Confidential Treatment: SEC Comment Letter Response Guide

Confidential Treatment for SEC Comment Letter Responses: The Rule 83 Playbook

If your SEC comment letter response contains pricing data, contract terms, litigation strategy, or proprietary financial projections, that information will go public on EDGAR 20 business days after the staff closes its review, unless you act. This guide walks through exactly how to protect it under Rule 83 of the SEC's Rules on Information and Requests (17 C.F.R. § 200.83), step by step, including the procedural traps that turn a defective request into no protection at all.

For the broader mechanics of structuring and filing a CORRESP response, see Finrep's SEC Comment Letter Response Best Practices: The 2026 Playbook. This article focuses exclusively on the confidential treatment process.

Key takeaway: A procedurally defective Rule 83 request is treated as no request at all. The SEC will release the full, unredacted response letter on EDGAR. There is no cure once the review closes.

Can You Keep Parts of an SEC Comment Letter Response Confidential?

Yes, but only your response letters and supplemental materials, not the SEC's comment letters themselves. This asymmetry catches practitioners off guard. When the SEC's Division of Corporation Finance issues a comment letter, that letter goes public in full, no exceptions. What you can protect, under Rule 83, are selected portions of your written responses (filed on EDGAR as form type CORRESP) and any supplemental materials you submit alongside them, such as financial models, board books, or technical analyses.

The SEC has been publicly releasing comment letters and registrant responses since August 1, 2004, when it announced it would expand transparency "so that this information is available to a broader audience, free of charge." As Willkie Farr & Gallagher noted at the time, "it is now more important than ever for filers to consider seeking confidential treatment for portions of their response letters." That observation has only grown more relevant as EDGAR search tools have made CORRESP filings trivially searchable by competitors, investors, and journalists.

Rule 83 vs. Rule 406 vs. Rule 24b-2: Which Applies?

Using the wrong rule is a common and consequential mistake. Here is how the three regimes divide:

Rule 83 governs information that is not itself required to be filed, meaning the content of your response letter and any supplemental materials you voluntarily provide to the staff. Rule 406 and Rule 24b-2 govern the exhibits attached to your primary filings. If you are trying to protect a material contract that you filed as Exhibit 10.x to your S-1, that is a Rule 406 question. If you are trying to protect the discussion of that contract in your comment letter response, that is Rule 83.

The Skadden 2024 guide on confidential treatment of exhibits covers the Rule 406/24b-2 exhibit regime in detail. This article covers only Rule 83.

What Information Qualifies for Protection Under Rule 83?

The substantive standard is FOIA Exemption 4: "trade secrets and commercial or financial information obtained from a person and privileged or confidential." The SEC applies this standard when evaluating whether to uphold a confidential treatment request if a third party later files a FOIA request for the redacted material.

Strong candidates for protection include:

• Customer-specific pricing, discount structures, or volume thresholds
• Unpublished financial projections, internal models, or budget data
• Material contract terms that competitors could exploit (e.g., exclusivity periods, termination fees, minimum purchase commitments)
• Litigation strategy, settlement discussions, or legal analyses
• M&A deal terms, valuation methodologies, or target identification
• Proprietary ESG metrics, emissions data, or supply chain information submitted in response to climate-related comments

Weak or unsupported grounds include:

• Information already publicly disclosed elsewhere (inadvertent disclosure by the company or a counterparty destroys the basis for protection)
• Generic assertions that information is "commercially sensitive" without specifics
• Redactions covering entire pages where only a few lines are actually protectable

The SEC has stated it will question requests that are "on their face overly broad." As CCB Journal notes, the FOIA Office letter must "indicate reasons for seeking confidential treatment and provide facts and sufficient legal analysis specific to the information subject to the request." Narrow, well-justified redactions survive; sweeping ones invite pushback.

The Three-Part Rule 83 Process: Step by Step

The Rule 83 mechanics are precise. All three steps must be completed concurrently, and each has specific formatting requirements. A failure in any one of them means the protection fails.

Step 1: File a Redacted Version on EDGAR

File your CORRESP response letter on EDGAR with all confidential portions removed. Use the placeholder marker [***] (or a similar bracketed notation) wherever information has been omitted. The header of the EDGAR-filed version must state prominently that portions have been omitted and that confidential treatment has been requested.

The Palo Alto Networks CORRESP filing from May 10, 2012 (File No. 333-180620) is the canonical public example. Its header reads:

"CERTAIN PORTIONS OF THIS LETTER AND ITS ANNEXES HAVE BEEN OMITTED FROM THE VERSION FILED VIA EDGAR. CONFIDENTIAL TREATMENT HAS BEEN REQUESTED WITH RESPECT TO THE OMITTED PORTIONS. INFORMATION THAT WAS OMITTED IN THE EDGAR VERSION HAS BEEN NOTED IN THIS LETTER WITH A PLACEHOLDER IDENTIFIED BY THE MARK [***]."

Do not file the unredacted version on EDGAR. That error is irreversible.

