# Requests for access to records.
**AGENCY:**
Office of the Secretary, Department of Homeland Security.
**ACTION:**
Final rule.
**SUMMARY:**
The Department of Homeland Security (DHS or Department) is updating its regulations related to the procedures for submitting Freedom of Information Act (FOIA) and Privacy Act of 1974 requests to clarify that requesters must generally submit their Freedom of Information Act (FOIA) requests and Privacy Act requests electronically.
**DATES:**
This final rule is effective January 22, 2026.
**FOR FURTHER INFORMATION CONTACT:**
Roman Jankowski, Chief Privacy Officer, Privacy Office, Department of Homeland Security, Washington, DC 20528, (202) 343-1717, *[email protected].*
**SUPPLEMENTARY INFORMATION:**
**I. Background**
The Secretary of Homeland Security has authority under 5 U.S.C. 301, 552, and 552a, and 6 U.S.C. 112(e) to issue Freedom of Information Act and Privacy Act regulations. That authority has been delegated to the Chief Privacy Officer of the Department pursuant to 6 U.S.C. 142 and DHS Del. No. 13001, Rev. 01 (June 2, 2020). Most recently, DHS updated its procedures implementing the Freedom of Information Act and Privacy Act, 5 U.S.C. 552a., at 6 CFR part 5, subparts A and B on November 16, 2022 (87 FR 68599) and February 27, 2024 (89 FR 14369).
**II. Discussion of Changes**
This rule updates Title 6, part 5, paragraphs 5.3(a)(2) and 5.21(a)(6), which provide instructions to requesters on how and where to make FOIA and Privacy Act (and Judicial Redress Act (JRA) if applicable) requests for DHS records. The rule generally requires requesters to submit their Freedom of Information Act (FOIA) requests and Privacy Act requests electronically through the web portal at *https://www.dhs.gov/foia* or other acceptable Federal Government or DHS Component websites. DHS and its components will generally no longer accept FOIA or Privacy Act/JRA requests mailed to the DHS Privacy Office, or other DHS components, or via fax or email. By accepting requests only through DHS's or its components' websites, DHS will ensure requests are sent to the correct DHS Headquarters office or DHS component. In addition, this will reduce the time to interact with requesters and also expedite the time requesters will receive responsive records to their requests. In addition, this change will allow the Department to respond to requesters quickly and efficiently to correct any mistakes made in submitting their requests or clarifying their requests. Upon request, DHS FOIA public liaisons may facilitate, in limited circumstances ( *e.g.,* incarceration), an alternative method to submit requests for requesters who are unable to submit electronic requests. Requesters who are unable to submit electronic requests should contact the Office or DHS Component they wish to seek records from.
**III. Regulatory History**
DHS did not publish a notice of proposed rulemaking for this rule. Under 5 U.S.C. 553(b)(A), this final rule is exempt from notice and public comment rulemaking requirements because the change involves rules of agency organization, procedure, or practice. In addition, under 5 U.S.C. 553(b)(B), an agency may bypass notice and comment requirements if it finds, for good cause, that notice and comment is impracticable, unnecessary, or contrary to the public interest. DHS finds that notice and comment is unnecessary here because the change to the manner of submitting FOIA and Privacy Act requests is an agency procedural update that will have minimal substantive effect on the public. Specifically, DHS believes that submitting a request through a publicly accessible web portal is a routine and accepted method of seeking information in today's society, and the vast majority of requesters already submit their requests this way. Furthermore, DHS will continue to consider requests for exceptions in limited circumstances for requesters who lack internet access. In addition, the rule is procedural because it changes only the manner in which the public presents FOIA and Privacy requests to DHS, and not the substance of those requests. Notice and comment is unnecessary because the public has come to accept using web pages to submit information and generally does so routinely. Electronic submission via web portal is also more efficient than using the U.S. Postal Service. and allows for better tracking of the submission and quicker response by the Government.
**III. Regulatory Analyses**
**A. Executive Orders 12866 (Regulatory Planning and Review), 13563 (Improving Regulation and Regulatory Review), and 14192 (Unleashing Prosperity Through Deregulation)**
Executive Orders 13563 and 12866 direct agencies to assess the costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits. Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. Executive Order 14192 establishes a policy that the executive branch be “prudent and financially responsible in the expenditure of funds, from both public and private sources, and [ ] alleviate unnecessary regulatory burdens placed on the American people.”
