The legal hold is the one obligation in this glossary that a company imposes on itself, which is precisely why it gets missed. Nothing arrives in the inbox to trigger it.
When the duty attaches
The duty to preserve begins when litigation is reasonably anticipated, not when it is filed. Events that can trigger it include:
- Receiving a demand letter or a credible threat of suit
- An internal investigation into conduct likely to lead to claims
- Regulatory contact suggesting enforcement is contemplated
- Awareness of an incident whose facts make litigation foreseeable
Because the trigger is a judgement rather than a document, the practical risk is a gap between when the duty attached and when someone acted on it. Deletion continuing during that gap is where spoliation exposure accumulates.
What a hold requires in practice
- Identify custodians and systems likely to hold relevant material.
- Suspend automated deletion for the material in scope. Retention policies that run automatically will otherwise destroy data on schedule.
- Notify custodians clearly, and confirm they understood.
- Monitor and reissue. Holds decay. New custodians join, systems change, and people forget.
- Release deliberately when the matter concludes, with a documented decision.
| Legal hold | Preservation request | |
|---|---|---|
| Who imposes it | The organisation itself | A government agency |
| Trigger | Litigation reasonably anticipated | Receipt of a 2703(f) request |
| Scope defined by | The organisation’s own assessment | The requesting agency |
| Duration | Until the matter concludes | 90 days, renewable once |
| Consequence of failure | Spoliation sanctions | Loss of evidence, non-compliance |
What it means for a data request programme
Legal holds and government preservation requests overlap constantly, and treating them as one process causes problems in both directions. A preservation request has a fixed expiry, and continuing to retain data after it lapses conflicts with data minimisation obligations. A legal hold has no fixed expiry and must persist until the matter resolves. A single “do not delete” flag with no provenance and no end date satisfies neither obligation properly.
The workable pattern is to record, for each hold, what triggered it, what it covers, who imposed it, and what event releases it.