Step 2: Deliver an Unredacted Paper Copy to the SEC Examiner

Send the SEC examiner conducting the review two things by overnight delivery:

1. A full, unredacted paper copy of the response letter and all supplemental materials. Every page, or segregable portion of every page, must be clearly marked with the words "Confidential Treatment Requested by [Name]" and an identifying Bates-stamped number and code (e.g., "PAN-0001" for Palo Alto Networks' first page).

2. A separate written request for confidential treatment addressed to the examiner, specifying the information for which protection is sought by reference to the identifying Bates numbers and codes.

On Bates-stamping: use any standard document management or PDF software that applies sequential page numbers. The code (e.g., "COMPANYNAME-0001") should be unique to this submission. The Palo Alto Networks filing used "PAN-0001" as its identifier. The point is traceability, so the FOIA Office letter and the paper copy cross-reference each other unambiguously.

Also enclose a copy of the FOIA Office letter (Step 3) and a copy of the correspondence marked to show the redacted portions, so the examiner has the full picture.

Step 3: Send the FOIA Office Letter

This is the step most practitioners underestimate. The FOIA Office letter is a distinct document from the response letter. Send it by mail to:

Office of Freedom of Information and Privacy Act Operations U.S. Securities and Exchange Commission 100 F Street, N.E. Washington, D.C. 20549

Required elements of the FOIA Office letter:

• The words "FOIA Confidential Treatment Request" must appear clearly and prominently at the top of the first page.
• The name, address, and telephone number of the person requesting confidential treatment.
• A reference to the response letter by its identifying Bates number and code.
• The specific information for which protection is sought, identified by Bates number.
• The legal and factual basis for protection under FOIA Exemption 4, specific to each category of information.
• The period of time for which confidential treatment is sought (with justification).

Do not enclose the underlying response letter or supplemental materials with the FOIA Office letter. Send only the written request itself.

Model language for the opening paragraph of the FOIA Office letter:

"Pursuant to Rule 83 of the Commission's Rules on Information and Requests, 17 C.F.R. § 200.83, [Company Name] hereby requests confidential treatment for the portions of its response letter dated [Date] to the staff of the Division of Corporation Finance, identified by Bates numbers [COMPANYNAME-0001] through [COMPANYNAME-000X], as specified herein. The information for which confidential treatment is requested constitutes confidential commercial and financial information within the meaning of FOIA Exemption 4, 5 U.S.C. § 552(b)(4), for the reasons set forth below."

What Happens After You File: The No-Proactive-Ruling Principle

The SEC will not make an affirmative determination on your Rule 83 request unless and until a third party files a FOIA request for the redacted material. Until that happens, the SEC releases only the redacted EDGAR version. Protection is effectively automatic in the absence of a FOIA request.

This means you cannot obtain a formal ruling proactively, and you should not expect one. The practical implication: your risk management posture should be based on the likelihood that a competitor, journalist, or short-seller will file a FOIA request for the specific information you have redacted.

If the FOIA Office does receive a third-party request, the process works as follows:

1. The FOIA Office notifies the company that a request has been received.
2. The company has an opportunity to provide reasons why the information should not be disclosed.
3. The FOIA Office makes a determination on whether the information warrants protection under Exemption 4.
4. If the FOIA Office rejects the request for confidential treatment, the information is not automatically disclosed; the company may have further appeal rights before disclosure occurs.

As CCB Journal explains, "the SEC will then give you the opportunity to provide your reasons for seeking the request and will only disclose the information if it determines that the information does not warrant confidential treatment."

How Long Does Confidential Treatment Last?

A Rule 83 confidential treatment request expires ten years from the date the FOIA Office receives it, unless the FOIA Office receives a renewal before that date. There is no automatic extension.

This is a live compliance issue right now. Companies that filed Rule 83 requests in connection with comment letters in 2015 or 2016 are approaching or have passed their ten-year mark. If your company has confidential treatment requests dating to that period, calendar the renewal deadline immediately.

Renewal requires a new submission to the FOIA Office before expiration, with updated justification for why the information remains protectable. The standard for renewal is the same as for the original request: the information must still qualify under FOIA Exemption 4.

The IPO Acceleration Risk: What S-1 Filers Must Know

For companies in an active S-1 or other registration statement review, a pending confidential treatment request on an exhibit creates a direct gate on the IPO timeline. The SEC staff will not accelerate the effective date of the registration statement until any comments on the confidential treatment request have been resolved and the application is complete.

The Palo Alto Networks filing states this explicitly. The staff's comment reads: "Any comments must be resolved and your application must be complete before we may accelerate the effective date of your registration statement."

Two additional mechanics from that filing are worth noting:

• The confidential treatment review runs on a parallel track from the substantive disclosure comments. Comments on the confidential treatment request, if any, are issued in a separate letter.
• The exhibit-level confidential treatment request (governed by Rule 406 for S-1 exhibits) and the response-letter confidential treatment request (governed by Rule 83) are separate applications, but both must be resolved before acceleration.

