What is a legal hold or retention hold?¶

A legal hold or retention hold is an organisational instruction to preserve specified information that might otherwise be deleted or altered through normal processes.

Avoid this assumption: A hold automatically identifies and preserves every relevant record. Its effectiveness depends on the scope, systems, people, data categories and time period covered.

A hold may apply to email, messages, documents, cloud files, logs, backups, devices, case systems and other business records.

It may suspend routine deletion, retention expiry, mailbox cleanup or disposal of equipment.

The hold should identify the matter, custodians, systems, relevant dates and categories of information as precisely as possible.

Record who authorised it, when it began, who received notice and which technical controls were applied.

Do not rely solely on an email telling staff not to delete material. Some systems require administrator action to preserve records properly.

A hold does not necessarily prevent users from changing live data unless separate controls exist.

It also does not automatically provide investigators with access to the preserved material.

Where the scope is unclear, involve legal, records-management, information-governance and technical specialists.

Record any limitation, failed system, excluded source or period not covered.

Review the hold when new accounts, systems, people or relevant time periods are identified.

Do not describe the evidence as complete merely because a hold exists.

Record how compliance will be checked and who is responsible for lifting or reviewing the hold.

Operational takeaway¶

Use a legal or retention hold to suspend routine loss across clearly defined people, systems and data, while recording its scope, controls, limitations and ongoing review.