 3 incorporates nondisclosure rules from other qualifying federal statutes. It applies when another statute requires withholding without discretion or establishes particular criteria or categories for withholding. A qualifying law enacted after the OPEN FOIA Act of 2009 must specifically cite Exemption 3. Read the full test in 5 U.S.C. section 552(b)(3).

The decisive questions are which statute the agency invokes and whether the requested information falls within that statute. Familiar examples include tax returns and return information under 26 U.S.C. section 6103, certain census information under title 13, specified grand-jury material, and some confidential archaeological-resource information. OGIS gives official examples and links DOJ’s qualifying-statute list. These examples do not mean every tax, census, court, or archaeology record is categorically unavailable; the cited nondisclosure provision controls its own scope.

DOJ publishes both a court-tested list and annual agency-reported Exemption 3 data, with fiscal-year 2025 resources available in the current collection. Use DOJ OIP’s current Exemption 3 resource page. An appeal should therefore address the actual statute and its elements. Arguing only that FOIA favors openness does not answer a law that prohibits the specific disclosure.

What does FOIA Exemption 4 protect?

Exemption 4 protects trade secrets and commercial or financial information obtained from a person that is privileged or confidential. For the larger commercial-information branch, the agency must establish that the information is commercial or financial, came from a “person” as the law uses that term, and is privileged or confidential. DOJ’s current Exemption 4 guide states the three elements.

Record examples include a private company’s nonpublic pricing inputs, sales data, manufacturing details, customer information, technical formulas, or financial projections submitted to an agency. The exemption does not automatically cover an agency’s own analysis simply because it discusses a company. Nor does a company label make public information confidential.

In Food Marketing Institute v. Argus Leader Media, the Supreme Court rejected the former rule that required proof of substantial competitive harm. It held that information customarily and actually kept private by its owner, and supplied under an assurance of privacy in that case, was confidential within Exemption 4. Read the Supreme Court’s official 2019 opinion. DOJ’s current guide treats the owner’s actual confidentiality practices as the first part of the analysis and examines any government assurance of privacy in context. See DOJ’s post-Argus Leader analysis.

An agency may contact the business submitter before deciding whether to release potentially protected material. The submitter’s objection informs the process, but the agency remains responsible for the FOIA determination. A useful requester challenge asks what information is genuinely nonpublic, who supplied it, and how the confidentiality element was established.

What does FOIA Exemption 5 protect?

Exemption 5 protects inter-agency or intra-agency memorandums or letters that would not routinely be available to an outside party in litigation with the agency. It incorporates recognized civil-discovery privileges rather than creating a general “internal document” exemption. The statutory language is in 5 U.S.C. section 552(b)(5).

The three most common privileges are deliberative process, attorney-client, and attorney work product. DOJ’s Exemption 5 chapter identifies these principal privileges. They answer different questions:

• Deliberative process can protect predecisional recommendations and discussion that form part of an agency decision process.
• Attorney-client privilege can protect confidential legal communications between authorized agency clients and counsel.
• Attorney work product can protect material prepared by or for counsel in anticipation of litigation.

A draft is not protected merely because it is called a draft. For deliberative-process protection, the agency must identify the decision process and show that the material is both predecisional and deliberative. The Supreme Court held in U.S. Fish and Wildlife Service v. Sierra Club that the inquiry is functional and that some drafts may reflect an agency’s last view rather than a proposal. Read the Supreme Court’s official 2021 opinion.

The statute adds a concrete age limit: deliberative-process privilege does not apply to records created 25 years or more before the request date. See the Exemption 5 proviso in the current FOIA statute. That limit applies to the deliberative-process privilege, not automatically to every other privilege incorporated by Exemption 5. Final decisions, adopted reasoning, and segregable factual material also require their own analysis.

What does FOIA Exemption 6 protect?

