When should provider preservation be considered?¶

Consider provider preservation when identified records face a credible risk of loss before the correct process for obtaining them can be completed. The trigger is the retention risk, not simply the importance of the account.

Look for a time-sensitive loss mechanism¶

Examples include disappearing messages, short log windows, deleted-item expiry, account closure, employee departure, service migration and rapidly changing incident data. Records may be lost while an account remains active, and provider systems may retain different categories for different periods.

Start with the investigative question: what record matters, which service is likely to hold it, and what event may remove it? Preserve the visible warning, countdown, deletion state or other basis for urgency. Continue local preservation because a provider request does not secure devices, screenshots or organisational logs.

Make a proportionate, traceable decision¶

Capture exact account, tenant, object, session and time identifiers before contact. Define the relevant categories and period rather than requesting everything associated with a possibly relevant account. Use the approved organisational, legal, communications-data or provider channel.

Record the authority, request, time, scope and response. Seek early specialist advice for unclear service structures, shared accounts or overseas providers. Preservation must not delay separate safeguarding or containment where immediate harm continues.