Records are considered lost when they can no longer be accessed, read, or produced in their original form after a reasonable effort to find or recover them. That standard sounds simple, but the point at which a missing item crosses from “hard to locate” into “legally lost” depends on the kind of record and the rules that govern it. Federal courts, the IRS, and privacy regulators each apply their own test, and the consequences range from a 20 percent tax penalty to a default judgment in a lawsuit.
Physical Records: Missing After a Diligent Search
A paper file, microfilm reel, or other tangible record is treated as lost when it cannot be found in its assigned location after a diligent search. Misfiling is the most common cause. The folder may still exist somewhere in the building, but if a reasonable search fails to turn it up, the organization has to treat it as lost for compliance purposes.
Outright destruction produces the same result. Fire, flooding, mold, accidental shredding, or disposal can leave a document unreadable or gone entirely, and once that happens, restoration is usually impossible. Federal agencies must report this kind of loss to the National Archives and Records Administration under 36 CFR Part 1230, including a description of the records, the circumstances, the safeguards put in place to prevent a recurrence, and any steps taken to recover or reconstruct what was lost.1eCFR. 36 CFR Part 1230 – Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records Private organizations face parallel obligations through industry regulations, contracts, or court orders.
Digital Records: Unreadable, Locked, or Obsolete
A digital record can be lost even when the drive holding it works perfectly. Severe file corruption can scramble the data until no software can reassemble the document, and if the file cannot be read after reasonable recovery efforts, it is lost. The storage device does not have to have failed.
Losing an encryption key produces the same outcome. When the key to encrypted data is deleted, revoked, or misplaced, the content becomes permanently inaccessible. The ones and zeros remain on the disk, but without the key no one can turn them back into usable information. Cloud providers treat a revoked encryption key the same as deletion for this reason.
Software obsolescence is a slower version of the same problem. If a record sits in a proprietary file format and the software that reads it no longer runs on any available hardware, the content is effectively sealed off. Format migration and emulation sometimes recover the data; when they fail, the record is lost. Organizations that store records digitally are generally expected to maintain the ability to retrieve, process, and print those records for as long as they are required to keep them.2Internal Revenue Service. Rev. Proc. 98-25
Ransomware Counts as Loss and Possibly a Breach
Ransomware sits in an awkward middle ground. When an attacker encrypts files and demands payment, the records are inaccessible to the organization, and the attacker may have accessed or copied them. The Department of Health and Human Services treats ransomware-encrypted health records as a presumed breach, reasoning that the attacker has taken “possession or control” of the information by encrypting it.3HHS.gov. Fact Sheet: Ransomware and HIPAA So the same event can trigger both loss and disclosure obligations at once.
Authorized Destruction Is Not Loss
Not every missing record is a lost record. Organizations with approved retention schedules are required to destroy certain records once the retention period expires. A personnel file shredded after its seven-year window is not lost. It was disposed of on schedule and with authorization.
This distinction matters because the consequences diverge sharply. Federal agencies cannot legally destroy records without an approved schedule from NARA, and any destruction outside that schedule is classified as unauthorized disposal.4National Archives. Scheduling Records Records that have not yet been scheduled must be treated as permanent until a schedule is approved. Private organizations face analogous rules under industry regulations and litigation holds. If a policy authorized the destruction, the record is not lost. If it did not, the record is lost or unlawfully destroyed, and the exposure grows from there.
When Records Are “Lost” in a Lawsuit
Once litigation is in the picture, the standard sharpens. Federal Rule of Civil Procedure 37(e) governs electronically stored information that should have been preserved for a lawsuit. Under that rule, information is considered lost when three conditions all hold: the data should have been preserved in anticipation of or during litigation, a party failed to take reasonable steps to preserve it, and the data cannot be restored or replaced through additional discovery.5Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions
The duty to preserve starts when litigation is reasonably foreseeable, not when a complaint is filed. A demand letter, word that a former employee is considering a claim, or an incident that will obviously generate lawsuits can each trigger the obligation. Once the duty exists, letting routine deletion continue or failing to issue a litigation hold creates serious exposure.
Two Tiers of Sanctions
Rule 37(e) splits its remedies by state of mind:
- If the court finds another party was prejudiced by the missing information, it can order measures “no greater than necessary to cure the prejudice.” That might mean allowing evidence about the loss, reopening discovery, or adjusting how certain facts are treated at trial.