The Office of Management and Budget (OMB) has not designated this rule a “significant regulatory action,” under section 3(f) of Executive Order 12866. Accordingly, OMB has not reviewed this rule. This rule is also not subject to Executive Order 14192 because the rule is not significant under Executive Order 12866 and because it is related to agency organization, management, or personnel. *See* OMB Memorandum M-25-20, “Guidance Implementing Section 3 of Executive Order 14192, titled `Unleashing Prosperity Through Deregulation” (Mar. 26, 2025).
DHS has considered the costs and benefits of this rule. This rule will not impose any new costs on the government or the public. The rule's benefits include increased efficiency in processing and responding to FOIA and Privacy Act/JRA requests and decreased lag times for handling requests that would otherwise come from non-portal sources. Specifically, the rule allows DHS FOIA personnel to spend less time on data entry and administrative tasks if the requester submits through the electronic portal rather than through email, fax or physical mail. Spending less time on initial data entry and administrative tasks will allow DHS FOIA personal to spend more time searching and reviewing records to respond to the requests.
**Unfunded Mandates Reform Act of 1995**
This rule will not result in the expenditure by state, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more in any one year, and it will not significantly or uniquely affect small governments. Therefore, no written statement was deemed necessary under the provisions of the Unfunded Mandates Reform Act of 1995.
**Regulatory Flexibility Act**
Under the Regulatory Flexibility Act (RFA), 5 U.S.C. 601-612, and section 213(a) of the Small Business Regulatory Enforcement Fairness Act of 1996, 5 U.S.C. 601 note, agencies must consider the impact of their rulemakings on “small entities” (small businesses, small organizations, and local governments). The term “small entities” comprises small businesses, not-for-profit organizations that are independently owned and operated and are not dominant in their fields, and governmental jurisdictions with populations of less than 50,000. DHS has reviewed this regulation and by approving it certifies that this regulation will not have a significant economic impact on a substantial number of small entities. DHS does not believe this rule imposes any additional direct costs on small entities.
**Small Business Regulatory Enforcement Fairness Act of 1996**
This rule is not a major rule as defined by section 251 of the Small Business Regulatory Enforcement Fairness Act of 1996 (as amended), 5 U.S.C. 804(2). The Office of Management and Budget's Office of Information and Regulatory Affairs has not found that this rule is likely to result in an annual effect on the economy of $100,000,000 or more; a major increase in costs or prices; or significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of United States-based companies to compete with foreign-based companies in domestic and export markets.
**National Environmental Policy Act**
DHS reviews regulatory actions to determine whether the National Environmental Policy Act (NEPA) applies to them and, if so, what degree of analysis is required. DHS Directive 023-01 Rev. 01 (Directive) and Instruction Manual 023-01-001-01 Rev. 01 (Instruction Manual) establish the procedures that DHS and its components use to comply with NEPA.
NEPA allows Federal agencies to establish, in their NEPA implementing procedures, categories of actions (“categorical exclusions”) that experience has shown do not, individually or cumulatively, have a significant effect on the human environment and, therefore, do not require an environmental assessment or environmental impact statement. The Instruction Manual, Appendix A, lists the DHS categorical exclusions.
Under DHS NEPA implementing procedures, for an action to be categorically excluded, it must satisfy each of the following three conditions: (1) the entire action clearly fits within one or more of the categorical exclusions; (2) the action is not a piece of a larger action; and (3) no extraordinary circumstances exist that create the potential for a significant environmental effect.
This rule is strictly procedural and is limited to updating the method by which requesters may submit requests for information under FOIA and the Privacy Act/JRA. DHS has reviewed this rule and finds that it clearly fits within categorical exclusion A3(a) as an administrative or procedural rule that will have no significant effect on the environment, is not part of a larger Federal action, and does not present extraordinary circumstances that create the potential for significant environmental impacts. Therefore, the rule is categorically excluded from further NEPA review.
**List of Subjects in 6 CFR Part 5**
Classified Information, Courts, Freedom of information, Government employees, Privacy.
