An employee’s phone auto-deletes messages after 24 hours. Nobody disabled that setting when the demand letter arrived, because nobody remembered it was on. Six months later, opposing counsel asks for those messages in discovery, and the firm has nothing to produce — not because anyone destroyed evidence on purpose, but because the routine, everyday behavior of an app kept running after the legal duty to stop it had already begun. Courts don’t require bad intent to sanction that outcome. They require only that the duty to preserve existed and wasn’t met.
That gap — between when the duty to preserve legally begins and when an organization actually acts on it — is what a legal hold is built to close.
What Is a Legal Hold?
A legal hold, also called a litigation hold, is a notice and process that requires an organization to preserve all information that may be relevant to pending or reasonably anticipated litigation, a regulatory investigation, or an audit. Once a hold is in place, routine document destruction and retention schedules are suspended for the covered data. Emails don’t purge on their normal cycle, chat logs don’t roll off, and auto-delete settings on the relevant channels get disabled for the custodians involved.
A legal hold is not the same as a records retention policy. Retention policies govern the ordinary lifecycle of data. A legal hold overrides that lifecycle for a defined scope of information, for as long as the underlying matter is active.
When Does the Duty To Preserve Begin?
The duty to preserve attaches when a party reasonably anticipates litigation — not when a complaint is formally filed. Courts have applied this standard consistently since the early 2000s: an organization doesn’t get to wait for service of process before its preservation obligations start.
“Reasonably anticipates” is a facts-and-circumstances test, not a bright line. A demand letter, a whistleblower complaint that names specific individuals, a regulatory inquiry, or even an internal investigation that surfaces potential misconduct can each be enough to trigger the duty, well before any lawsuit exists. Waiting for a filed complaint as the signal to preserve is, in itself, a common way organizations end up on the wrong side of a spoliation motion.
What Triggers a Legal Hold?
Common triggering events include:
- A subpoena or document request
- A regulatory inquiry — from the SEC, FINRA, the FCA, or an equivalent body
- A demand letter or notice of claim
- A whistleblower complaint or internal misconduct report
- An internal investigation into potential wrongdoing
- An employment dispute, such as a termination likely to be contested
- Notice of a pending or threatened lawsuit
- Regulatory exam findings that could lead to enforcement
This list is illustrative, not exhaustive. Any credible signal that litigation, investigation, or audit is reasonably likely can be enough to start the clock.
The Legal Hold Process
A defensible legal hold process generally follows the same structure regardless of the size of the matter:
- Identify the trigger and scope. Determine what subject matter, time period, and business units the matter is likely to touch.
- Identify custodians. Name the specific individuals whose communications and files are relevant — not just the obvious parties, but anyone in the surrounding conversation chain.
- Issue the hold notice. Instruct custodians in writing on what to preserve, and confirm acknowledgment. A verbal instruction that nobody signs off on is difficult to defend later.
- Suspend routine deletion. Disable auto-delete, archive expiration, and any retention schedule that would otherwise touch the relevant data — across every channel the custodians use, not just email.
- Monitor and reissue. As a matter evolves, custodians and scope often change. Holds should be revisited, not set once and forgotten.
- Release the hold. When the matter resolves, formally lift the hold and document that release, so normal retention policy can resume.
What Happens If a Legal Hold Fails?
A failure to preserve relevant information after the duty to preserve has attached is spoliation. Under Federal Rule of Civil Procedure 37(e), which governs electronically stored information specifically, courts assess whether reasonable steps were taken to preserve the data and what prejudice resulted from its loss. Remedies can include:
- Monetary sanctions — covering the cost the opposing party incurred from the loss
- Evidentiary preclusion — barring the offending party from using related evidence
- Adverse inference instructions — telling a jury it may assume the missing evidence was unfavorable to the party that lost it
- Dismissal or default judgment — reserved for the most severe cases, typically where intent to deprive is shown
Courts don’t require proof of malicious intent for the lighter remedies. Negligent, good-faith loss of data — like an app’s default settings running as designed — can still draw sanctions if reasonable preservation steps weren’t taken once the duty attached.
Legal Holds and Modern Communication Channels
The channels most likely to defeat a legal hold aren’t the ones compliance teams are used to archiving. Email retention is a solved problem for most firms. WhatsApp, Signal, Teams, and disappearing-message features are not, and courts have started treating that distinction seriously: continuing to use auto-delete messaging, or switching to it, after the duty to preserve attaches can itself support a finding that reasonable preservation steps weren’t taken.
The operational challenge is that a legal hold issued on paper doesn’t stop a phone from deleting a message on schedule. Enforcing the hold requires the underlying data to be already captured somewhere the hold can reach it.
This is what Shield Discover is built for. Because Shield’s Data Engine continuously captures and archives communications across 100+ channels — including WhatsApp, Teams, Zoom, and voice — a legal hold doesn’t depend on a custodian remembering to change a device setting after the fact. Shield Discover applies the hold directly against data that’s already preserved, reconstructs the full communication timeline across every channel involved, and packages evidence for production. That turns an investigation that would otherwise take weeks of manual, channel-by-channel collection into a matter of hours, with complete omni-channel evidence rather than whatever happened to survive.
Compliance Best Practices and Shield’s Solutions
How does Shield help organizations manage legal holds? Shield Discover applies legal hold and data preservation directly to Shield’s unified communications archive, so you can place a hold across email, chat, voice, and mobile from a single point rather than chasing preservation channel by channel. Because the archive already captures every channel continuously, a hold doesn’t depend on a custodian remembering to disable auto-delete after the fact.
Learn more about Shield Discover.
What specific features does Shield offer for legal hold and eDiscovery? Shield Discover provides cross-channel, rapid search across the full communications archive, legal hold and data preservation, communication timeline reconstruction, and evidence packaging for production. It integrates with Shield Archive so held data stays intact in a single audit-ready system rather than a separate export.
How quickly can Shield be implemented? Shield has been deployed at a Tier 1 bank in three weeks, using out-of-the-box connectors and a security-by-design architecture.
What performance metrics demonstrate Shield Discover’s effectiveness? Shield Discover is built to cut investigation cycle time from weeks to hours, giving legal and compliance teams complete omni-channel evidence instead of a fragmented, manual collection process.
Frequently Asked Questions
When does the duty to preserve begin? The duty to preserve begins when a party reasonably anticipates litigation, not when a complaint is formally filed. Courts assess this on the facts: a demand letter, a regulatory inquiry, or a credible internal complaint can each trigger the duty well before a lawsuit exists.
What triggers a legal hold? Common triggers include a subpoena, a regulatory inquiry from a body like the SEC or FINRA, a demand letter, a whistleblower complaint, an internal investigation, an employment dispute, or notice of a pending lawsuit. This list is illustrative, not exhaustive.
What happens if a company fails to comply with a legal hold? Failing to preserve relevant information after the duty attaches is spoliation. Under Federal Rule of Civil Procedure 37(e), courts can impose remedies ranging from monetary sanctions and evidentiary preclusion to an adverse inference instruction or, in the most severe cases, dismissal or default judgment.
Who is responsible for issuing and enforcing a legal hold?
Legal and compliance teams typically issue the hold, working with IT and records management to identify custodians, suspend deletion policies for the relevant data, and confirm custodians have acknowledged their preservation obligations.
Related Terms
Talk to an expert → shieldfc.com/contact-us