Legal Hold Notice: Preserve Data Without Reorganizing the Evidence

Legal Hold Notice: Preserve Data Without Reorganizing the Evidence

Quick answer

If you receive a legal hold, read it promptly, acknowledge it through the authorized channel, stop routine deletion for the covered information, and ask counsel what people, dates, devices, accounts, formats, and physical records are included. Preserve originals and metadata. Do not rename, edit, forward, export, deduplicate, wipe, replace, or personally investigate data unless the hold team instructs you. Tell counsel immediately about disappearing messages, automatic deletion, backups, personal devices, former staff, or inaccessible systems.

Employee Justice Legal Group PC / employee justice legal group pc

Los AngelesLos Angeles CountyCalifornia

1001 Wilshire Blvd 2nd Floor, Los Angeles, CA 90017, USA

Why it matters

A legal hold is a preservation process used when information may be relevant to pending or reasonably anticipated litigation or investigation. Ordinary retention settings and collaboration tools can delete or alter evidence unless coordinated steps suspend them.

This United States article is general information, not legal advice. Duties, scope, privilege, privacy, employment rules, regulator demands, and sanctions depend on the matter and jurisdiction. Follow counsel and approved IT or e-discovery procedures.

Braden & Tucci / braden and tucci

Los AngelesLos Angeles CountyCalifornia

811 Wilshire Blvd 17th Floor, Los Angeles, CA 90017, USA

Practical checklist

• Read the notice and identify the counsel or hold coordinator.
• Acknowledge receipt without discussing the matter broadly.
• Stop covered deletion, shredding, overwriting, auto-expiration, and device replacement.
• List work and personal devices, email, chat, cloud, files, paper, removable media, and third-party systems that may contain covered information.
• Preserve native files and metadata rather than making only screenshots or printouts.
• Report inaccessible, damaged, encrypted, shared, or departing-user sources.
• Ask before collecting, searching, copying, or sending data.

Step-by-step plan

1. Contact the hold coordinator with scope questions and do not guess at key terms.
2. Identify custodians, repositories, retention schedules, automatic deletion, ephemeral messaging, backups, and physical locations.
3. Coordinate with authorized IT so changes are documented and targeted systems are preserved without disrupting unrelated data unnecessarily.
4. Leave relevant files in their original structure unless the collection plan directs otherwise.
5. Document actions, dates, systems, exceptions, and confirmations without adding commentary to evidence.
6. Report new sources, role changes, device loss, account closure, or technical failure as the matter evolves.
7. Maintain the hold until counsel gives written release or modification; normal retention does not resume automatically.

Keep the notice, acknowledgments, scope clarifications, custodian and system inventory, retention changes, collection logs, exceptions, device transfers, departure checklists, periodic reminders, and written release.

Limits and warning signs

Copying everything to a folder may alter metadata or omit cloud and deleted-state information. A backup is not automatically a searchable archive. Preservation does not authorize reading privileged or private material beyond role and counsel instructions.

Notify counsel immediately about suspected deletion, lost devices, expiring accounts, ransomware, system migration, departing custodians, or inability to suspend a relevant process. Do not conceal or independently remediate a preservation failure.

Frequently asked questions

Can I clean up duplicate files?

Not without direction. Deduplication, renaming, or reorganization can alter context and metadata.

Do personal phones count?

They may when used for relevant business or communications. Tell counsel; do not self-collect unless instructed.

Can disappearing messages stay enabled?

Report them immediately. DOJ and FTC guidance emphasizes preservation obligations for ephemeral collaboration tools.

When does the hold end?

Only when authorized counsel gives written release or modification; a case event or employee departure alone is not enough.

Sources and evidence

U.S. Department of Justice guidance describes written notice, custodian confirmation, IT coordination, preservation of native ESI and metadata, suspension of routine destruction, documentation of preservation efforts, and attention to ephemeral messaging.

Conclusion and next steps

Acknowledge the hold, stop covered deletion, and send counsel a source inventory with any automatic or disappearing-data risks. Make no collection or cleanup changes until the authorized preservation plan assigns them.