Guide
Most legal holds start the same way. Someone in legal hears about a complaint, an HR issue, a regulator asking questions, or a contract dispute that’s getting louder. Then the scramble begins.
People start asking where the information lives and whether it still exists. IT gets pulled into emergency calls. Somebody realizes the relevant conversations happened in Slack six months ago. Another team remembers key approvals lived inside Jira tickets that have been updated several times since the dispute started.
This guide covers what a legal hold is, what triggers one, how the legal hold process works, and how to choose legal hold software that keeps up with the systems your teams use.
A legal hold, also called a litigation hold or preservation hold, is an instruction to suspend normal deletion and preserve information that may be relevant to litigation, an investigation, or a regulatory inquiry. Legal teams issue a legal hold notice to the custodians who hold that information, and the hold stays in place until counsel releases it.
The obligation comes from common law. Rule 37(e) of the Federal Rules of Civil Procedure sets out what courts can do when electronically stored information is lost because a party failed to take reasonable steps to preserve it.
Most companies first think about legal holds in the context of email. Relevant records now sit in Slack threads, Teams chats, Google Docs, and Jira tickets as often as in inboxes.
A legal hold is triggered when litigation, an investigation, or a regulatory inquiry is reasonably anticipated. That point often comes before a lawsuit is filed, for example when a demand letter arrives or a dispute escalates internally. From then on, routine deletion has to stop for any data that could be relevant, including messages in Slack or Teams workspaces that run automatic retention policies.
The events that most often trigger a hold are:
A legal hold process runs from the trigger to the release, and each step leaves a record that counsel may need to defend later.
A legal hold notice tells custodians exactly what to preserve, in language they can act on without calling legal. Most notices include:
Naming systems matters. A notice that says “preserve all documents” leaves custodians unsure whether a Slack DM or a comment in a Google Doc counts.
A legal hold notice stays valid until legal formally releases it, usually after the matter and any appeals or related proceedings have ended. It has no fixed expiry date.
Some matters close quickly. Others stay active for years because of appeals, regulator involvement, parallel litigation, or internal reviews that keep expanding. During that time, employees change departments, systems migrate, and retention policies evolve underneath the hold.
We’ve seen active legal holds survive on paper while the underlying systems changed so much that portions of the preserved data quietly disappeared. Nobody noticed until outside counsel requested production.
Long-running holds create operational fatigue. People stop thinking about them because the original issue feels old internally, while the preservation obligation still exists. Automated tracking shows which custodians still fall under the hold and whether connected systems changed in ways that affect the defensibility of the collection.
A retention policy sets how long an organization keeps data during normal operations and when it deletes it. A legal hold overrides that schedule for the data tied to a specific matter and keeps it until the hold is released.
The two collide most often in collaboration tools. Slack, Teams, and Google Workspace all let admins set retention periods that delete messages automatically. If those settings keep running after a trigger, relevant data disappears on schedule. Google Vault and Microsoft Purview both give holds priority over retention rules for the data a hold covers, so the risk usually sits in data that falls outside the hold’s scope.
Collaboration platforms change messages and files after they’re shared, and the earlier versions are usually what a reviewer needs to see. Whether a legal hold keeps them depends on the platform and on when the hold was placed.
What a legal hold can miss in collaboration data
Each gap has the same effect in review. The record shows what a message or document says now, and the dispute turns on what it said when someone acted on it. Testing a preservation workflow against these four cases before a matter starts shows where it falls short.
Illuminate preserves collaboration data in context, including edit history, deleted messages, document versions, and the files linked inside conversations.
Legal hold software manages the legal hold process in one system. It sends legal hold notices, tracks who acknowledged them, preserves data in the platforms where it lives, and logs each step for the audit trail.
A lot of companies still manage legal holds through spreadsheets and email reminders. Those systems tend to hold together until the company expands or the number of collaboration platforms grows faster than legal processes can keep up. One employee leaves the company. Somebody changes Slack retention settings during a migration project. A Jira workspace gets archived because engineering assumed the project was inactive.
