Legal hold
Definition
A directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant to anticipated litigation. For engineering evidence, the legal hold triggers the responsibility to stop routine maintenance, disposal, or repair of failed components.
- Also called
- Litigation hold or preservation notice
- Covers
- Electronic data, documents, and physical items
- Timing
- Issued as soon as litigation is reasonably anticipated
Common questions
What is a legal hold and when is it issued?+
A legal hold is a directive that tells people and organisations to stop destroying or deleting documents, data, and physical items because they may be needed as evidence. It is issued as soon as a lawsuit or investigation is reasonably expected, even if litigation has not started yet. The goal is to prevent evidence from being lost through routine deletion or disposal.
Who issues a legal hold and what does it cover?+
Legal counsel issues the hold to relevant people in an organisation. It can apply to electronic data such as emails, files, and databases, as well as paper documents and physical items. For engineering evidence, a legal hold triggers the responsibility to stop routine maintenance, disposal, or repair of failed components that might be needed as evidence.
What happens if someone ignores a legal hold?+
Organisations have a legal duty to comply with a hold and must ensure their staff knows about it so they do not accidentally delete or dispose of key evidence. Failing to preserve evidence that is subject to a hold can result in serious legal consequences.
Related terms
- Chain of custody
- The unbroken documentary trail of who held a sealed exhibit, when, and under what seal, from the moment of collection through analysis...
- Audit trail
- A log maintained by an accounting system, ERP, or cloud application recording who accessed, created, modified, or deleted each record, with timestamps....
- Electronically stored information (ESI)
- The US legal term for any information created, stored, or communicated digitally. ESI includes emails, accounting databases, spreadsheets, instant messages, ERP records,...
- Hash value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Joint inspection
- An examination of physical evidence attended by the experts for all parties under an agreed protocol. Joint inspection ensures that each expert...
- Metadata
- Data about data. In document forensics, metadata includes file-creation timestamps, last-modified dates, author fields, revision history, and embedded GPS coordinates in images....
- Photogrammetry
- A technique that uses overlapping photographs to reconstruct three-dimensional geometry from two-dimensional images. In forensic engineering, photogrammetry and Structure-from-Motion (SfM) software allow...
- Spoilation doctrine
- The legal principle that a party who destroys or materially alters evidence relevant to litigation may be penalised. Sanctions range from an...
- Spoliation letter
- A written notice from one party to another (or to a third party with custody of the evidence) demanding that specific items...
Explained in these topics
- Digital Evidence in Financial CasesA directive issued to document and data custodians requiring them to suspend routine deletion and preserve all potentially relevant ESI. Also called a litigati...
- Evidence Preservation and DocumentationA directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant to antic...