What is a legal hold or retention hold?¶

A legal or retention hold is an organisational control that suspends routine deletion or disposal for defined information relevant to a matter. It preserves availability; it does not automatically collect or disclose the material.

A hold needs defined boundaries¶

Scope may identify custodians, accounts, devices, systems, data categories and date ranges across email, messages, documents, logs, backups and case systems. A hold can pause mailbox cleanup, retention expiry or equipment disposal, but only where the relevant people and technical sources are actually covered.

Record the matter, authority, start date, recipients and applied controls. An instruction asking staff not to delete information may be necessary, but platform administration or records-management action may also be required. Live data can still change unless separate protections address that risk.

Effectiveness must be monitored¶

Document excluded sources, failed controls and any period or category the organisation cannot hold. Review scope when new systems, custodians or dates emerge, and assign responsibility for compliance checks, extensions and eventual release.

Legal, information-governance, records-management and technical specialists should resolve unclear scope. The existence of a hold does not establish that all relevant evidence was located, preserved correctly or made available to an investigator.