Months later, legal discovers the hold technically existed while the underlying records quietly disappeared. That’s usually where legal hold software becomes part of the conversation.
Tracking acknowledgments is the easier part. The harder part is preserving context: the edits, deleted messages, thread structure, and timestamps that show how a discussion evolved.
Slack creates preservation issues because people treat it like casual conversation even when business decisions happen there every day. Approvals happen inside threads. Teams negotiate contracts in direct messages. Someone reacts with a checkmark emoji instead of writing formal confirmation. Weeks later, nobody remembers which channel the discussion happened in.
By the time legal gets involved, retention settings may already be removing older messages automatically. A Slack legal hold has to capture the conversation the way users originally saw it, including edits, reactions, deleted messages, linked files, and timestamps that show how a discussion evolved. Raw exports rarely tell the full story, and review teams end up piecing together fragments.
The volumes add up quickly. In one employment discrimination matter, Spotlight AI ran across 2.1 million Slack messages, culled from 8.8 million messages across 21 custodians and 47,110 channels.
Illuminate preserves Slack content in context, so investigations start with intact threads instead of disconnected JSON files. That matters most in employment disputes and internal investigations, where sequence and timing carry the case.
A Microsoft Teams legal hold is placed through Microsoft Purview eDiscovery, and what it preserves depends on where each type of Teams content is stored:
Once a user or team is on hold, every version of an edited message is preserved. Without a hold, only the latest version is kept.
The gap most teams hit is scope. A hold on a custodian’s mailbox covers their chats but not the channels they posted in, and a file shared in a chat is held only if the sharer’s OneDrive is in scope.
Engineering systems create a different kind of preservation problem. Jira data usually gets attention only after teams realize product decisions were documented entirely inside tickets and comments. Features get approved and security concerns get debated there, and deadlines shift quietly through workflow updates nobody thought to preserve.
When we investigated preservation gaps for one client, the legal team had email chains and Slack messages but almost no preserved Jira history. Engineering decisions connected to the dispute had been edited repeatedly over several months. Important context disappeared because the preservation workflow focused on communication systems and left operational tools out.
A single Jira ticket can contain comment history, attachments, status changes, linked issues, sprint activity, and approvals spread across multiple users. Flat exports usually strip away the timeline that makes the record meaningful during review, which is why more legal hold scopes now include engineering systems alongside email and chat.
A GSuite legal hold runs through Google Vault, the retention and eDiscovery tool built into Google Workspace. Google renamed G Suite to Google Workspace in 2020, and a G Suite legal hold works the same way under the new name. A Vault admin opens a matter and places holds on accounts, organizational units, or groups, which preserve the data indefinitely. For Gmail and Chat messages, the hold can be limited to messages that match set conditions. Held data stays protected from deletion, so a custodian can remove a message from their own view without removing it from the preservation set. Both the custodian and the Vault admin need a Workspace license that includes Vault.
The mechanics of a GSuite legal hold are straightforward. Preservation gets harder because Google Workspace was built around live collaboration. Documents change continuously, several people edit the same file at once, resolved comments disappear from view, and Shared Drive permissions shift during a project. We’ve seen matters where teams preserved the final Google Doc but lost the revision history showing who changed language during negotiations, and that gap became a problem later in discovery.
Google Vault legal holds also leave a few gaps worth knowing about. A Drive file shared as a link in a Gmail message is not held along with the message. Vault can export linked files separately, but the file pulled from Drive may be a different version from the one that was sent. In version snapshots, edited comments appear as they read now, not as they read at the time of that version. And early versions of very large Docs, Sheets, and Slides files can be merged to save storage unless the file is on hold, so a hold placed late can mean versions that no longer exist.
Preservation inside Google Workspace works differently from traditional file collection because the content keeps changing. Illuminate preserves Google Workspace records in place, along with the activity history legal teams often need later: document versions and metadata, plus the comments and communication tied to each file.
