Glossary
Legal hold
Also called: litigation hold, preservation order
A legal hold suspends the routine destruction of records that may be relevant to litigation, an investigation or an audit. It arises when proceedings become reasonably anticipated — not when they are filed — and it overrides any retention schedule for as long as it remains in force.
Legal hold explained
When the obligation starts
Earlier than most people assume. The duty to preserve arises when litigation is reasonably anticipated, which can be a complaint letter, a regulatory enquiry or an internal report of serious misconduct — well before anything is filed. Destroying records after that point, even under a perfectly good retention schedule, is spoliation.
Why it must override retention
Over-retaining a record is untidy. Destroying one that was under a preservation duty is a materially worse problem, and courts have imposed adverse inference instructions and sanctions for it. So a hold has to take precedence over the schedule automatically, rather than depending on someone remembering to suspend a rule.
What a workable hold looks like
Applied by scope rather than by file: a matter, a date range, a set of custodians, a document type. Applied by search, so it captures records nobody thought to list.
It also must not be releasable by the people whose own records it covers. A hold that a custodian can lift is not a control.
Release and evidence
Both application and release are recorded with who, when and why. When the hold lifts, the underlying retention rule resumes — records do not become immortal because they were once held, and treating them as though they had is how archives become unbounded.
FAQ
Legal hold: common questions
Who decides when a hold is needed?
Legal, normally, but the trigger is often noticed elsewhere — a complaint to customer service, a safety report, a regulator's letter. The practical control is a route by which people who notice can escalate quickly.
Does a hold apply to backups?
Often yes, and it is the part organisations miss. If the only copy of a relevant record is in a backup that rotates out in thirty days, the preservation duty attaches to it.
Related terms
- Audit trailAn audit trail is an append-only record of every action taken on a document — views, downloads, edits, approvals, permission changes and deletions — with the acting user, timestamp and affected version.
- Chain of custodyChain of custody is the documented, unbroken record of who has held, accessed or altered an item of evidence, and when.
- DispositionDisposition is what happens to a record when its retention period expires: destruction, transfer to an archive, or a decision to extend.
- Document controlDocument control is the discipline of ensuring only approved documents are in use, superseded ones cannot be mistaken for current, and every change is authorised and recorded.
- Information governanceInformation governance is the framework of accountability, policies and controls determining how an organisation creates, uses, retains and disposes of its information.
- Records managementRecords management governs how long a document is kept and what happens at the end of that period.
Last reviewed: August 28, 2026. Browse the full glossary.