For S-1 filers on a tight IPO timeline, this means starting the Rule 83 process as early as possible, not as an afterthought after the response letter is drafted. See Finrep's S-1 SEC Comment Letters: Evidence Before the Response for the broader S-1 comment letter strategy.

The Strategic Question: How Much to Redact?

Over-redaction and under-redaction carry opposite but equally serious risks.

Over-redaction draws staff scrutiny. The SEC has stated it will question requests that are overly broad on their face. A response letter where entire paragraphs are blacked out, without granular justification for each redaction, signals that the company is using confidential treatment as a blanket shield rather than a targeted protection. That invites a challenge from the FOIA Office and can delay resolution of the comment letter itself.

Under-redaction is irreversible. Once the EDGAR-filed version goes public, the information is public. There is no mechanism to retroactively redact a CORRESP filing. If you omit a redaction that should have been there, competitors and investors have the information permanently.

The practical approach:

1. Go through the response letter line by line before filing. Flag every piece of information that meets the FOIA Exemption 4 standard.
2. For each flagged item, ask: has this been publicly disclosed anywhere else? If yes, it cannot be protected.
3. Draft the FOIA Office letter to justify each category of redaction separately, with specific facts about the commercial harm that disclosure would cause.
4. Have outside securities counsel review the redactions and the FOIA Office letter before filing. The Rule 83 process is technical enough that a first-time practitioner is likely to miss something.

For ESG and sustainability teams: as the SEC's climate disclosure rules generate more comment letters touching on proprietary emissions data, supply chain information, and transition plan details, the confidential treatment question is becoming a live issue for ESG officers and CFOs, not just securities counsel. The same Rule 83 framework applies to supplemental ESG materials submitted to the staff.

Supplemental Materials: An Often-Missed Category

Rule 83 protection extends beyond the response letter itself to "any supplemental information submitted therewith." This includes financial models, board presentations, internal projections, marketing materials, and technical analyses that the staff requests outside the formal CORRESP process.

For supplemental materials that are not filed on EDGAR, the Rule 83 request should be accompanied by a request for return of the materials under Securities Act Rule 418(b) or Exchange Act Rule 12b-4, as applicable. If the SEC rejects the return request, the materials remain protected until a third party files a FOIA request, at which point the same notification and determination process applies.

Checklist: Rule 83 Confidential Treatment for a CORRESP Filing

Use this before submitting any response letter that contains sensitive information:

• Identified every piece of information in the response letter and supplemental materials that meets the FOIA Exemption 4 standard
• Confirmed that none of the information to be redacted has been publicly disclosed elsewhere
• Drafted the EDGAR-filed version with [***] placeholders at every redaction point
• Added the required header language to the EDGAR-filed version ("CERTAIN PORTIONS OF THIS LETTER HAVE BEEN OMITTED...")
• Prepared the full, unredacted paper copy with "Confidential Treatment Requested by [Name]" on every page
• Bates-stamped every page of the unredacted paper copy with a unique identifying code
• Drafted the separate written request for confidential treatment to the SEC examiner, referencing the Bates numbers
• Drafted the FOIA Office letter with "FOIA Confidential Treatment Request" at the top, required contact information, Bates references, and Exemption 4 justification for each category
• Confirmed the FOIA Office letter does NOT include the underlying response letter or supplemental materials
• Calendared the 10-year expiration date for renewal
• For S-1 filers: confirmed that the confidential treatment review timeline is factored into the IPO acceleration schedule

FAQ

Can I request confidential treatment for the SEC's comment letter itself? No. The SEC releases comment letters in full, without exception. Rule 83 applies only to registrant response letters and supplemental materials submitted in connection with the comment letter process.

What happens if I accidentally file the unredacted version on EDGAR? The information becomes public immediately and permanently. There is no mechanism to retract or redact a CORRESP filing after it has been accepted by EDGAR. Contact outside counsel immediately if this occurs.

Does the SEC proactively review my Rule 83 request and issue a ruling? No. The SEC releases only the redacted EDGAR version and takes no further action unless a third party files a FOIA request for the omitted material. You will not receive a formal approval or denial absent a third-party request.

What is the difference between Rule 83 and Rule 406/24b-2? Rule 83 covers response letters and supplemental materials submitted in connection with a comment letter. Rule 406 (Securities Act) and Rule 24b-2 (Exchange Act) cover exhibits to registration statements and periodic reports. Using the wrong rule for the wrong document type means the request fails.

Can a pending Rule 83 request block my IPO? A pending confidential treatment request on an exhibit (governed by Rule 406) can block acceleration of the registration statement's effective date. The staff will not accelerate until the application is complete and any comments are resolved. The Rule 83 request for the response letter itself runs on a parallel track but should also be resolved before acceleration.

What if my confidential treatment request is approaching its 10-year expiration? File a renewal with the FOIA Office before the expiration date. There is no grace period. A request that expires without renewal loses its protection, and the full, unredacted information becomes subject to release upon any subsequent FOIA request.