A deleted Teams message, an overwritten CCTV file or a departing employee’s wiped handset can alter the course of a case before pleadings are even served. Legal hold practices are the practical controls that prevent that loss. They turn a general duty to preserve potentially relevant material into documented, defensible action – while the evidence still exists.
For solicitors, in-house counsel and investigation teams, the central risk is not simply failing to find data later. It is being unable to explain what was preserved, why particular sources were excluded, who had access, and whether relevant material changed after the dispute became foreseeable. A legal hold must therefore be treated as an evidential process, not an administrative email.
What legal hold practices are designed to achieve
A legal hold, sometimes called a preservation notice, instructs relevant people and custodians to retain information that may be material to an actual or anticipated dispute, investigation or regulatory matter. In a digital context, this can include emails, documents, chats, call records, cloud files, mobile device content, system logs, CCTV, social media data, backups and information held by third parties.
The objective is proportionate preservation. No organisation can realistically freeze every record forever, and indiscriminate collection can create cost, privacy and data-protection difficulties. The task is to identify material that may be relevant, preserve it in a manner that maintains integrity, and keep clear records of the decisions made.
In English and Welsh civil litigation, disclosure obligations and the duty to preserve relevant documents can arise well before formal proceedings begin. The precise scope depends on the facts, the likely claims, the parties involved and the applicable procedural framework. Criminal, employment, matrimonial and internal investigation matters may raise different duties and timelines. That is why a hold should be defined with legal oversight and revisited as the matter develops.
When a legal hold should begin
The trigger is usually reasonable anticipation of a dispute or investigation, rather than the date a claim form arrives. A credible grievance, a threatened injunction, allegations of fraud, signs of insider data theft, a serious cyber incident or correspondence between solicitors may all require preservation to be considered immediately.
Delay is especially hazardous where data is volatile. Messaging platforms may have short retention settings. CCTV routinely overwrites. Endpoint telemetry can disappear within days. A user may replace a phone, reset a device or leave the business with local data stored on a personal laptop. Once a potential issue is identified, ordinary retention policies should not be allowed to destroy relevant material simply because the legal team has not yet finalised its case theory.
Early action does not mean making unsupported accusations or collecting every employee’s private information. It means taking sensible, recorded steps to prevent foreseeable loss while scope is assessed. Where personal devices or private accounts may contain business evidence, the method of preservation requires particular care, clear authority and appropriate advice.
A defensible legal hold process
The best legal hold practices begin with an evidence map. Before issuing instructions, establish the likely allegations, time period, key individuals, business functions, systems and data locations. Speak to IT, information governance, HR, security and the relevant business team. Their input often reveals sources that a questionnaire alone will miss, such as archived mailboxes, shared drives, mobile-device management platforms, cloud collaboration tools, badge-entry records or application audit logs.
Define scope without making it vague
A notice that merely tells staff to retain “anything relevant” is difficult to follow and harder to defend. It should identify the subject matter, likely date range, relevant categories of information, known systems, named custodians and any immediate restrictions on deletion, alteration or disposal.
At the same time, scope should not become falsely precise. New facts may reveal that a former contractor, a different project team or an overlooked data source is material. Record the initial rationale, then update the hold when evidence justifies expansion or narrowing. A defensible process shows considered judgement, not perfect foresight.
Suspend routine deletion where necessary
Many preservation failures are automated. Email retention rules, backup rotation, deletion scripts, cloud lifecycle policies and messaging settings can remove material without any human decision. The hold process must identify which controls need suspension and whether this can be done for selected users, folders, sites or data classes rather than across the entire organisation.
IT should confirm the technical action taken, its effective date and any limitations. A backup is not automatically a preservation solution. It may be inaccessible, short-lived, incomplete, difficult to search or unsuitable for restoring individual records without affecting other data. The question is whether the relevant information can be reliably retained and later retrieved.
Obtain acknowledgement and follow up
Custodians should receive instructions in plain, unambiguous language. They need to understand that preservation includes material outside formal corporate systems where it is used for the relevant business or communications, subject to the lawful and proportionate scope of the hold.
Require written acknowledgement, provide a point of contact for questions and chase non-responses. A person who does not understand that WhatsApp messages, downloaded files or personal cloud synchronisation may be relevant can unintentionally cause irrecoverable loss. Follow-up is not bureaucracy. It provides an auditable record that instructions were delivered, understood and acted upon.
Preserve first, collect with forensic control
Preservation and collection are related but different. A hold stops routine destruction; collection acquires information for review, analysis or disclosure. Where there is a risk of deletion, tampering or disputed authenticity, preservation should be followed quickly by a controlled forensic acquisition.
Forensic collection methods aim to capture data without altering the source unnecessarily and to document the process in sufficient detail for independent scrutiny. This may involve recording device condition, serial numbers, account identifiers, timestamps, hash values, acquisition tools, operator actions and storage arrangements. The appropriate method depends on the device, operating system, encryption, cloud access and urgency.
An employee’s smartphone illustrates the trade-off. Asking them to forward selected screenshots may be quick, but it can omit metadata, surrounding context and deleted content. Taking physical possession may better protect evidence, yet it can disrupt work and raise privacy concerns. A proportionate forensic approach should preserve what is necessary, minimise avoidable intrusion and maintain a clear chain of custody from source to report.
Keep a hold register that can withstand scrutiny
A legal hold is not complete when the first notice is issued. It needs active management. A hold register should show the matter reference, reason for the hold, date triggered, responsible legal owner, custodians, systems, preservation actions, acknowledgements, collection status, exceptions, reviews and release decision.
The register also records difficult choices. If a legacy system cannot be preserved in its native form, document what was available, the technical constraint, the alternative measure taken and who approved it. If a device could not be accessed because of encryption, record that fact rather than allowing a gap to remain unexplained.
This documentation matters when the other side, a regulator or a court asks whether relevant evidence has been lost. A candid, contemporaneous account of proportionate steps is far more credible than retrospective reconstruction after a problem emerges.
Common failures that weaken evidence
The most damaging failures are often procedural rather than technical. They include issuing a notice too late, failing to include IT in the process, overlooking mobile and cloud data, relying on informal screenshots, allowing departing staff to keep or wipe devices, and never reviewing whether the hold remains fit for purpose.
Another frequent error is treating the hold as confidential to the legal department. Legal teams must retain control of scope and strategy, but preservation depends on operational cooperation. IT may know about retention schedules. HR may know of an imminent departure. Security may hold logs that are due to expire. Procurement may identify a SaaS supplier holding relevant records. Each group needs only the information necessary to perform its role, but each may be essential.
Releasing a hold responsibly
A hold should remain in place until the underlying risk has ended, not until the first document review is finished. Consider whether proceedings, appeals, investigations, limitation issues, contractual obligations or related claims remain live. Legal advice should guide the release decision.
When release is authorised, document it and tell custodians what has changed. Normal retention rules may then resume, but do not assume deleted information will disappear instantly or that preserved copies should be retained indefinitely. Retaining excessive personal data without purpose can create a separate governance problem.
Where digital evidence may be contested, early forensic input can make the difference between a manageable disclosure exercise and an argument about what can no longer be proved. The most effective hold is not the longest notice or the largest collection. It is the one that preserves the right material, records every material decision and leaves the facts capable of being tested fairly.