What can a preservation request achieve?¶

A preservation request can reduce the risk that specified provider-held records are lost through routine deletion or retention expiry.

Avoid this assumption: Preservation captures everything connected to an account. Its effect depends on the provider, the identifiers supplied, the categories requested, the time range and the lawful process used.

A well-framed request may preserve account records, login and session data, communications, cloud files, audit events, subscriber information or other provider-held material.

It may also protect records linked to an account scheduled for deletion or a short provider-retention period.

Preservation can secure time for the correct disclosure, production or legal process to follow.

Before making the request, preserve exact account identifiers, URLs, object IDs, timestamps, tenant details and relevant context.

Define the investigative question and the data at risk.

Record the provider’s confirmation, reference number, preserved categories, date range, expiry and any limitation.

Do not assume the provider has preserved data it never held, had already deleted or could not identify from the request.

Preservation does not normally provide immediate access to the material.

It does not automatically disable the account, stop offending, prevent remote deletion by the user or prove who used the service.

A later disclosure may still be limited, unavailable or subject to separate authority.

Where the request is urgent or technically complex, seek legal, communications-data or specialist support.

Operational takeaway¶

Use preservation to hold identified provider records against routine loss and create time for lawful acquisition, while recording its exact scope, duration and limitations.