For the reasons stated in the preamble, DHS amends Chapter I part 5 of Title 6, Code of Federal Regulations, as follows:
**PART 5—DISCLOSURE OF RECORDS AND INFORMATION**
**6 CFR Part 5**
1. The authority citation for Part 5 continues to read as follows:
**Authority:**
6 U.S.C. 101 *et seq.;* Pub. L. 107-296, 116 Stat. 2135; 5 U.S.C. 301; 6 U.S.C. 142; DHS Del. No. 13001, Rev. 01 (June 2, 2020).
Subpart A also issued under 5 U.S.C. 552.
Subpart B also issued under 5 U.S.C. 552a and 552 note.
**6 CFR Part 5**
2. Amend § 5.3 by revising paragraphs (a)(2) and (c) to read as follows:
§ 5.3
(a) * * *
(2) A requester may send their request to the Privacy Office, U.S. Department of Homeland Security, via the internet at *https://www.dhs.gov/foia* or for any of the Headquarters Offices of the Department of Homeland Security listed in Appendix A to Subpart 5, or *https://www.foia.gov/.* Upon request, DHS FOIA public liaisons may facilitate, in limited circumstances ( *e.g.,* incarceration), an alternative method to submit requests for requesters who are unable to submit electronic requests. Please direct such requests to the liaison of the Office or DHS Component you wish to seek records from, which can be found listed in Appendix A to Subpart 5 or found here: *https://www.dhs.gov/foia-contact-information.* In addition, if a requester does not know which DHS component may maintain responsive records to a request, the requester may explicitly ask for assistance from the DHS Privacy Office with identifying the proper component that most likely maintains any potential responsive records. Upon a request for assistance and based on information provided in the FOIA request and by the requester, the Privacy Office will forward the request to the DHS component(s) that it determines to be most likely, as of the date of the request for information, to maintain the records that are sought. The Privacy Office will notify the requester that it is forwarding the request, including identifying the component(s) where the request has been sent, provide the FOIA Public Liaison contact information for the respective component(s), and provide administrative appeal rights in the response. If the requester does not agree with the Privacy Office's determination regarding which components would likely have records responsive to the request, the requester must submit a timely appeal of the Privacy Office's determination. Although these are not to be considered misdirected requests, the recipient DHS component shall be granted the same number of days to respond as permitted by 6 CFR 5.4(c) and 5.5(a).
(c) If a request does not adequately describe the records sought, DHS may at its discretion either seek additional information from the requester, or administratively close the request. Requests for clarification or more information will be made in writing electronically whenever possible (either via electronic mail or portal message) except when DHS requests to speak on the phone to discuss the request. If DHS communicates via a phone call, DHS will summarize the call in a follow up electronic mail or portal message. If DHS corresponds only electronically via electronic mail or portal message, requesters must respond to requests for additional information also by electronic mail or portal message in the same medium as the DHS correspondence. In order to be considered timely, responses to requests for additional information must be received by electronic mail or portal message within 30 working days of the electronic mail or portal message request for additional information. If the requester does not respond to a request for additional information within 30 working days, the request may be administratively closed at DHS's discretion. This administrative closure does not prejudice the requester's ability to submit a new request for further consideration with additional information. Upon request, DHS FOIA public liaisons may facilitate, in limited circumstances ( *e.g.,* incarceration), an alternative method to submit requests for requesters who are unable to submit electronic requests. Please direct such requests to the liaison of the Office or DHS Component you wish to seek records from, which can be found listed in Appendix A to Subpart 5 or found here: *https://www.dhs.gov/foia-contact-information.*
**6 CFR Part 5**
3. Amend § 5.21 by revising paragraphs (a)(6) and (c) to read as follows:
§ 5.21
(a) * * *
(6) An individual may send a request to the Privacy Office via the internet at *https://www.dhs.gov/foia* for any of the Headquarters Offices of the Department of Homeland Security listed Appendix A to Subpart 5, or *https://www.foia.gov/.* Upon request, DHS FOIA public liaisons may facilitate, in limited circumstances ( *e.g.,* incarceration), an alternative method to submit requests for requesters who are unable to submit electronic requests. Please direct such requests to the liaison of the Office or DHS Component you wish to seek records from, which can be found listed in Appendix A to Subpart 5 or here: *https://www.dhs.gov/foia-contact-information.* In addition, if a requester does not know which DHS component may maintain responsive records to a request, the requester may explicitly ask for assistance from the DHS Privacy Office with identifying the proper component that most likely maintains any potential responsive records citing this section of the regulations. Upon a request for assistance and based on information provided in the FOIA request and by the requester, the Privacy Office will forward the request to the DHS component(s) that it determines to be most likely, as of the date of the request for information, to maintain the records that are sought. The Privacy Office will notify the requester that it is forwarding the request, including identifying the component(s) where the request has been sent, provide the FOIA Public Liaison contact information for the respective component(s), and provide administrative appeal rights in the response. If the requester does not agree with the Privacy Office's determination regarding which components would likely have records responsive to the request, the requester must submit a timely appeal of the Privacy Office's determination. For the quickest possible handling, the requester should mark the request letter “Privacy Act Request” or “Judicial Redress Act Request.”
