What is a legal hold?

Once an organization reasonably anticipates litigation, it has a legal duty to preserve relevant evidence. A legal hold is the mechanism used to meet that duty. It tells specific people — called custodians — which information to keep, for what time period, and that routine deletion must stop until further notice.

The terms legal hold, litigation hold, preservation hold, and preservation notice are used interchangeably. "Legal hold" is often preferred because the same obligation can arise from government investigations, regulatory inquiries, and audits, not only lawsuits.

The duty to preserve begins when litigation is reasonably anticipated, which is often well before a complaint is filed. Common trigger events include:

• A demand letter or a preservation letter from opposing counsel
• A subpoena, civil investigative demand, or regulatory inquiry
• A credible threat of a lawsuit by a customer, employee, or vendor
• An internal complaint, whistleblower report, or serious incident
• A decision by the organization itself to bring a claim

Record the date the duty arose and the reasoning behind it. If preservation is ever challenged, that record shows the hold was issued promptly.

A hold covers every custodian with possession, custody, or control of potentially relevant information: people directly involved in the events, their managers and assistants, and the IT or records staff who administer relevant systems. Former employees, contractors, and third parties holding data on your behalf may also need to be addressed.

The information in scope is format-neutral. Email, chat and collaboration tools, text messages, documents on laptops and shared drives, databases, cloud applications, voicemail, and paper records can all be subject to a hold.

An effective legal hold notice is short, specific, and readable. It should:

• Identify the matter in plain language without disclosing privileged strategy
• Describe the subject matter and relevant date range
• List the categories and locations of information to preserve
• State clearly that deletion, alteration, or disposal must stop
• Explain that the hold overrides normal retention policies
• Ask the recipient to acknowledge the hold
• Name a contact for questions

A defensible legal hold is a process, not a single email. Most programs follow these steps:

1. 1Identify the trigger. Determine the date litigation became reasonably anticipated and document why.
2. 2Define scope. Decide the subject matter, date range, data types, and systems that must be preserved.
3. 3Identify custodians. List every person and system that holds potentially relevant information, including IT and records staff.
4. 4Issue the notice. Send a clear, written legal hold notice to each custodian and suspend automatic deletion where needed.
5. 5Collect acknowledgments. Require each custodian to confirm they received, understood, and will comply with the hold.
6. 6Interview custodians. Ask where relevant data lives so nothing is missed, and add newly identified people or sources.
7. 7Remind and monitor. Send periodic reminders, track new hires and departures, and update scope as the matter evolves.
8. 8Release the hold. When the matter is fully resolved, formally release the hold and tell custodians normal retention can resume.

Losing information that should have been preserved is called spoliation. Courts can respond with monetary sanctions, orders allowing the other side to present evidence of the loss, adverse-inference instructions that let a jury assume the missing information was unfavorable, and in serious cases dismissal or default judgment.

In U.S. federal courts, Federal Rule of Civil Procedure 37(e) addresses electronically stored information that is lost because a party failed to take reasonable steps to preserve it. The most severe remedies under the rule generally require a finding of intent to deprive the other party of the information — but a documented, timely hold process is what demonstrates those reasonable steps in the first place.

• Write notices in plain language, not legalese — custodians must understand what to keep.
• Act quickly. Delay between the trigger and the notice is the most common preservation gap.
• Suspend auto-delete policies on email, chat, and file systems for in-scope custodians.
• Keep a single record of every notice, acknowledgment, reminder, and interview response.
• Escalate non-responses to managers or counsel rather than letting them sit.
• Coordinate with IT before employees leave so their data is preserved, not wiped.
• Release holds promptly when matters close to avoid the cost of over-retention.

Have more questions? Our Legal Hold FAQ covers custodians, acknowledgments, releases, and more.