litigation hold (legal hold, preservation order or hold order)

What is a litigation hold (legal hold, preservation order or hold order)?

A litigation hold -- also known as legal hold, preservation order or hold order -- is an internal process that an organization undergoes to preserve all data that might relate to a legal action involving the organization. A litigation hold temporary suspends the normal retention policies applicable to data to ensure that the data is available for the discovery process prior to litigation.

An organization is required by law to preserve all relevant data when it learns of a triggering event, such as a pending or imminent legal action or when litigation is reasonably anticipated, e.g., when a faulty product causes injury. A litigation hold prevents spoliation -- destruction, alteration or mutilation of evidence. Its goal is to ensure that a plaintiff has fair access to any information that might be relevant to the litigation.

A legal hold applies to both hard copies of documents and to electronically stored information (ESI). Hard copies can include logs, notes, forms, bulletins, photographs, appointment books, printed emails and any other type of physical records. ESI can include any relevant electronic data, no matter its format or how it's stored.

The bulk of today's data is stored electronically and can add up to a substantial amount. It might include emails, contact lists, text messages, spreadsheets, presentations, word processing documents, application source files, social media posts, databases or other data stores, video and audio recordings, and anything else that can be electronically stored and is related to the litigation.

An organization's legal team -- whether internal or external -- typically initiates a litigation hold. When the team learns of a triggering event, it sends out a legal hold notification to appropriate custodians, data stewards and other key players. A hold notification usually provides an overview of the situation, describes the recipient's obligations and specifies what data must be preserved. It might include other information, such as who to contact if the recipient has any questions.

The notification itself represents only one in a series of steps taken during the litigation hold process:

1. The legal team becomes aware of a triggering event and immediately launches the litigation hold process.
2. With the help of IT and data stewards, the legal team identifies what data must be preserved and the custodians for that data.
3. The legal team drafts the litigation hold notification and carefully reviews it.
4. The legal team sends the notification to custodians, data stewards and other key players.
5. The recipients acknowledge receipt of the notification.
6. The legal team follows up with any recipients who do not acknowledge receipt of the notification, escalating the issue as necessary.
7. The recipients carry out whatever operations are necessary to protect the data.
8. During the course of the litigation, the legal team sends periodic reminders to custodians to inform them they're still under legal hold.
9. After the legal matter is resolved, the legal team sends a notice to the recipients releasing them of the litigation hold.

The exact approach varies depending on the organization and circumstances. Throughout this process, however, the legal team and other responsible parties need to track and document all steps to ensure a defensible legal hold process in case their approach to data protection, including but not limited to data archiving, is called into question.

If an organization fails to demonstrate a defensible process, it could face stiff penalties and be at a significant legal disadvantage.

Larger organizations often use legal hold software to automate many of these steps, making it easier to notify recipients and track everyone's activity. In addition, some storage systems and data-driven platforms include litigation hold features that can override existing retention and deletion rules, preventing alteration or destruction of the data until the legal action is resolved.

See enterprise content management best practices for deployment and best practices when preparing for an e-discovery request.