ExamWizardzExamWizardz
Start free
Security

What is legal hold?

A legal hold is an instruction from legal counsel to preserve all data relevant to expected litigation or an investigation, suspending routine deletion.

What is a legal hold?

A legal hold, also called a litigation hold, is an instruction from an organization's legal counsel to preserve every record that may be relevant to a lawsuit, government investigation or audit, and to stop any process that would delete or alter it. It overrides the normal retention schedule. Email that would be purged after 90 days, chat messages, files, logs, backups that would rotate out and devices that would be wiped all stay as they are until counsel releases the hold in writing.

In the United States, the duty to preserve starts when litigation is reasonably anticipated, not only when a lawsuit is filed. A demand letter, a regulator's inquiry, an employee dispute or a data breach likely to bring claims can all trigger it.

How a legal hold works

  1. Trigger: counsel decides that litigation or an investigation is reasonably likely.
  2. Scope: counsel identifies the matter, the date range, the data types and the custodians, the people who hold relevant information.
  3. Notice: custodians receive a hold notice explaining what to keep, and their acknowledgments are recorded.
  4. Technical preservation: IT suspends automatic deletion for everything in scope, including mailbox and chat retention policies, log rotation, backup media reuse, and the reimaging or wiping of devices belonging to people who leave.
  5. Maintenance: new custodians are added as the matter grows, and reminders go out on a schedule.
  6. Release: when the matter ends, counsel releases the hold in writing and normal retention resumes.

Example: placing a mailbox on hold

Most collaboration platforms have hold features. In Exchange Online, an administrator can preserve a custodian's entire mailbox, including items the user deletes later, with:

Set-Mailbox -Identity akhan@example.com -LitigationHoldEnabled $true

Holds can also be applied through the eDiscovery and compliance tools in Microsoft 365 and Google Workspace, through legal hold settings on cloud object storage, and through hold options in backup software. The effect is the same everywhere: neither users nor automated policies can remove the data while the hold is in place.

Why legal holds matter

Failing to preserve relevant data is called spoliation, and it has real consequences. In US federal courts, Rule 37(e) of the Federal Rules of Civil Procedure applies when electronically stored information that should have been preserved is lost because a party failed to take reasonable steps and it can't be restored or replaced. If the loss prejudices the other side, a judge may order measures to cure the harm; if the party intended to deprive the other side of the evidence, the court may presume the lost data was unfavorable, instruct the jury that it may or must do so, or even dismiss the case or enter a default judgment. Letting routine automated deletion run after the duty arose generally doesn't excuse the loss. For the security team, a hold can arrive in the middle of incident response, and forensic images, incident tickets, chat channels used during the response and logs then become preserved records.

Legal hold vs. related concepts

  • Data retention policy: the normal schedule for how long records are kept and when they are destroyed. A legal hold suspends that schedule for the data it covers.
  • Chain of custody: documents who handled a specific piece of evidence after collection. It doesn't stop routine deletion.
  • E-discovery: the broader process of identifying, collecting, reviewing and producing electronic records. The legal hold is its preservation step.
  • Backups: a recovery tool, not a hold. Backups keep rotating on schedule unless the hold stops them.
  • Privacy erasure requests: a valid request to erase data generally yields to a legal hold on the same data. GDPR, for example, makes an exception for data needed to establish, exercise or defend legal claims. The data is deleted once the hold and any retention requirement end.

Legal hold on the CompTIA Security+ exam

On SY0-801, legal hold appears in objective 4.7, as part of preserving evidence during an incident investigation, and in objective 5.4, where legal duties sit alongside privacy rights in a compliance program. Scenario wording such as "litigation is expected," "stop the scheduled mailbox purge," "preserve records for a lawsuit" or "suspend deletion of a departing employee's data" points to legal hold. Distractors include chain of custody, which tracks evidence handling but doesn't stop deletion, the data retention policy, which the hold overrides, and simply taking a backup. Legal counsel issues the hold; IT carries it out. Legal hold also appears in A+ Core 2 (220-1202) objective 4.6.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

chain of custody

Chain of custody is the documented, unbroken record of who collected, handled, transferred and stored a piece of evidence, when, and why.

data retention

Data retention is the policy that sets how long records, email and backups must be kept and when they must be securely destroyed.

digital forensics

Digital forensics is the collection, preservation and analysis of digital evidence using documented methods so its findings hold up to legal scrutiny.

e-discovery

E-discovery (electronic discovery) is the legal process of finding, preserving, collecting and producing electronically stored information for litigation.

incident response

Incident response is the set of steps for handling a security breach, malware or prohibited content: identify, report, preserve evidence and document.

← Back to the full CompTIA glossary