- If the court finds the party acted with the intent to deprive the other side of the information, the court can instruct the jury to presume the lost evidence was unfavorable, dismiss the action, or enter a default judgment.5Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions
The intent requirement is where most spoliation disputes are fought. The harshest sanctions are not available just because records went missing. The court must find that the party deliberately destroyed or failed to preserve the data to keep the other side from using it. Negligence, even gross negligence, does not reach that threshold under the federal rule. Careful documentation of your preservation efforts is what makes the difference.
One limit worth flagging: Rule 37(e) applies specifically to electronically stored information. Physical records lost during litigation fall under the court’s inherent authority and common law spoliation principles, which vary by jurisdiction but follow similar logic.
Lost Tax Records and the IRS
Taxpayers are required to keep records sufficient to determine their tax liability.6Office of the Law Revision Counsel. 26 USC 6001 – Notice or Regulations Requiring Records, Statements, and Special Returns When records are destroyed by a disaster, theft, or system failure, the IRS does not simply accept that they are gone. Taxpayers are expected to reconstruct what they can.
The IRS recommends several reconstruction methods: requesting bank statements showing deposits and payments, obtaining copies of invoices from suppliers going back at least a year, checking phones and cameras for photos of inventory or property, and requesting transcripts of prior-year returns using Form 4506-T.7Internal Revenue Service. Reconstructing Records After a Natural Disaster or Casualty Loss After a federally declared disaster, you can write the disaster designation in red at the top of Form 4506-T to expedite processing and waive the normal fee.8Internal Revenue Service. About Form 4506-T, Request for Transcript of Tax Return
The penalty shows up indirectly. If the IRS determines that lost records contributed to an underpayment, it can impose a 20 percent accuracy-related penalty on the underpaid amount under IRC 6662. One factor the IRS weighs in assessing negligence is whether the taxpayer failed to maintain adequate books and records.9Taxpayer Advocate Service. Accuracy-Related Penalty Under IRC 6662(b)(1) and (2) The penalty can be waived if you show reasonable cause and good faith, which is why documenting reconstruction efforts matters almost as much as the reconstruction itself.
When a Lost Record Also Triggers Breach Notification
If the lost records contain personal information, the loss itself can require notice to affected individuals and regulators. Many organizations do not realize the overlap until a deadline has already passed.
Under HIPAA’s Breach Notification Rule, a covered entity that loses unsecured protected health information must notify each affected individual within 60 calendar days of discovering the breach.10eCFR. 45 CFR 164.404 – Notification to Individuals If more than 500 people are affected, the entity also has to notify HHS and prominent media outlets. The key word is “unsecured.” Records properly encrypted before they went missing generally fall outside the notification requirement.
Financial institutions covered by the Gramm-Leach-Bliley Act have their own mandate. Under the FTC’s Safeguards Rule, a financial institution must notify the FTC within 30 days of discovering a breach involving the unencrypted customer information of at least 500 consumers.11Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect Physical losses count. If customer data on a laptop, portable drive, or paper file is lost or stolen, unauthorized acquisition is presumed unless the institution has reliable evidence the data was not actually compromised.12Federal Trade Commission. Gramm-Leach-Bliley Act
All 50 states also have breach notification laws, and many define “breach” broadly enough to cover physical loss. Several states explicitly treat lost or stolen devices containing unencrypted personal information as reportable breaches. Timeframes, definitions of covered personal information, and reporting duties vary significantly by state, so any organization that loses records containing names combined with Social Security numbers, financial account numbers, or similar identifiers should check its obligations in every state where affected individuals live.
What to Document When Records Go Missing
Once records are missing, the documentation you create about the loss often matters more than the records themselves. Whether you are reporting to NARA, responding to a court order, or defending a tax position, the quality of that documentation shapes how the loss is judged.
For every lost record, capture:
- What the records contained, how many items were affected, and the date range they covered.
- The specific server path, filing cabinet, shelf, or off-site storage facility where the records were last confirmed to exist.
- The person or department that last had control of them.
- The circumstances of the loss, whether accidental deletion, a natural disaster, malware, or an unexplained disappearance.
- Every step taken to locate, restore, or reconstruct the records, with dates and results.
- The safeguards put in place to prevent the same type of loss from recurring.
Federal agencies must report unauthorized removal or destruction of records to NARA promptly, with the report approved by the official authorized to sign records schedules.1eCFR. 36 CFR Part 1230 – Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records In litigation, notifying opposing counsel quickly about lost evidence matters, because delay strengthens any argument that you acted in bad faith. In regulatory contexts, the deadline depends on the framework: 60 days under HIPAA, 30 days under the Safeguards Rule, and varying windows under state breach statutes. The longer you wait, the worse the loss looks, and the harder it becomes to argue you handled it responsibly.