Litigation holds and preservation
Preservation comes before collection. We help counsel and clients scope a hold, apply it technically in Microsoft 365 and Google Workspace, notify custodians, and avoid the gaps that lead to spoliation arguments.
Reviewed by the ITRS security team · Last updated
When the duty to preserve arises
Principle 3 of the Sedona Canada Principles Addressing Electronic Discovery (Third Edition) states that as soon as litigation is reasonably anticipated, parties must consider their obligation to take reasonable and good-faith steps to preserve potentially relevant electronically stored information. That moment often comes well before a claim is issued: a demand letter, a dismissal that is likely to be contested, a regulator's inquiry, or a cyber incident that may lead to claims.
Whether and when the duty has arisen in a particular matter is for counsel to advise. Our job begins when counsel decides to preserve: making sure the systems actually stop deleting what needs to be kept.
Scoping custodians and sources
A proportionate hold, consistent with Sedona Canada Principle 2, targets the people and systems likely to hold relevant information, not the whole organization by default.
| Question | Why it matters |
|---|---|
Who are the key custodians? | People directly involved, their assistants, and anyone who inherited their files |
Which systems do they use? | Mailbox, OneDrive, Teams chats, SharePoint sites, Google Drive, phones, practice or line-of-business systems |
What is the relevant period? | Date ranges reduce volume, but holds are often set broader at first and narrowed later |
What is set to delete? | Retention policies, auto-archive, chat retention and backup rotation that need to be suspended |
Who is leaving? | Departing custodians need special handling before their accounts are removed |
Non-custodial sources | Shared mailboxes, team sites, file shares and logs not tied to one person |
Technical holds in Microsoft 365 and Google
Place the custodian's mailbox on Litigation Hold. Microsoft says this preserves all mailbox content, including deleted items and original versions of modified items, and also holds the user's archive mailbox. The hold can take up to 60 minutes to take effect. Pair it with written custodian notices and a scope agreed with counsel, so preservation is defensible later.
In Microsoft 365, holds are created in Microsoft Purview eDiscovery: within a case, the Hold policies tab lets you place mailboxes, OneDrive accounts and SharePoint sites (including those behind Teams and Microsoft 365 groups) on hold, either entirely or by query and date range. Microsoft notes that a hold can take up to 24 hours to take effect, and that some query-based and custodian-scoped hold features require higher licence tiers. Exchange Online's mailbox-level Litigation Hold remains available as an alternative for whole mailboxes.
In Google Workspace, holds are placed through Google Vault matters on editions that include Vault, covering Gmail, Drive, Chat (where history is on), Meet recordings and other supported data. Holds in either platform override the user's ability to permanently delete held content and override retention rules that would otherwise remove it.
After applying holds we verify them: confirming each location shows as on hold, and testing that deleted items are retained. A hold that silently failed on one mailbox is worse than no hold, because everyone believes the data is safe.
Custodian notices
Technical holds do not cover everything. Phones, personal devices used for work, paper, and data in third-party apps depend on people. A written hold notice tells custodians what to keep, in plain language, and records that they were told.
- What the matter concerns, in general terms, and the relevant period
- Categories of information and locations to preserve, including texts and messaging apps
- A clear instruction not to delete, wipe, reset or replace devices
- Who to contact with questions
- A request for written acknowledgment, and periodic reminders
Departing custodians
The most common preservation failure is offboarding. When a Microsoft 365 user account is deleted without a hold in place, the mailbox is soft-deleted and then permanently removed. Microsoft's documentation explains that if a hold is applied before the account is deleted, the mailbox becomes an inactive mailbox and its content is retained.
We help clients build a step into offboarding: check whether the person is a custodian on any hold before their licence is removed, their laptop is reimaged, or their phone is reset. For Google Workspace, Vault holds are tied to user licences, so licence removal needs the same check.
Releasing holds
Holds should not run forever. When the matter is resolved and appeal periods have passed, counsel confirms release in writing. Before removing a hold we check whether the same custodians are subject to any other hold or regulatory retention requirement, then release it and record the date. Content then becomes subject to normal retention, which may mean deletion, so the decision is documented.
FAQ
Rarely. Systems delete content automatically under retention settings, so relying on people alone leaves gaps. Technical holds and notices work together.
No. Users can keep working and even delete items from their view; the held content is retained in the background.
Not through Microsoft 365 or Google holds. Phones are preserved by instruction to custodians, by setting devices aside, or by forensic collection.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyCleaning Up a Microsoft 365 Tenant for a Fire Protection & Security CompanyHow IT Rapid Support audited every Microsoft 365 group for a GTA fire protection company, fixed mail routing, and cut an 82,456-item mailbox by 62%.
Related.
- PracticeLegal TechnologyeDiscovery and forensic collection for counsel, expert-ready reports and legal-tech advisory for firms.
- GuideMicrosoft 365 litigation hold and content search for law firms and legal teamsHow Microsoft 365 preserves and finds content for legal matters in the current Microsoft Purview eDiscovery experience: holds versus retention, creating a case and hold…
- GuideGoogle Vault retention rules and holdsGoogle Vault is Workspace's built-in tool for keeping, preserving and exporting data.
- ServiceeDiscovery and defensible collectionProportionate, documented collection of email, chat, files and phone data for small and mid-sized matters, done so that how it was gathered never becomes the argument.
- GuideOffboarding a user in Microsoft 365 the right wayDeleting a departing employee's account is the fastest way to lose their email, their files and any evidence you might later need.
Acting on a matter that turns on electronic evidence?
Tell us who you act for and what is at issue. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.