Exemption 6 protects information in personnel, medical, and similar files when disclosure would constitute a clearly unwarranted invasion of personal privacy. “Similar files” can reach information about a person outside a formal personnel folder, but the agency still must identify a meaningful privacy interest and balance it against the FOIA public interest in disclosure. DOJ’s Exemption 6 guide lays out the four-step analysis.

Possible examples include a home address, personal phone number, medical diagnosis, family detail, personal financial information, or other identifying information in an administrative record. The result depends on context. A name is not automatically exempt, and the fact that information concerns a government employee does not resolve the balance.

For FOIA, the relevant public interest is how disclosure would shed light on government operations or conduct. A requester’s private reason for wanting the information generally does not substitute for that disclosure interest. OGIS explains the privacy exemptions and links the controlling DOJ guidance. A focused appeal can describe what the requested detail would reveal about agency performance while proposing narrower disclosure, such as releasing job titles, office names, aggregate information, or records with direct identifiers removed.

What does FOIA Exemption 7 protect?

Exemption 7 protects information compiled for law-enforcement purposes only when disclosure would cause one of six specified harms. The threshold comes first. An agency cannot invoke a 7-series subpart without connecting the information to a law-enforcement purpose. DOJ’s Exemption 7 guide explains the threshold before the six harms.

The six subparts are:

The exact statutory verbs differ across the subparts. Some ask what “could reasonably be expected” to happen, while 7(B) uses “would.” Compare all six clauses in 5 U.S.C. section 552(b)(7). Read the agency’s explanation against the exact subpart rather than treating “law enforcement sensitive” as a complete answer.

Exemption 7(C) and Exemption 6 can both protect privacy, but they do not have identical thresholds. Exemption 7(C) requires law-enforcement compilation and asks whether disclosure could reasonably be expected to create an unwarranted privacy invasion. Exemption 6 applies to personnel, medical, and similar files and uses the phrase “clearly unwarranted.” DOJ compares the two privacy provisions in its Exemption 6 guide.

An investigation’s closure may weaken a 7(A) interference rationale because that subpart focuses on enforcement proceedings, but it does not erase every other possible protection. Witness privacy, confidential-source information, techniques, safety risks, classified content, or another statute may remain relevant. Ask for a current, subpart-specific review rather than assuming that age alone opens the entire file.

What do FOIA Exemptions 8 and 9 protect?

Exemption 8 covers information contained in or related to examination, operating, or condition reports prepared by, for, or on behalf of an agency responsible for regulating or supervising financial institutions. Read the exact category in 5 U.S.C. section 552(b)(8). It can apply to bank-examination reports and related supervisory material, not to every document that happens to mention a bank.

DOJ’s guide describes two purposes: protecting the security of financial institutions and preserving candid cooperation between supervised institutions and regulators. Courts have read the category broadly, but recent decisions still require agencies to identify the applicable ground and thoughtfully address foreseeable harm. See DOJ’s updated Exemption 8 chapter. Public filings, final enforcement documents, consumer-facing disclosures, and agency records outside the examination relationship require separate analysis.

Exemption 9 covers geological and geophysical information and data, including maps, concerning wells. The statute states this narrow subject directly. The D.C. Circuit has held that “wells” is not limited to oil and gas wells; location and depth information about water wells can qualify. DOJ’s Exemption 9 chapter summarizes the official case law and water-well holding.

This exemption does not turn all environmental or geological information into exempt material. The withheld data must concern wells. A request for regional geology, a published environmental assessment, or agency policy may present a different record question even if wells appear somewhere in the broader project.

How do redactions and segregable portions work?

FOIA requires an agency to release any reasonably segregable portion after deleting exempt material. The agency generally must indicate the amount deleted and the exemption used on the released record. If technically feasible, those indications should appear where the deletion occurs. The agency may omit an indication when the indication itself would harm the interest protected by the exemption. The statute states each of these marking rules after the nine exemptions.

