When should a provider preservation request be considered?¶

A provider preservation request should be considered when relevant account, transaction, device or access records may be lost before the formal process for obtaining them is complete.

Avoid the dangerous assumption¶

The dangerous assumption is that preservation automatically discloses the records or that every provider retains everything once contacted informally.

Preservation is about asking a provider to retain specified existing data for a defined account, identifier and period.

It is not the same as legal production, disclosure or unrestricted access.

Consider preservation where the account is central, the data is volatile, the provider is overseas, formal authority may take time or the user may delete or alter the account.

Relevant categories may include account details, transactions, devices, sessions, IP addresses, authentication events, security changes, messages, payment links, wallet addresses and support contacts.

The request should be precise.

Include known identifiers, the relevant date range, timezone, transaction references and the categories requiring preservation.

Do not ask vaguely for “everything” where the provider cannot identify the account or scope.

Use the correct organisational, legal and provider process.

Do not assume an acknowledgement means every requested category has been preserved.

Record when the request was sent, what it covered, who sent it and any response or expiry date.

A later lawful request will still be needed to obtain the material.

When reporting, distinguish preservation from acquisition and explain any limits.

Operational takeaway¶

Consider prompt, precise preservation where provider-held evidence may expire or change before formal acquisition, and record the identifiers, categories, date range and provider response clearly.