Legal Hold and E-Discovery

A legal hold is a documented instruction to preserve information that may be relevant to anticipated or pending litigation, an investigation, or an audit. E-discovery is the process by which that electronically stored information is then identified, collected, reviewed, and produced. The two are sequential: a hold that fails early makes the discovery that follows both expensive and legally exposed.

When the Duty to Preserve Begins

The obligation attaches when litigation is reasonably anticipated, which is earlier than most organizations assume. It does not wait for a complaint to be filed or a subpoena to arrive. A demand letter, a threat made in writing, an internal complaint of a kind that commonly leads to a claim, or a regulator making contact can each start the clock.

Once it attaches, routine deletion must stop for the material in scope. This is the point at which the retention policy that protects an organization in normal operation becomes a liability, because automated deletion will keep running unless it is deliberately suspended.

Rule 37(e) and What Failure Costs

Federal Rule of Civil Procedure 37(e) governs the consequences when electronically stored information that should have been preserved is lost. The structure matters:

• If the information cannot be restored or replaced, a court may order measures no greater than necessary to cure the prejudice.
• Only on finding that a party acted with intent to deprive another of the information may a court presume the information was unfavorable, instruct the jury that it may so presume, or dismiss the action or enter default judgment.

That intent threshold is the whole game. Negligent loss is remediable. A suspended retention policy that nobody suspended, or a custodian who deleted a mailbox after being told to preserve it, is where negligence starts to look like intent.

What Actually Has to Be Preserved

Scope is broader than email and gets missed in predictable places:

• Email and calendar, including the mailboxes of departed staff
• Chat and collaboration — Microsoft Teams messages, channel posts, and meeting chat
• Cloud file storage — SharePoint and OneDrive, including version history
• Mobile devices, and text messages on them, including personally owned devices used for work
• Voicemail, where retained
• Structured systems — the practice management, CRM, or accounting platform, where the relevant record is a database row rather than a document
• Ephemeral and disappearing messaging, which is where the most serious sanctions cases now originate

The Technical Mechanics

For firms on Microsoft 365, preservation is a configuration rather than an instruction. A hold applied through Microsoft Purview eDiscovery preserves content in place, including items a user subsequently deletes, and it operates without the custodian being able to defeat it. Retention policies and retention labels continue to run alongside it, so the interaction between them has to be understood rather than assumed.

Two practical requirements follow. The hold must be recorded — who was placed on hold, for what matter, on what date, and what notice they received. And it must be released when the matter closes, because indefinite holds accumulate until no one can say why a given mailbox is preserved.

Where Firms Most Often Fall Short

• The hold is an email, not a control. Custodians are told to preserve and left to comply manually, with auto-delete still running.
• Departed custodians. The mailbox was removed during offboarding, after the duty attached.
• Chat and mobile overlooked. Email is preserved and Teams, texts, and personal devices are not.
• No hold log. The organization cannot evidence who was notified or when, which is the record that distinguishes negligence from intent.
• Holds never released. Preservation quietly becomes permanent across the estate.

Why Legal Hold and E-Discovery Matter for Investment & Professional Firms

Law firms carry this obligation twice over — for their own records and on behalf of clients whose matters they manage. CPA firms are drawn in through client disputes and examinations. Investment advisers face it alongside recordkeeping duties, where the same message may need to be preserved for a hold and retained in a non-rewriteable format for Rule 17a-4. DKBinnovative configures Microsoft 365 and Azure so preservation is enforced in place rather than requested, with the hold log, release process, and retention interactions documented. We have supported litigation-exposed and compliance-intensive firms in Frisco, Plano, Irving, and Las Colinas since 2004.

Related DKBinnovative Resources

• Managed IT for Law Firms
• Managed IT for Investment & Professional Firms
• Glossary: ABA Formal Opinion 477R
• Glossary: Backup and Disaster Recovery
• Glossary: Incident Response Plan

External references: Federal Rule of Civil Procedure 37 · Federal Rules of Civil Procedure