Legal Hold Checklist Template

What the Legal Hold Checklist Covers

1. 1
   Phase 1

   Phase 1: Record the Trigger

   4 tasks

   The hold owner starts the run on the day something puts you on notice: a claim, a letter before action, a complaint served, a subpoena, a regulator’s notice, or an event that makes litigation reasonably likely. Choose the rules that apply on the first task; it shows the matching notes where the rules differ. Phases 1 to 7 count in business days from the trigger date.

   • Record the trigger, the matter and who is responsible — the organisation, the matter, the date you were put on notice, the kind of trigger, the rules that apply, who runs the hold, the counsel who decides and authorises, the IT and records contacts who suspend deletion, and the HR contact for leavers
   • Log what put you on notice and keep a copy — the letter, claim, subpoena, notice or event, the date it arrived, who received it and who else knew, with the document saved to the matter
   • Regulator: read the notice for its own preservation requirements — the powers the regulator relies on, any instruction about keeping documents, the deadlines it sets and the people it names, read before anything else is decided
   • Tell the people who need to know now — the general counsel or partner responsible, the business owner of the matter and, if your policy asks for notice of claims or circumstances, your insurer or broker, told in a privileged channel
2. 2
   Phase 2

   Phase 2: Decide on the Hold

   4 tasks

   Counsel decides whether the duty to preserve has arisen and from what date. Waiting for a claim form is often too late: the duty can start when litigation is reasonably likely. A decision not to issue a hold yet adds a task to record the reasons and a date to look again.

   • Assess whether litigation is reasonably anticipated — what the trigger says, how likely a claim or investigation is, who the parties would be and what the dispute is about, written down for counsel
   • Counsel decides whether to issue a hold and from what date — a decision to issue a hold or not, the date the duty to preserve began, and the reasons, recorded by counsel
   • No hold yet: record the reasons and when to look again — why the duty has not arisen, what would change that, and a date to review it; if a hold follows later, change the decision and carry on from Phase 3
   • Open an entry in the legal hold register — a hold reference, the matter, the trigger date, the date the duty began, counsel and the hold owner, in the register that lists every open hold
3. 3
   Phase 3

   Phase 3: Scope the Hold

   5 tasks

   Decide what the hold covers before anyone is told about it: the issues, the dates, the subjects, the kinds of document and the systems that hold them. A scope that is too narrow loses evidence; one that is too wide stops routine deletion for no reason.

   • Define the issues and the date range the hold covers — the issues in dispute or under investigation, described neutrally, and the period the relevant documents were created in, from the earliest relevant date to the present
   • List the subjects and kinds of document to preserve — the projects, contracts, products, people and events in scope, and the kinds of document: email, chat and text messages, voicemail, drafts, spreadsheets, databases, recordings, paper and metadata
   • Map the systems and places where the data is held — email, chat and collaboration tools, file shares, document management, business systems and databases, laptops and phones including personal devices used for work, backups, paper and offsite storage, each with its owner and its routine deletion setting
   • Identify third parties that hold relevant data — cloud and IT providers, outsourcers, payroll and HR providers, agents, advisers and former suppliers who hold documents for you
   • Agree a proportionate scope with counsel — what is in and what is left out, and why, balancing the importance of the data against the cost of keeping it, recorded so the choice can be explained later
4. 4
   Phase 4

   Phase 4: Custodians & At-Risk Data

   7 tasks

   Custodians are the people who hold relevant data, including former employees. A custodian about to leave, and data about to be overwritten, need action before the notice goes out: each adds its own tasks.

   • List the custodians — every employee, contractor and former employee likely to hold relevant data, with their role, the systems they use and the period they were involved
   • Check for custodians leaving or changing role — anyone on the list who has resigned, is under notice, is on long leave or is about to move role, and any leaver whose account or device is due to be removed
   • Departing custodian: preserve their mailbox, files and devices — the mailbox, personal drive, chat history and laptop or phone of each departing custodian kept or copied before access is removed, and the device kept, not wiped or reissued
   • Departing custodian: add the hold to the leaver process — HR and IT told which leavers are under the hold, so the exit steps keep their data and their exit interview covers where they kept documents
   • Identify data at risk of loss — devices due for refresh or reimaging, backups about to rotate, chats that delete themselves, personal devices used for work and accounts about to close
   • At-risk data: image or collect the devices and data — a forensic image or a verified copy of each at-risk device or account, made by someone qualified to do it, with the chain of custody recorded
   • At-risk data: take backup media out of rotation — the backups that hold data in scope and are due to be overwritten, set aside or kept beyond their normal cycle, with the reason recorded
5. 5
   Phase 5

   Phase 5: Suspend Routine Deletion

   5 tasks

   The hold notice tells people not to delete. Systems delete by themselves, so IT and records suspend every automatic deletion, retention schedule and disposal that reaches data in scope, and keep evidence that they did.