A legal hold can reach what an organization published online. When a dispute turns on what a customer or investor could see on a given date, the live page rarely helps, because dynamic web content has usually changed since.
Chronicle captures and archives web content as it changes over time. Each capture is preserved in WARC format with a SHA-256 hash value, so a page can be replayed as it appeared on a specific date. One investment management firm has archived 299.5 million pages with Chronicle over seven years of daily crawls.
This matters most in regulated industries. Financial firms under SEC or FINRA scrutiny may need to show what investors could access at a point in time, and pharmaceutical teams may need historical labeling records tied to product disclosures. We’ve seen archived website language become central to regulatory reviews because the live version had changed months earlier.
Rule 37(e) asks whether a party took reasonable steps to preserve electronically stored information. For most legal teams, that now covers Slack, Teams, Google Workspace, and Jira as much as email. Most legal hold software handles notices well, so the differences that matter show up in how each tool handles data spread across those systems.
A single investigation can involve Slack threads, Google Docs revisions, Teams conversations, Jira tickets, and attachments linked across several repositories. When nobody knows where the relevant records are, teams default to exporting entire mailboxes and shared drives. We’ve seen matters where that approach drove collection costs up fast, and reviewers sorted through large volumes of irrelevant material while the important conversations stayed inside collaboration platforms.
A tool that maps the data environment before preservation starts avoids that pattern. Illuminate lets legal teams identify likely custodians and the systems they used, including connected data sources, without pulling entire environments into review.
We’ve seen legal teams collect Slack exports that looked complete until reviewers found that earlier versions of edited messages were missing from the preservation set. The thread was there. The context reviewers needed to judge it was gone.
Capture depth varies by platform and by vendor, so it is worth testing each tool against the data you hold. The details that most often decide a review are edit history, deleted messages, threaded replies, and the version of a linked document at the time a message was sent.
Every extra custodian and system added to a hold increases the storage and review volume that outside counsel processes later. The 2015 Advisory Committee Note to Rule 37(e) names proportionality as a factor in judging whether preservation efforts were reasonable. Legal hold software that scopes holds by custodian, system, and date range, based on where relevant data actually lives, keeps preservation closer to what the matter needs.
Broad collections disrupt the business quickly. Employees lose access to systems, IT gets pulled into emergency exports, and review deadlines tighten while nobody is confident the collection is complete. Tools that let legal place and manage holds directly in connected platforms reduce how often a preservation request becomes an IT ticket.
If preservation is challenged, the record of the hold carries the argument. That record shows who received the notice, when they acknowledged it, which reminders went out, and when the hold was released. Software that logs each step automatically makes that record available without reconstructing it from email.
Preservation works better when teams understand the data environment before they start collecting from it.
Yes. Legal hold, litigation hold, and preservation hold all describe the same obligation to preserve information relevant to a dispute or investigation.
In-house legal or outside counsel issues the legal hold notice. IT, records, and system owners usually handle the technical preservation in each platform.
Employees under a hold must not delete, edit, or move in-scope data. In Google Vault and Microsoft Purview, held data is preserved even if a user deletes it from their own view, but data outside the hold’s scope can still be lost.
Under FRCP 37(e), if electronically stored information is lost because a party failed to take reasonable steps and it cannot be restored, the court can order measures to cure the prejudice. If the court finds intent to deprive the other party of the information, it can instruct the jury to presume the information was unfavorable, dismiss the action, or enter a default judgment.
A legal hold is released once the matter and any appeals or related proceedings have ended and counsel confirms no further duty to preserve exists. Legal sends a written release, and normal retention resumes.
A legal hold preserves data. eDiscovery is the wider process that follows, from collection through review and production.
Illuminate preserves collaboration data from platforms such as Slack and Google Workspace in context, with edits and thread structure intact. Chronicle preserves websites and social media as they appeared on a given date. Talk to the Hanzo team about the systems your next legal hold needs to cover.
Hanzo
N/a
© Hanzo 2026 | All Rights Reserved.