A university has a contract with the government. Does a university need to confirm the existence of a contract when the third party asks?
If this is a government university in the US, the matter would be controlled by that state's public records law. An example is 42.56 RCW Public Records Act. Generally, you have to make available any public record. In the definitions, that
includes any writing containing information relating to the conduct of government or the performance of any governmental or proprietary function prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics.
which a contract would be an example of.
The obligation to make accessible is in 42.56.070, which requires that
(1) Each agency, in accordance with published rules, shall make available for public inspection and copying all public records, unless the record falls within the specific exemptions of subsection (8) of this section, this chapter, or other statute which exempts or prohibits disclosure of specific information or records.
Thus there are some exceptions to what must be made available. One partial exception is, as that subsection continues that
To the extent required to prevent an unreasonable invasion of personal privacy interests protected by this chapter, an agency shall delete identifying details in a manner consistent with this chapter when it makes available or publishes any public record; however, in each case, the justification for the deletion shall be explained fully in writing.
hence you can't make a public records request to obtain my address, phone number, SS number and so on. Also as mentioned above, subsection (8) instructs that
This chapter shall not be construed as giving authority to any agency...to give, sell or provide access to lists of individuals requested for commercial purposes, and agencies... shall not do so unless specifically authorized or directed by law
And there is a sub-exception therein that
lists of applicants for professional licenses and of professional licensees shall be made available to those professional associations or educational organizations recognized by their professional licensing or examination board, upon payment of a reasonable charge therefor
On the front of personal information, the law indicates more or less what personal information is excluded, in 42.56.050:
(1) Would be highly offensive to a reasonable person, and (2) is not of legitimate concern to the public
There are quite a number of other exceptions:
Records in the medical marijuana authorization database established in RCW 69.51A.230 containing names and other personally identifiable information of qualifying patients and designated providers are exempt from disclosure
Actual enumeration data collected under RCW 35.13.260, 35A.14.700, 36.13.030, and chapter 43.62 RCW shall be used and retained only by the office of financial management and only for the purposes of RCW 35.13.260, 35A.14.700, 36.13.030, and chapter 43.62 RCW. The enumeration data collected is confidential, is exempt from public inspection and copying under this chapter, and in accordance with RCW 43.41.435, must be destroyed after it is used.
The following investigative, law enforcement, and crime victim information is exempt from public inspection and copying under this chapter: (1) Specific intelligence information and specific investigative records compiled by investigative, law enforcement, and penology agencies, and state agencies vested with the responsibility to discipline members of any profession, the nondisclosure of which is essential to effective law enforcement or for the protection of any person's right to privacy;
and especially pertaining to security:
The following information relating to security is exempt from disclosure under this chapter:
(1) Those portions of records assembled, prepared, or maintained to prevent, mitigate, or respond to criminal terrorist acts, which are acts that significantly disrupt the conduct of government or of the general civilian population of the state or the United States and that manifest an extreme indifference to human life, the public disclosure of which would have a substantial likelihood of threatening public safety, consisting of...
(and a lot more).
So in Washington (and many similar states), if University of X has a contract with W, that fact is a public record and subject to some degree of disclosure. The actual content might be heavily redacted, pursuant to the numerous exceptions that exist, but the existence of a contract is not subject to suppression. Also, there is no requirement to disclose records for the purpose of commercial exploitation.
Federal law might be relevant, if the university were a federal university, but there are none. There are federal military academies, which are not termed "universities", but with an expanded understanding of "university", military academies would be subject to federal law, the Freedom of Information Act. Federal agencies are subject to an analogous obligation to disclose, with exemptions (for example:
This section does not apply to matters that are— (1) (A) specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign policy and (B) are in fact properly classified pursuant to such Executive order;
If any party to the contract is a government agency (state or federal), one can pursue a records request. Consequently, the only university contracts which are entirely exempt from disclosure are those between a private university and a non-governmental party.