Legal holds are formal directives requiring a person or organization to preserve information that could be relevant to a lawsuit or investigation. The obligation attaches the moment a reasonable person would foresee litigation, well before any complaint is filed, and it reaches every format the data lives in: paper files, emails, text messages, chat platforms, cloud accounts, and even disappearing messages on apps like Signal. Mishandling one can produce court sanctions severe enough to decide a case before trial.
When the Duty to Preserve Begins
The preservation duty does not wait for a process server. It begins at the point of “reasonable anticipation of litigation,” an objective standard that asks whether a reasonable person in the same situation would foresee a legal dispute. A filed lawsuit is the clearest trigger, but the duty almost always arises earlier.
Common triggers include a demand letter from opposing counsel, notice of a government investigation, or a credible threat of legal action from an employee or business partner. A serious workplace accident, a product failure that injures someone, or a data breach affecting customer information can start the clock on its own. Even informal events count. A group of supervisors discussing reported harassment can create the obligation if the conversation makes litigation foreseeable.
Internal investigations deserve particular attention. An HR complaint that moves past intake into formal review, or an audit that uncovers financial irregularities, can shift a company from “something may have happened” to “a lawsuit is plausible.” Waiting for outside counsel to flag the issue is a common mistake. The standard is what a reasonable person would anticipate, not what a legal department formally declares.
What a Legal Hold Covers
Scope is driven by the subject matter of the anticipated dispute, not by where the data lives or what format it is in. If information is potentially relevant to the legal issue, it must be preserved, whether it sits on a company server, a personal phone, or a cloud platform.
Electronically Stored Information
“Electronically stored information” (ESI) is deliberately broad. It covers emails, text messages, chat logs from platforms like Slack and Microsoft Teams, voicemails, calendar entries, social media posts, spreadsheets, databases, and files stored on local drives, network servers, or cloud services. Paper documents, handwritten notes, and photographs are covered too, but most preservation fights happen over ESI because digital data is so easy to lose or destroy without anyone noticing.
Disappearing and Ephemeral Messages
Self-deleting messages on platforms like Signal, Snapchat, or vanish-mode features in various chat apps do not get a pass. The DOJ and FTC updated their preservation guidance in 2024 to make this explicit: companies under investigation must preserve data from ephemeral messaging applications, and the agencies treat the use of disappearing-message features during an investigation as potential evidence of obstruction.1U.S. Department of Justice. Justice Department and the FTC Update Guidance That Reinforces Parties Preservation Obligations for Collaboration Tools and Ephemeral Messaging The FTC has stated that its preservation responsibility applies to all collaboration tools, “even including tools that allow for messages to disappear,” and that noncompliance may result in obstruction of justice charges or civil spoliation sanctions.2Federal Trade Commission. FTC and DOJ Update Guidance That Reinforces Parties Preservation Obligations for Collaboration Tools and Ephemeral Messaging If litigation is reasonably anticipated, auto-delete features need to be turned off immediately.
Metadata
Metadata, the behind-the-scenes information attached to a file like when it was created, who edited it, and what changed, is also part of the preservation obligation. Converting a spreadsheet to a PDF strips out formulas and edit history. Printing emails to paper destroys header routing data. These seemingly innocent actions can trigger spoliation claims if the metadata was relevant. The safest approach is to keep files in their original format until counsel clears a different method.
Personal Devices and Cloud Accounts
If employees use personal phones, tablets, or home computers for work, those devices can fall within the scope of a hold. Courts have held that an employee’s use of a personal device does not excuse a company from searching for and preserving work-related data on it. Organizations with bring-your-own-device policies need to address upfront who owns the data on personal devices, which communication methods are permitted for work, and how privacy concerns will be handled when a hold requires access to an employee’s personal phone.
What a Legal Hold Notice Should Include
A legal hold notice is the written communication that puts custodians, the people who hold relevant data, on notice of their preservation obligations. A vague or incomplete notice is almost as bad as none at all because it gives custodians room to miss something critical.
An effective notice typically includes:
- A description of the dispute, with enough context for custodians to understand what is relevant, without revealing privileged strategy.
- What must be preserved, described by category and broadly enough to capture everything relevant. “All emails, text messages, documents, and other files related to [subject]” is a starting point, not a ceiling.
- The relevant time period for which data must be preserved.
- An explicit instruction to suspend routine data destruction, including automated email purges, backup tape recycling, and manual cleanup.
- A reminder that relevant data may exist on work computers, personal devices, home networks, cloud accounts, and external drives.
- A named contact person (a lawyer or IT lead) for questions.
- An acknowledgment requirement so custodians confirm in writing that they received and understood the notice.
The notice should come from someone with recognizable authority (general counsel, an executive, or the legal department) rather than an unfamiliar name in an email that might be ignored. The obligation is ongoing. Custodians must preserve new documents and communications falling within the hold’s scope as they are created, not only what existed when the notice went out.
What to Do When You Receive a Legal Hold
If you are named as a custodian, the core obligation is simple: stop destroying anything that could be relevant. Suspend auto-delete settings immediately, pause any cleanup of old files, and hold off on wiping or repurposing devices that might contain relevant data.
Beyond that initial freeze, identify where relevant information lives: email accounts, hard drives, cloud storage, personal devices, paper files. Keep it secure. In many organizations, IT will step in to apply technical holds to email accounts, image hard drives, or lock down specific folders. A standard file copy will not capture deleted data or system-level metadata the way a forensic image does, which is why forensic imaging is sometimes used when the stakes are high or there is reason to think relevant files were previously deleted.
