A disputed WhatsApp message can disappear under an auto-delete setting. A departing employee can reset a phone. A cloud retention rule can remove a mailbox before anyone has identified its relevance. In each case, litigation hold notices are the practical instruction that turns a vague duty to preserve evidence into controlled, auditable action.
For solicitors, in-house counsel and investigators, the issue is not simply whether a notice was sent. The question, often asked later and under pressure, is whether the organisation identified the right custodians and systems, stopped routine destruction in time, preserved data proportionately, and can prove what it did. A poorly scoped or poorly enforced hold can damage a party’s position before the underlying documents have even been reviewed.
What a litigation hold notice is
A litigation hold notice, sometimes called a legal hold or preservation notice, directs named people and relevant teams not to alter, delete, overwrite, dispose of or otherwise interfere with potentially relevant information. In a digital context, that can include emails, chat messages, call logs, files, audit trails, cloud data, device contents, CCTV recordings, backup material and social-media content.
The notice should be issued when litigation is underway or reasonably anticipated, and it should be reviewed as the matter develops. The precise legal duty, scope and timing will depend on the forum, the issues in dispute and the advice of the legal team. What does not vary is the operational risk: routine business processes continue unless somebody stops or manages them.
A hold is not a request to retain everything indefinitely. Nor is it a substitute for disclosure analysis. It is a targeted preservation measure designed to prevent loss while the parties establish what evidence may matter.
When preservation must begin
The most dangerous period is often the gap between an incident and formal proceedings. A complaint about suspected data theft, an allegation of misconduct, a threatened claim, a pre-action letter, a regulatory enquiry or an internal investigation may all require prompt consideration of preservation. Waiting for a claim form, police interview or disclosure order can be too late.
The trigger is fact-specific. A speculative concern may not justify an enterprise-wide hold, while credible indications of a serious dispute may require immediate action across several custodians and systems. Legal advisers should assess the position, but technical teams need clear instructions without delay.
Early action is particularly necessary where data is volatile. Messaging platforms may apply retention periods. Cloud collaboration tools retain versions differently from locally stored files. Mobile devices can be remotely wiped, upgraded or replaced. Security logs may roll over within days or weeks. A sound preservation decision therefore starts with a rapid map of where relevant material is likely to exist and how quickly it could change.
What effective litigation hold notices should contain
Recipients must be able to understand precisely what they are expected to do. Dense legal wording that never explains the practical steps will not preserve evidence. Equally, a vague instruction to keep all records can create confusion, unnecessary data retention and poor compliance.
A defensible notice normally addresses at least the following:
- the matter or investigation, described at a level appropriate to confidentiality;
- the relevant date range, people, events, projects and categories of information;
- the locations and devices that may contain material, including personal devices where applicable;
- the actions prohibited, such as deletion, editing, overwriting, factory resetting or replacing devices; and
- the route for questions, acknowledgement and reporting any lost, changed or inaccessible material.
The language should distinguish between preserving information and sharing it. Custodians should not forward potentially sensitive data to personal accounts, copy it casually to USB media or conduct their own informal searches. Those actions can create further versions, compromise confidentiality and make provenance harder to explain.
Where employees use personal phones or private cloud accounts for business communications, the notice must address that reality carefully. The organisation may have preservation needs, but collection and review must be lawful, proportionate and properly authorised. Employment terms, data protection obligations, privacy rights and the nature of the dispute all affect the appropriate approach.
Tailor notices to the recipient
A finance director, IT administrator and sales employee do not hold information in the same way. A standard core notice can be useful, but it should be supplemented with practical, role-specific direction. For example, an IT team may need to suspend mailbox deletion, preserve shared-drive permissions and record backup cycles. A custodian may need instructions not to change handset settings, delete chats or surrender a device to a third party without first notifying the legal team.
This tailoring is not administrative polish. It is the difference between a notice that can be followed and one that is merely filed.
Issuing the notice is only the start
A notice that sits unopened in an inbox is not an effective control. The issuing party should record who received it, when it was issued, whether it was acknowledged and what follow-up took place. Non-responders should be chased. Custodians with high-value or high-risk data may need a direct discussion, particularly where they are leaving the business, are on leave, or are involved in the allegations.
Preservation also requires technical action. Disabling deletion rules, suspending disposal schedules, retaining relevant backup sets and securing access to key devices may be necessary. These measures should be recorded alongside the legal hold process, including the person responsible, the date of action and any known limitations.
A hold should be revisited at sensible intervals and whenever the facts change. New allegations may identify additional custodians. Initial forensic work may reveal a private email account, removable media or an undeclared messaging application. Conversely, a refined understanding of the dispute may permit the hold to be narrowed. Over-preservation has costs: storage, privacy exposure, review burden and operational disruption. Proportionality remains relevant throughout.
Preserving digital evidence without changing it
There is a critical distinction between preservation and collection. Asking a custodian to leave a device untouched may prevent immediate loss, but it does not create a forensic record of its state. Where authenticity, deletion, attribution or timeline evidence may be disputed, an appropriately qualified forensic examination can be needed.
A forensic practitioner can document the device condition, acquisition method, identifiers, relevant software and handling history. Depending on the device and circumstances, they may create a forensic image or undertake a targeted extraction. The objective is to recover and preserve information while maintaining evidential integrity and a clear chain of custody.
This is particularly relevant in cases involving alleged insider activity, deleted communications, harassment, intellectual property disputes, fraud or cyber incidents. Ordinary IT handling can alter timestamps, trigger synchronisation, overwrite volatile data or fail to capture material held within applications. The correct approach depends on the device, operating system, account access, urgency and evidential question. There is no single collection method that is suitable for every matter.
Computer Forensics Lab supports legal teams with preservation, forensic acquisition and reporting designed to withstand scrutiny. Early specialist input can help define what should be secured before routine processes or well-meaning internal action change the evidential picture.
Common failures that create avoidable risk
The most frequent failure is delay. A team may recognise that a dispute is serious but spend days agreeing wording while retention rules continue to operate. A short, controlled initial notice can be refined once the scope is clearer.
Another failure is treating the exercise as solely legal or solely technical. Legal teams define relevance and proportionality; IT teams understand systems, retention and access; HR may know who is leaving or subject to restrictions; information security may control logs and incident records. The process needs a named owner and documented co-ordination.
Finally, do not assume an acknowledgement proves compliance. A custodian may not understand that deleting a message from a phone can also affect linked cloud content, or that replacing a handset can remove locally held evidence. Clear instructions, follow-up questions and, where warranted, forensic preservation provide far stronger assurance.
A hold process that can be defended
If a preservation decision is later challenged, the organisation should be able to show its reasoning without reconstructing events from memory. Keep a contemporaneous record of the anticipated dispute, the sources considered, the custodians selected, the notices issued, acknowledgements received, technical safeguards applied, follow-up activity and changes to scope.
That record does not need to disclose privileged advice. It should, however, demonstrate disciplined action. Gaps should be recorded candidly too. If a handset had already been replaced, a mailbox was beyond its retention period, or a custodian could not be contacted, document what happened and what alternative sources were considered. A transparent explanation is more defensible than an unexplained omission.
When the immediate pressure of a dispute begins, preserve first, investigate carefully and keep the record of every decision. Evidence that is protected early can still be assessed, challenged and tested fairly. Evidence that has been deleted or altered may never be recovered at all.