Skip to main content
Digital Compliance Bureau
Promotional banner for the pentest readiness checklist
Category: Data Governance

Legal Hold

Also known as: Litigation Hold
Simply put

A legal hold is a process an organization uses to preserve information that could be relevant to a lawsuit or investigation, so that it is not deleted or altered. It generally applies when litigation is pending or can be reasonably anticipated, and it can cover both electronic data and physical records. In practice, it is often triggered by a directive from an organization or, in some cases, a court.

Formal definition

A legal hold, also referred to as a litigation hold, is the formal process by which an organization preserves potentially relevant information—including electronically stored information (ESI) and physical evidence—when litigation is pending or reasonably anticipated, or when an investigation arises. It typically involves issuing a directive to suspend routine data destruction or retention policies for affected records and custodians. The obligation is generally driven by the point at which litigation becomes reasonably foreseeable, though the precise triggering standard, scope, and procedural requirements depend on the governing jurisdiction, forum, and applicable rules of procedure. Readers should note that specific duties, timing, and consequences for failure to preserve are fact-specific and should be verified against current authoritative legal sources and professional judgment; this entry does not address remedies or sanctions for non-compliance.

Why it matters

A legal hold is the mechanism that stands between routine data management and the loss of evidence an organization may later be obligated to produce. Because most organizations run automated retention and deletion policies—email purges, backup rotation, document lifecycle rules—information that is potentially relevant to a dispute can be destroyed in the ordinary course of business unless those processes are deliberately suspended. When litigation is pending or reasonably anticipated, the duty to preserve generally attaches, and a legal hold is the operational step that gives effect to that duty across affected records and custodians.

The stakes are practical as well as procedural. Failure to preserve information that should have been held can expose an organization to consequences within the litigation or investigation, and it can undermine the credibility of a party's broader records-management posture. The precise standard for when preservation is triggered, how broadly a hold must reach, and what follows from a failure to act varies by jurisdiction, forum, and the applicable rules of procedure. This entry does not address remedies or sanctions for non-compliance; those questions are fact-specific and should be evaluated against current authoritative legal sources.

Because the obligation typically turns on when litigation becomes reasonably foreseeable rather than when a complaint is filed, organizations often need to act before formal proceedings begin. That timing sensitivity is what makes the legal hold a governance concern and not merely a legal one—coordination between legal, IT, and records teams is generally required for the hold to be effective in practice.

Who it's relevant to

Legal counsel and litigation teams
In-house and outside counsel are generally responsible for determining when the duty to preserve attaches and for defining the scope of a hold. They translate the point at which litigation becomes reasonably foreseeable into a concrete preservation directive covering the relevant custodians and record types.
IT and information governance teams
These teams operationalize the hold by suspending automated retention and deletion processes for affected electronically stored information and by ensuring that backups and systems retain the relevant data. Their coordination with legal is generally what makes a hold effective rather than merely nominal.
Records and data custodians
Individuals who hold or control potentially relevant information—both electronic and physical—are the direct subjects of a preservation directive. They are typically instructed not to delete or alter material within the scope of the hold until it is released.
Compliance and eDiscovery professionals
Those managing information governance and eDiscovery programs rely on legal holds as a foundational control for defensible preservation. They help ensure holds are documented, tracked, and released appropriately, and that the process aligns with the organization's broader records-management practices.

Inside Legal Hold

Preservation Obligation
The core duty to retain potentially relevant information once litigation or an investigation is reasonably anticipated. This duty generally arises before formal proceedings begin and suspends routine deletion or destruction processes for the affected data.
Trigger Event
The circumstance that gives rise to the preservation duty, such as receipt of a complaint, a demand letter, a regulatory inquiry, or credible knowledge that a dispute is likely. Identifying the trigger is fact-specific, and reasonable anticipation is judged on the circumstances rather than a fixed rule.
Scope of Preserved Material
The categories of information and custodians covered by the hold, which may include emails, documents, structured data, and other electronically stored information. Scope should be proportionate to the matter and refined as the issues become clearer.
Hold Notice
The communication issued to relevant custodians and IT personnel instructing them to preserve identified material and to refrain from altering or deleting it. The notice typically explains what to keep and may require acknowledgment.
Suspension of Routine Disposal
The interruption of standard retention schedules and automated purge routines for data within scope, so that ordinary information lifecycle processes do not destroy material subject to the hold.
Monitoring and Release
Ongoing oversight to confirm the hold is followed, periodic reassessment of scope, and eventual formal release of the hold once the preservation duty ends. Release should be documented as clearly as issuance.

Common questions

Answers to the questions practitioners most commonly ask about Legal Hold.