Document everything you do to comply. If the hold is ever challenged, the organization will need to show a court exactly what steps were taken, when, and by whom. That paper trail is often the difference between a judge accepting an inadvertent loss and imposing sanctions.
Holds can last for years, and memory fades. The legal department should reissue the notice periodically to remind custodians of ongoing obligations, especially when new information expands the scope or when personnel changes bring new custodians into the picture. Following up with anyone who has not acknowledged the notice is not optional. A custodian who claims never to have seen the hold is a problem better caught early than discovered during a sanctions hearing.
What Happens If Evidence Is Lost or Destroyed
Destroying or altering evidence that should have been preserved is called spoliation, and courts take it seriously. Federal Rule of Civil Procedure 37(e) provides the framework courts use when ESI that should have been preserved is lost because a party failed to take reasonable steps to keep it.3Cornell Law School / Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions The rule creates a two-tier system that turns on the spoliating party’s state of mind.
When the Loss Was Negligent
If ESI was lost because a party failed to take reasonable preservation steps and the loss prejudices the other side, a court can order measures “no greater than necessary to cure the prejudice.”3Cornell Law School / Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions That often means paying the other side’s attorneys’ fees for the extra work caused by the loss, reopening discovery on affected issues, or allowing additional depositions. These are not trivial costs, but they are designed to fix the harm rather than punish the party.
When the Destruction Was Intentional
The severe sanctions are reserved for parties who acted with the intent to deprive the other side of evidence. Only when a court makes that finding can it presume the lost information was unfavorable to the spoliating party, instruct the jury to draw that same conclusion, dismiss the case, or enter a default judgment.3Cornell Law School / Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions An adverse inference instruction, where the judge tells the jury it can assume destroyed evidence would have been bad for the party that destroyed it, is the most common severe sanction, appearing in roughly 44% of all federal spoliation cases where sanctions were ordered and 57% of cases specifically involving ESI.4Federal Judicial Center. Motions for Sanctions Based Upon Spoliation of Evidence in Civil Cases
Case-terminating sanctions (dismissal or default judgment) are rare. The Federal Judicial Center identified only about 20 reported federal cases involving case-terminating sanctions for ESI spoliation.4Federal Judicial Center. Motions for Sanctions Based Upon Spoliation of Evidence in Civil Cases Rare does not mean impossible. When a party’s behavior is egregious enough, such as deliberately deleting files after being told to preserve them, courts will end the case outright.
The “Reasonable Steps” Standard
Rule 37(e) offers a form of protection. If a party took reasonable steps to preserve ESI and the information was still lost, the severe sanctions under subsection (e)(2) are off the table.3Cornell Law School / Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery; Sanctions “Reasonable steps” does not mean perfection. It means the organization issued timely hold notices, identified the right custodians, suspended auto-deletion policies, followed up with people who did not respond, and documented what it did. A good-faith effort that still misses some data is far more defensible than a sloppy process that happened to preserve everything.
Beyond court sanctions, employees who ignore a hold or intentionally destroy evidence often face internal discipline up to and including termination. In government investigations, the stakes are higher: both the DOJ and FTC have signaled that failure to preserve documents covered by an investigation can lead to obstruction of justice charges.2Federal Trade Commission. FTC and DOJ Update Guidance That Reinforces Parties Preservation Obligations for Collaboration Tools and Ephemeral Messaging
When a Legal Hold Ends
A hold does not last forever, but it lasts longer than most people expect. It stays in effect until the underlying legal matter is fully resolved: a final settlement, a court judgment with all appeal periods expired, or the closure of a government investigation. Reaching a verdict at trial is not enough if either side might appeal.
Releasing a hold is deliberate, not automatic. The legal department should issue a formal release notice identifying the specific matter and telling custodians they can resume normal data management for that hold. The release applies only to the dispute named in the original notice. If a custodian is subject to multiple active holds, releasing one does not release the others, and before deleting anything custodians need to confirm the data is not covered by a separate, still-active hold.
Once release is issued, normal retention and deletion policies resume for the affected data. Organizations that skip the formal release and let data sit in limbo create their own problems: ballooning storage costs, confusion about what can be deleted, and a growing pile of stale holds nobody monitors.
Common Mistakes That Lead to Sanctions
Most spoliation sanctions do not result from deliberate destruction. They come from disorganized, late, or incomplete preservation. A few patterns show up repeatedly.
Issuing the hold too late is the most damaging error. Auto-delete policies do not pause themselves, and every day between the trigger event and the hold notice is a day relevant data might be permanently lost. Organizations that wait for outside counsel before issuing even a preliminary hold are gambling that nothing important will disappear.
Forgetting about departing employees is another frequent problem. When someone leaves, their email account, laptop, and network files are often wiped or reassigned during offboarding. If that person was a custodian on an active hold, their data needs to be preserved before any of that happens. IT and HR need to coordinate with legal on every departure.
Scoping the hold too narrowly causes trouble as a case evolves. A hold focused on one product line might miss relevant communications from an engineering team that designed a shared component. Erring toward over-inclusion is far cheaper than explaining to a judge why relevant data was destroyed because it fell outside a hold drawn too tightly.
Finally, treating the notice as a one-and-done communication is a recipe for noncompliance. People forget. They change roles, get new devices, or start using a different messaging platform. Periodic reminders, follow-ups with non-responsive custodians, and updates when the scope changes are what separate a defensible hold from one that crumbles under scrutiny.