That means a black rectangle with “b(6)” can be useful evidence, but it is not self-validating. The code identifies the claimed legal basis. The determination letter should explain the overall reason for an adverse determination, and the released pages should let the requester understand the scope of deletions to the extent the law permits. OIP instructs agencies to provide tailored explanations when practical and to confirm consideration of foreseeable harm for exemption determinations other than Exemption 3. Read OIP’s response-letter guidance within the foreseeable-harm discussion.

Segregability is not simply a page count. A paragraph may contain releasable dates, final actions, totals, or factual descriptions alongside protected names, advice, or methods. Conversely, isolated words may be so intertwined with exempt material that separation would convey nothing meaningful or reveal the protected content. DOJ’s procedural guide explains that agencies and reviewing courts evaluate whether useful nonexempt information can reasonably be separated. See the current DOJ procedural chapter on reasonably segregable portions.

How should you review an exemption-coded FOIA response?

Treat the response as an evidence package. The goal is not to argue that exemptions never apply. It is to identify whether this agency explained this withholding under the correct rule and released everything else that can reasonably be separated.

1. Preserve the response package. Save the determination letter, released records, attachments, request text, and envelope or transmission details as one dated set.
2. Map every withholding. List each exemption code, the page or record affected, whether the withholding is partial or full, and the agency’s stated explanation.
3. Test the legal elements. Compare the explanation with the actual elements of the cited exemption, including any threshold, protected interest, and required harm.
4. Test segregability and markings. Check whether nonexempt portions were released and whether deletion amounts and exemption codes appear where technically feasible.
5. Identify a focused correction. State the specific defect and request a practical remedy such as a new search, narrower redaction, segregability review, or fresh exemption analysis.
6. File through the stated appeal route. Follow the response letter and current agency regulations, submit before the stated deadline, and retain proof of timely delivery.

A useful worksheet has one row per withholding: record or page, code, agency explanation, missing element, segregable material sought, and requested remedy. This prevents a broad appeal from obscuring a strong point. It also distinguishes an exemption dispute from a search dispute, a no-records determination, a fee issue, or a routing problem.

If you did not receive the determination letter, check the FOIA request status guide before appealing a portal label. If timing is the problem, the separate guide on how long a FOIA request takes explains determinations, processing tracks, tolling, and production without treating the statutory clock as a delivery guarantee.

What mistakes weaken an exemption appeal?

A generic demand to “release everything” rarely identifies the legal or factual defect. A focused appeal gives the reviewing official a concrete issue to correct.

Common failure modes include:

• Treating every redaction as bad faith. An exemption may properly protect part of a responsive record. Challenge the missing element, overbreadth, explanation, or segregability rather than assuming motive.
• Ignoring the threshold. Exemption 7 needs a law-enforcement purpose before any subpart applies. Exemption 5 needs qualifying interagency or intra-agency material and a recognized privilege. Exemption 4 needs information obtained from a person.
• Challenging Exemption 3 without reading the other statute. The incorporated nondisclosure law, including its definitions and exceptions, is the center of that dispute.
• Equating “internal” with Exemption 2 or 5. Internal operational guidance may fall outside Exemption 2 after Milner, and an internal email may fall outside Exemption 5 if no privilege applies.
• Asking for private facts without articulating the FOIA public interest. For Exemption 6 or 7(C), explain how disclosure would illuminate agency operations and whether narrower information would serve that purpose.
• Missing the appeal instructions. An agency must provide at least 90 days for an administrative appeal, but a late or misdirected submission can create an avoidable procedural dispute. DOJ OIP explains both the minimum period and the need to follow agency procedures.
• Confusing an exemption with a no-records response. An exemption concerns responsive information found and withheld. A search dispute asks whether the agency used methods reasonably calculated to locate responsive records.

Do not place sensitive personal identifiers into an appeal unless the agency’s official instructions require them and provide an appropriate submission channel. Cite the request number, determination date, record description, exemption, and requested correction. Attach or identify the relevant pages rather than sending unrelated personal material.

