Glossary term
Litigation Hold
A litigation hold is a documented obligation, usually triggered by a hold notice from counsel, to preserve potentially relevant evidence once litigation is reasonably anticipated.
Litigation holds protect against spoliation of evidence. Once a party reasonably anticipates litigation, the duty to preserve attaches, and routine document destruction processes that would normally affect potentially relevant evidence must be suspended.
A complete hold workflow has four parts. First, a hold notice from counsel to every potential custodian, identifying the matter, the date range, and the data sources within scope. Second, technical preservation of endpoints, mailboxes, cloud accounts, and chat history. Third, ongoing monitoring of compliance, with refresher notices and additions as the matter evolves. Fourth, a documented release when the matter ends.
The technical preservation piece is where forensic firms add value. Cloud audit log retention is short. M365 unified audit log defaults to 90 to 180 days. Slack on Free or Standard plans does not retain indefinitely. A hold notice without technical preservation is incomplete.