Is a legal hold the same as a document retention policy?
No. A document retention policy governs the routine lifecycle of records, including scheduled deletion and archiving, in the ordinary course of business. A legal hold is a distinct, event-driven measure that suspends those routine processes for specific information once litigation or an investigation is reasonably anticipated. The two operate independently: a hold overrides normal retention and disposition schedules for the material it covers, but it does not replace the underlying retention policy for information not subject to the hold. Treating the two as interchangeable can lead either to premature deletion of relevant material or to indefinite over-retention.
Does a legal hold only apply once a lawsuit has actually been filed?
Not necessarily. The obligation to preserve information generally arises when litigation or an investigation is reasonably anticipated, which can precede the actual filing of a complaint. The precise trigger is fact-specific and depends on the circumstances and the applicable jurisdiction's standards. Waiting until a suit is formally filed may leave a gap during which relevant information could be lost through routine processes. Because the timing of the duty to preserve is a matter of legal judgment, organizations typically assess the trigger point in consultation with counsel rather than relying on a bright-line filing date.
Who within an organization should typically receive a legal hold notice?
A legal hold notice is generally directed to custodians and individuals who are likely to possess or control information relevant to the matter, as well as personnel responsible for the systems where such information resides, such as IT or records management staff. The scope of recipients depends on the subject matter of the anticipated dispute and where relevant data may be stored. Identifying the appropriate custodians usually involves coordination between legal, IT, and the relevant business units, and application to any specific matter requires professional judgment.
How should the issuance and acknowledgment of a legal hold be documented?
Documentation practices commonly include recording when the hold was issued, to whom it was distributed, the scope of information covered, and confirmation that recipients received and understood the notice. Maintaining a record of acknowledgments and any follow-up reminders can help demonstrate that reasonable preservation steps were taken if the adequacy of the hold is later questioned. Specific documentation expectations may vary by jurisdiction and by the forum in which a matter is heard, so organizations generally align their practices with applicable procedural rules and with counsel's advice.
What steps are typically involved in enforcing a legal hold across data systems?
Enforcement generally involves suspending automated deletion, rotation, or archiving processes that would otherwise affect the covered information, and coordinating with those who administer relevant systems such as email, file storage, and collaboration platforms. Because information may reside across multiple locations and in the hands of third parties, effective enforcement often requires mapping where relevant data lives before applying preservation measures. The technical means available depend on the systems in use, and the sufficiency of any approach is fact-specific.
When and how should a legal hold be released?
A legal hold is typically released once the matter that gave rise to it has concluded and the duty to preserve no longer applies, a determination generally made in consultation with counsel. Release is usually communicated formally to affected custodians so that the information can return to normal retention and disposition processes. Lifting a hold prematurely can create risk if a preservation obligation still exists, while leaving holds in place indefinitely can result in unnecessary over-retention. Documenting the release, like the issuance, supports a defensible record of the organization's preservation decisions.

Common misconceptions

A legal hold is only required once a lawsuit has been formally filed.
The duty to preserve generally arises when litigation or an investigation is reasonably anticipated, which can precede any formal filing. Waiting for a served complaint may mean relevant information has already been lost through routine processes.
A legal hold and a data retention schedule are the same thing.
They are distinct and can conflict. A retention schedule governs routine, time-based disposal of records, whereas a legal hold overrides that schedule for specific material by suspending deletion. When a hold applies, it takes precedence over the ordinary disposal that a retention policy would otherwise permit.
Issuing the hold notice completes the obligation.
Preservation is an ongoing duty, not a single event. It generally requires monitoring compliance, reassessing scope as the matter develops, reminding custodians, and formally releasing the hold when it ends. A notice that is issued and then ignored may not satisfy the underlying obligation.

Best practices

Document the trigger event and the reasoning behind when preservation was deemed reasonably anticipated, so the basis for the hold's timing can be demonstrated later.
Identify custodians and data sources deliberately, and refine scope as the issues become clearer rather than defaulting to over- or under-preservation.
Issue clear written hold notices that specify what must be preserved, and obtain acknowledgment from recipients where practicable.
Coordinate with IT to suspend automated deletion and routine retention processes for in-scope data, confirming that the suspension is actually effective.
Monitor and periodically reissue reminders throughout the life of the hold, reassessing scope as the matter evolves.
Formally document the release of the hold when the preservation duty ends, and note that specific obligations vary by jurisdiction and matter, so verify requirements against current authoritative sources and seek professional judgment for particular circumstances.
Green background, the words "The Biggest AI Security Risk Isn’t the Model. It’s the Agent." A robot drawing. A button for "Get the Free Guide."