A legal hold requires your organization to immediately preserve all relevant information the moment litigation is reasonably anticipated. Issue a formal hold notice, identify every custodian and data source, implement preservation measures, enforce compliance, and release the hold only after the matter fully resolves. Skipping any step exposes the organization to sanctions and adverse inference rulings.

Step 1: Understand the Trigger and Duty to Preserve

The duty to preserve activates the moment your organization reasonably anticipates litigation, a government investigation, or other legal proceedings. Trigger events include receiving a demand letter, a verbal lawsuit threat, a regulatory inquiry, or internal investigations that surface legal exposure. Legal and compliance teams need documented protocols to identify these triggers immediately – not after a delay that creates spoliation risk.

Educating HR, IT, and executive leadership on what constitutes a trigger event is non-negotiable. Delayed recognition leads directly to evidence spoliation and serious legal consequences. Build a formal, auditable process to identify, evaluate, and formally acknowledge when a preservation duty has activated – before you are under pressure to reconstruct one retroactively.

Expert Take

Courts do not give organizations credit for “we didn’t know yet.” The standard is reasonable anticipation – and the case record, not internal timelines, determines when that clock started. Document your trigger identification process before you need it, not during a crisis.

Step 2: Issue a Comprehensive Legal Hold Notice

The legal hold notice goes out immediately once a trigger is identified – no delays, no internal debate about scope. The notice must clearly state what information is covered (emails, documents, voicemails, social media posts, databases), the relevant date ranges, and the explicit prohibition on destroying, altering, or deleting anything within scope.

Write the notice so any employee can understand it without legal training. Include instructions on suspending routine deletion policies and auto-delete functions. Require written acknowledgment of receipt from every custodian – that acknowledgment is your compliance paper trail if the matter escalates. Any custodian who does not acknowledge gets a direct follow-up before the week is out.

Step 3: Identify Custodians and Data Sources

Every person with knowledge of, involvement in, or access to relevant data is a custodian – not just the people directly named in the dispute. Identifying them requires interviewing key personnel, reviewing org charts, and mapping communication flows across the organization.

Beyond individuals, document every data system in scope: email servers, cloud storage, collaboration platforms like Slack or Teams, CRM systems including Keap, backup archives, and physical documents. A thorough data mapping exercise pinpoints every location where electronically stored information (ESI) lives within the hold’s scope. This guide to comprehensive HR data sources covers the full data landscape HR and recruiting operations need to account for when reconstructing complete activity records.

Step 4: Implement Preservation and Collection Strategies

Preservation starts by suspending automated deletion protocols across every identified system. For active data, implement in-place holds where the system supports it. For volatile or high-risk data types, initiate targeted collection immediately. For systems that do not support in-place holds, image hard drives or collect data snapshots to capture the current state.

Document every preservation action with dates, methods, and personnel involved. E-discovery platforms streamline this process and create the defensible record you will need if preservation is ever challenged. Verify at regular intervals that new data generated after the notice is also captured – the hold does not freeze at the moment of issuance; it applies to all data created going forward within the defined scope.

Expert Take

A legal hold is only as strong as its documentation. If you cannot produce a timestamped record showing what was preserved, when, and how, the hold itself becomes evidence of inadequacy. Build the audit trail as you work – retrofitting it after the fact is both harder and far less credible in court.

Step 5: Monitor Compliance and Enforce the Hold

Issuing the notice is the start, not the finish. Follow up with custodians on a regular schedule to confirm they understand their obligations and are actively complying. Periodic reminders, re-issued notices when scope changes, and targeted spot audits keep the hold enforceable throughout the life of the matter.

Address non-compliance immediately with clear escalation procedures – no exceptions, no informal workarounds. New custodians and data sources surface as matters evolve, and the monitoring process needs to catch them in real time. Legal teams work directly with IT to verify that technical preservation measures, including retention policies and backup schedules, stay aligned with hold requirements from issuance through resolution.

Step 6: Release the Legal Hold

Release the hold formally once the underlying matter is fully resolved and no reasonable anticipation of litigation remains. A premature release creates fresh spoliation exposure; an indefinitely extended hold creates unnecessary storage costs and operational drag on the teams subject to it.

Issue a formal release notice to all custodians, explicitly stating that the preservation duty has ended and standard retention policies resume. IT reverses every technical preservation measure that was put in place – suspended deletion policies, backup holds, all of it – with each reversal documented. Record the release date and the justification that supports it. That documentation closes the legal hold record cleanly and returns the organization to standard information governance practices without ambiguity.

For a deeper look at how HR and recruiting operations handle data protection, retention, and CRM-level backup strategies, see 10 Essential Strategies for Protecting Your Keap CRM Data in HR Recruiting.