(c) *Description of records sought.* A requester must describe the records sought in sufficient detail to enable Department personnel to locate the system of records covering them with a reasonable amount of effort. Whenever possible, the request should describe the records sought, the time periods in which the requester believes they were compiled, the office or location in which the requester believes the records are kept, and the name or identifying number of each system of records in which the requester believes they are kept. The Department publishes notices in the *Federal Register* that describe its components' systems of records. These notices can be found on the Department's website here: *https://www.dhs.gov/system-records-notices-sorns.* If a request does not adequately describe the records sought, DHS may at its discretion either seek additional information from the requester or administratively close the request. Requests for clarification or more information must be made in writing via electronic mail. To be considered timely, responses to requests for additional information must be received by electronic mail within 30 working days of the electronic mail request for additional information. If the requester does not respond timely, the request may be administratively closed at DHS's discretion. This administrative closure does not prejudice the requester's ability to submit a new request for further consideration with additional information.
**6 CFR Part 5**
4. Revise Appendix A to Part 5 to read as follows:
**Appendix A to Part 5—FOIA/Privacy Act Offices of the Department of Homeland Security**
I. For Headquarters Offices of the Department of Homeland Security, FOIA and Privacy Act (or JRA if applicable) requests should be submitted electronically via *https://foiarequest.dhs.gov/.* For a listing of Headquarters Offices and contact information, please see *https://www.dhs.gov/foia-contact-information.* Additional contact information for questions: Phone: 202-343-1743 or 866-431-0486, Fax: 202-343-4011, or Email: *[email protected].* The Public Liaison may also be contacted using this information.
II. For the following components and offices of the Department of Homeland Security, FOIA and Privacy Act (or JRA if applicable) requests should also be submitted electronically by way of instructions at *https://www.dhs.gov/foia-contact-information* or through an alternative dedicated DHS component website. For each component, the Public Liaison may also be contacted using the information below for questions about submission of requests. The components are:
**Cybersecurity and Infrastructure Security Agency (CISA)**
Additional contact information for questions: Phone: 202-343-1743 or 866-431-0486, Fax: 202-343-4011, or Email: *[email protected].*
**U.S. Customs and Border Protection (CBP)**
Additional contact information for questions: Phone: 202-325-0150 or Email: *[email protected].*
**Federal Emergency Management Agency (FEMA)**
Additional contact information for questions: Phone: 202-646-3323, Fax: 202-646-3347, or Email: *[email protected].*
**Federal Law Enforcement Training Center (FLETC)**
Additional contact information for questions: Phone: 912-267-3103, Fax: 912-267-3113, or Email: *[email protected].*
**Immigration and Customs Enforcement (ICE)**
Additional contact information for questions: Phone: 866-633-1182, Fax: 202-732-4265, or Email: *[email protected].*
**Office of Inspector General**
Additional contact information for questions: Phone: 202-981-6100, or Email: *[email protected].*
**Transportation Security Administration (TSA)**
Additional contact information for questions: Phone: 1-866-FOIA-TSA or 571-227-2300, or Email: *[email protected].*
**U.S. Citizenship and Immigration Services (USCIS)**
Additional contact information for questions: Phone: 1-800-375-5283, USCIS Contact Center, or Email: *[email protected].*
**U.S. Coast Guard (USCG)**
Additional contact information for questions: Phone: 202-475-3522, Fax: 202-372-8413, or Email: *[email protected].*
**U.S. Secret Service (USSS)**
Additional contact information for questions: Phone: 202-406-6370, Fax: 202-406-5586, or Email: *[email protected].*
Roman Jankowki,
Chief Privacy Officer, Department of Homeland Security.