Are FOIA exemptions the same as exclusions or a Glomar response?

No. The nine exemptions appear in subsection (b). FOIA also contains narrow law-enforcement exclusions in subsection (c), and agencies sometimes issue a “Glomar” response that neither confirms nor denies the existence of records when confirming existence itself would reveal protected information. DOJ treats exclusions as a separate chapter from the nine exemptions.

An ordinary exemption response usually acknowledges responsive records and withholds some or all information under a cited subsection. An exclusion can allow specified records to be treated as outside FOIA’s requirements while a defined circumstance continues. A Glomar response addresses whether the agency can acknowledge record existence at all. These mechanisms have different elements, so an appeal should use the agency’s actual wording rather than treating every nonrelease as the same event.

FAQ

Does an agency have to withhold every record covered by a FOIA exemption?

Not always. Most FOIA exemptions permit withholding, but another law or valid classification rule may prohibit disclosure; the agency must also apply the foreseeable-harm and segregability requirements where they govern. OIP explains discretionary release and the limits imposed by law or classification.

Can an agency redact part of a record instead of withholding the whole record?

Yes. FOIA requires release of reasonably segregable nonexempt portions and generally requires the agency to mark the exemption and amount deleted when technically feasible. See the statutory segregability and marking language.

Which FOIA exemptions protect personal privacy?

Exemption 6 protects privacy in personnel, medical, and similar files, while Exemption 7(C) protects personal privacy in information compiled for law-enforcement purposes. DOJ’s privacy chapter compares both provisions.

Does Exemption 5 protect every internal agency email?

No. The record must meet Exemption 5’s inter-agency or intra-agency threshold and a recognized civil-discovery privilege; an internal label alone is not enough. DOJ’s Exemption 5 guide explains the threshold and incorporated privileges.

How long do I have to appeal an exemption-based FOIA denial?

Federal agencies must allow at least 90 days from an adverse determination, but the response letter and the agency’s current regulations control the filing method and stated deadline. Read DOJ OIP’s administrative-appeal guidance.

Do the nine federal FOIA exemptions apply to state public-records requests?

No. Federal FOIA governs federal executive-branch agency records; each state has its own public-records law, exemptions, procedures, and appeal routes. FOIA also does not provide the access rules for federal court case files or congressional records. Use the responsible institution’s official system rather than applying federal agency exemptions to a different jurisdiction.

Conclusion

The nine FOIA exemptions are specific legal categories, not a general license for secrecy. Start with the exact statutory elements, then test foreseeable harm, segregability, deletion markings, and the agency’s explanation. Exemption 3 requires the separate withholding statute; Exemption 7 requires both a law-enforcement threshold and a particular subpart; Exemption 5 requires an actual privilege.

The most effective next step is usually narrow and documented. Map each withholding, identify the missing or disputed element, describe the nonexempt information you believe can be released, and follow the agency’s appeal instructions on time. This approach cannot guarantee disclosure, but it turns a broad objection into a reviewable record-specific request.

Sources

1. FOIA.gov, Freedom of Information Act Statute, 5 U.S.C. section 552
2. U.S. Department of Justice, Guide to the Freedom of Information Act, updated May 28, 2026
3. U.S. Department of Justice, Applying a Presumption of Openness and the Foreseeable Harm Standard
4. National Archives, OGIS FOIA Resources and exemption summaries
5. National Archives, Executive Order 13526 on classified national-security information
6. U.S. Department of Justice, Procedural Requirements chapter, including segregability
7. U.S. Department of Justice, Adjudicating Administrative Appeals Under the FOIA
8. Supreme Court of the United States, Food Marketing Institute v. Argus Leader Media
9. Supreme Court of the United States, U.S. Fish and Wildlife Service v. Sierra Club

Editorial source check: 2026-08-31 · Topic ID: FED-009