6 C.F.R. § 5.23 – Responses to requests for access to records.

(a) In general. Components should, to the extent practicable, communicate with requesters having access to the internet using electronic means, such as email or web portal.
(b) Acknowledgements of requests. Consistent with the procedures in subpart A of this part, a component will acknowledge the request and assign it an individualized tracking number if it will take longer than ten (10) working days to process. Components will include in the acknowledgement letter a brief description of the records sought to allow requesters to more easily keep track of their requests. Further, in the acknowledgment letter, the component will confirm the requester's agreement to pay fees under §§ 5.21(d) and 5.29.
(c) Grants of requests for access. Consistent with the procedures in subpart A to this part, a component will have twenty (20) working days from when a request is received to determine whether to grant or deny the request unless there are unusual or exceptional circumstances as defined by the FOIA and set out in § 5.5(c). Once a component decides to grant a request for access to record(s) in whole or in part, it will notify the requester in writing. The component will inform the requester in the notice of any fee charged under §§ 5.21(d) and 5.29 and will disclose records to the requester promptly upon payment of any applicable fee. The component will inform the requester of the availability of its FOIA Liaison to offer assistance.
(d) Adverse determinations of requests for access. A component making an adverse determination denying a request for access in any respect will notify the requester of that determination in writing. Adverse determinations, or denials of requests, include decisions that: the requested record is exempt, in whole or in part; the requested record does not exist or cannot be located; or the record requested is not subject to the Privacy Act or JRA. Further, adverse determinations also include disputes regarding fees, or denials of a request for expedited processing. The denial letter will be signed by the head of the component, or the component head's designee, and will include:
1. (1) The name and title or position of the person responsible for the denial;
2. (2) A brief statement of the reason(s) for the denial, including any Privacy Act exemption(s) applied by the component in denying the request; and
3. (3) A statement that the denial may be appealed under § 5.25(a) and a description of the requirements of § 5.25(a).
(e) JRA access requests. For purposes of responding to a JRA access request, a covered person is subject to the same limitations, including exemptions and exceptions, as an individual is subject to under section 552a of title 5, United States Code, when pursuing access to records. The implementing regulations and reasons provided for exemptions can be found in appendix C to this part.