ELI5: What is a Legal Hold?
A legal hold means “do not delete anything” because it might be needed for a court case. It is like when a teacher says “nobody throw away your test papers” until grades are finalized.
Definition
A legal hold (also known as a litigation hold or preservation order) is a formal directive issued by legal counsel or management to suspend routine document destruction and data retention policies for data that may be relevant to anticipated or ongoing litigation, regulatory investigation, or government inquiry. Security and IT teams must immediately preserve all relevant electronically stored information (ESI) when a legal hold is issued.
Key Details
- Overrides normal data retention and destruction schedules — data must be preserved regardless of retention policy
- Failure to preserve data subject to a legal hold can result in sanctions, adverse inference instructions, or criminal charges (spoliation of evidence)
- Must be communicated clearly to all custodians (individuals with potentially relevant data)
- Cloud and email systems must be configured to enforce holds and prevent deletion
- Legal hold should be documented: what data is covered, who is subject to it, and when it was issued
Connections
- Parent: digital-forensics — legal hold is a critical prerequisite to forensic evidence collection
- See also: e-discovery