   • Suspend automatic deletion of the custodians’ email and chat — retention and auto-delete policies on the custodians’ mailboxes, chat, messaging and collaboration accounts put on hold, including former employees’ accounts that still exist
   • Suspend deletion in file shares, document systems and business systems — clean-up jobs, archive purges, version limits and database purges that reach data in scope, paused for the duration of the hold
   • Suspend the records retention schedule for the records in scope — every disposal under the retention schedule that would reach the records in scope stopped, including any disposal batch already approved but not carried out
   • Stop the disposal of devices and paper records — laptop and phone returns, reimaging and recycling, confidential waste, and destruction at offsite storage, stopped for the custodians and records in scope
   • Confirm each suspension and keep the evidence — each system, what was suspended, by whom and on what date, with screenshots or reports kept with the hold record
6. 6
   Phase 6

   Phase 6: Issue the Hold Notice

   8 tasks

   A written notice tells each custodian what to keep and that they must not delete it. Chase every acknowledgement until all are in. Third parties get their own preservation letters, and outside counsel gets the client’s written confirmation.

   • Draft the hold notice — the matter described neutrally, the subjects, kinds of document, places and dates to keep, an instruction not to delete, alter or move them, that it overrides retention rules, who to ask, and a request to acknowledge
   • Counsel approves the notice and the distribution list — the wording checked for scope and privilege, and the list of recipients agreed against the custodian list
   • Send the notice to every custodian — the approved notice sent in writing to each custodian, including former employees who may hold documents, with the date sent recorded
   • Third parties: send preservation letters — a written request to each third party that holds data for you, naming the data and dates, asking them not to delete it and to confirm in writing
   • Track and chase acknowledgements — each custodian’s acknowledgement recorded with its date, and a reminder sent to anyone who has not replied
   • Escalate custodians who have not acknowledged — the custodian’s manager or a senior person asked to make sure they read and acknowledge the notice, and their data checked by IT in the meantime
   • Outside counsel: get the client’s written confirmation that the steps are taken — written confirmation from the client, or someone who can speak for it, that deletion is suspended, the notice has gone out and third parties have been asked to preserve
   • Third parties: record each confirmation — each third party’s written reply logged, and anyone who has not replied or refuses chased and reported to counsel
7. 7
   Phase 7

   Phase 7: Interview Custodians & Preserve Data

   4 tasks

   Interviews with the key custodians find the data a list of systems misses: a personal phone, a messaging app, a paper notebook, a colleague who was copied in. Preserve what they reveal, record preservation for the court process and set the first review date.

   • Interview the key custodians — where each keeps relevant data, which devices, apps and accounts they used, any paper, who else was involved, and anything already deleted; new custodians and sources added to the lists
   • Preserve or collect data where the hold alone is not enough — data kept in place where the system can hold it, and copied or collected with a record of who did it and when where it cannot, such as personal devices, departing staff or systems being retired
   • Record preservation for the court process — what has been preserved and how, ready to discuss with the other side and to confirm to the court when the rules ask for it
   • Set the first review date — the date of the first reminder and scope review, usually a few months away and sooner if the matter is moving fast
8. 8
   Phase 8

   Phase 8: Keep the Hold in Place

   6 tasks

   A hold can last for years. At each review, remind the custodians, catch joiners, movers and leavers, check the suspensions survived system changes and re-scope if the case has moved on. The due dates in this phase count from the review date.

   • Send the reminder notice to every custodian — a short reminder that the hold is still in force, what it covers and who to ask, with each round recorded
   • Check for joiners, movers and leavers among the custodians — custodians who have left or changed role since the last review, and people who have joined the matter and need the notice
   • Check the suspensions are still in place — each suspension checked after system upgrades, migrations, new retention policies and changes of provider, and anything lost reported to counsel
   • Review the scope with counsel — new issues, parties, dates or custodians in the case, and data that no longer needs to be kept
   • Scope change: update the notice, the custodians and the suspensions — an updated notice sent to new and affected custodians, the custodian and system lists changed, and suspensions added or narrowed with counsel’s agreement
   • Set the next review, or record that the matter has ended — the date of the next review while the matter is live; once it has ended, the date it ended, which starts the release
9. 9
   Phase 9

   Phase 9: Release the Hold

   8 tasks

   Release is a decision, not a default. Confirm the duty to preserve has ended and that no other hold covers the same data. Counsel’s authorisation is the gate: nothing after it can be completed until it is done, so no deletion resumes early. The due dates count from the date the matter ended.

   • Confirm the duty to preserve has ended — the final judgment or order and any appeal period, the settlement terms carried out, or the reason it is now clear no claim will be brought, and any related claim still possible
   • Check whether another hold or duty still covers the data — the hold register and the records team checked for other matters, investigations or regulatory requirements that cover the same custodians, systems or records
   • Other hold: list the data that must stay preserved — the custodians, systems and records the other hold covers, so the release notice and the resumed schedules leave them alone
   • Regulator: get written confirmation that the investigation is closed — a letter or notice from the regulator closing the matter, and any requirement it sets for keeping records afterwards
   • Counsel authorises the release — the release authorised in writing by counsel, naming what is released and anything still held; if it is not time yet, record why and leave this task open, because nothing after it can be completed until it is done
   • Send release notices to custodians and third parties — a written notice to every custodian and third party that the hold has ended, saying normal retention rules apply again and naming anything still held under another hold
   • Resume routine deletion and the retention schedule — each suspension lifted system by system, collected copies and set-aside backups dealt with under the retention policy, and data past its retention period sent through the normal disposal approval
   • Close the hold record and keep it — the register updated, and the notices, acknowledgements, suspensions, interviews and release authorisation kept together as the record of how the data was preserved