How should preservation requests and responses be documented?¶

Preservation requests and responses should be documented as a complete decision and continuity record.

Avoid this assumption: Keeping the provider’s confirmation email is enough. The record should show why preservation was needed, what was requested, how the account was identified and what the provider actually agreed to retain.

Record the investigative purpose, urgency and risk of loss.

Preserve every identifier supplied, including account IDs, usernames, email addresses, phone numbers, URLs, tenant names, object IDs, session IDs and relevant timestamps.

Record the requested categories, date range, time zone and any exclusions.

Document who authorised the request, who submitted it, the date, time, route and provider contact point.

Retain the exact request rather than only a summary.

Record the provider reference, acknowledgement, preserved scope, stated expiry, limitations and required follow-on process.

If the provider asks for clarification, preserve both the question and the response.

Document extensions, amendments, refusals, failures and any change in scope.

Do not state that material was preserved beyond what the provider confirmed.

Where several providers or organisational systems are involved, maintain separate records so each preservation action can be tracked.

Record who is responsible for the next legal, disclosure or review step and the deadline.

Preserve attachments, portal receipts, screenshots and case-system entries in an approved location.

Preserve evidence of successful submission, delivery and receipt, not just the text prepared for sending.

Operational takeaway¶

Document preservation from rationale and identifiers through provider confirmation, scope, expiry and follow-on responsibility so the action can be verified and completed in time.