Michigan FOIA: respond within 5 business days, and know the exemptions for security plans and cybersecurity records

Michigan’s Freedom of Information Act requires a public body to respond to a written request within 5 business days, with at most one extension of up to 10 business days. MCL 15.243 lets public bodies exempt records of security measures, security and cybersecurity plans and assessments, and certain cybersecurity information, subject to stated limits.

Source facts

Under MCL 15.235, unless otherwise agreed in writing, a public body must respond to a FOIA request within 5 business days by granting it, denying it in writing, granting it in part, or issuing a notice extending the period by not more than 10 business days, and it may issue only one extension per request. A request sent by email is not received until 1 business day after transmission, and failing to respond can count as a final denial in specified circumstances.

MCL 15.233 requires employees who receive a request to promptly forward it to the FOIA coordinator, requires the coordinator to keep requests on file for at least 1 year, and requires a public body to protect public records from loss, unauthorized alteration, mutilation or destruction.

MCL 15.243 lets a public body exempt records of its security measures, including security plans, codes, passwords, keys and procedures, to the extent they relate to its ongoing security. It also covers records of measures to protect people, property or information systems, including emergency response plans, threat assessments and cybersecurity plans, assessments or vulnerabilities, unless disclosure would not impair security or the public interest in disclosure outweighs nondisclosure. Other exemptions cover personal information whose disclosure would be a clearly unwarranted invasion of privacy, and information that would disclose a person’s cybersecurity plans or practices.

Applicability

Use this for Michigan public bodies and their vendors. Exemptions are permissive and fact-specific, other sections govern fees and separating exempt material, and other laws may restrict release; have counsel decide each request.

DSE recommendation

DSE recommends that Michigan public bodies set up a FOIA workflow for security system records and video that can meet the 5-business-day deadline and route exemption decisions to counsel. Tell vendors and staff to forward requests to the FOIA coordinator immediately, preserve requested video before routine overwrite, label security plans and network diagrams for exemption review, and log every request and response.

Verification

Test the workflow once a year with a mock request for a short video clip, and confirm the response, any extension notice and the preserved copy are produced on time.

Official references

Michigan Legislature — MCL 15.235, Freedom of Information Act (1976 PA 442). Michigan Legislature — MCL 15.233, Public records; request requirements. Michigan Legislature — MCL 15.243, Exemptions from disclosure. Reviewed October 18, 2026.