A legal hold is the process of suspending normal deletion and retention practices so that evidence relevant to anticipated or pending litigation is preserved. It is not a single email: it is a notice, a suspension of automated deletion, and an ongoing obligation to confirm that both are actually working.
Three parts, and only one of them is the notice
Organisations reliably do the first part and reliably neglect the other two.
The notice tells custodians what to preserve and why. It should be specific enough that a recipient can act on it — naming the matter, the subject, the date range, and the kinds of material at issue.
The systems suspension is the part that actually preserves anything. Mail retention policies, messaging auto-deletion, backup rotation, ticketing systems and cloud platforms each delete on their own schedule, and none of them read the notice. This has to be done by an administrator, per system, and it is where preservation most often fails.
The follow-through is confirming receipt, re-issuing as the matter's scope changes, adding custodians as they surface, and releasing the hold when the matter ends. A hold nobody has confirmed is a hold nobody can prove.
When it starts
When litigation is reasonably anticipated — not when it is filed, and not when counsel is retained. A demand letter, a serious internal complaint, a regulator's inquiry, or an executive circulating a memo about a probable dispute can all trigger the duty.
Because the date is contested later, the reasoning behind it is worth recording contemporaneously. A short memo explaining what was known on the day the hold issued is far more persuasive than a reconstruction offered two years afterwards.
Scoping it honestly
Over-broad holds fail differently from narrow ones, but they do fail. A hold covering every employee and every system for an indefinite period will be quietly ignored, will not be technically enforced, and produces an enormous review population if it is enforced. A hold drawn too narrowly misses the custodian whose relevance emerges in deposition.
The workable approach is a defensible core — the custodians and systems obviously implicated — with a documented process for expanding as facts develop. What matters when it is challenged is not that the initial scope was perfect but that the reasoning was recorded and the process was responsive.
The parts people forget
- Departing employees. Offboarding wipes and reissues devices. Someone has to connect the hold list to the HR process, or the hold is defeated by routine IT hygiene.
- Personal devices and accounts. If work happens there, the data may be within scope and outside the company's technical control.
- Collaboration and messaging platforms. Chat is frequently where the candid discussion lives, and frequently the shortest default retention.
- Third parties. Vendors, contractors and cloud providers may hold relevant data the company has a contractual right to demand and no automatic ability to preserve.
Releasing it
Holds that are never lifted accumulate. An organisation preserving everything for every matter since 2015 has a storage cost, a review cost in the next matter, and a privacy exposure it did not choose. Releasing a hold is a decision to be documented like any other, but declining to make it is also a decision.
From our work
Dealing with legal hold in a live matter?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.