Legal hold and preservation: the duty, and what Rule 37(e) does about failure

Preservation failures are where eDiscovery stops being a cost problem and becomes a sanctions problem. A litigation hold that exists in a file but cannot show what information was targeted, what deletion processes were suspended, or why particular sources were treated differently leaves the organization defending the outcome rather than the decision. The relevant question is not whether every piece of information survived. It is whether the organization made a reasonable preservation decision on the facts available at the time and documented the basis for that decision.

The trigger: litigation that is reasonably anticipated#

The duty to preserve attaches when litigation is reasonably anticipated. That trigger generally occurs before a complaint is filed and before a formal litigation hold is issued. The determination is a judgment call based on facts known to the organization at the time, not a conclusion that can be postponed until discovery disputes arise.

Indicators of reasonably anticipated litigation may include a threat to file, a demand for records, an investigation that is likely to produce claims, or communications that identify a dispute with legal consequences. The importance of the timeline is that delay can allow routine deletion, overwriting, messaging expiration, or changes to collaboration-platform data to occur before anyone recognizes the preservation issue. A later litigation hold does not automatically repair information that disappeared before the hold was issued.

The trigger should be evaluated against the organization’s actual knowledge. A legal team may not know everything happening in a business unit, and an IT owner may not know that a dispute is becoming adversarial. Conversely, a single internal disagreement does not necessarily establish that litigation is reasonably anticipated. The defensible approach is to record the facts considered, the people who identified them, and the reasons for the decision not to issue a hold or to issue one earlier.

What a workable legal hold contains#

A hold is an operational instruction, not merely an announcement that preservation is required. It should identify the information to preserve, the people and systems that may hold it, the actions required, and the process for releasing the hold. It should also distinguish information subject to preservation from information that may be collected or reviewed later.

Written notice matters because custodians cannot preserve information they do not know exists. A notice should explain the matter in plain terms, identify the types of records and communications at issue, describe actions such as disabling deletion or preserving relevant chat channels, and provide a route for asking questions. The notice should also make clear that the hold is not a general instruction to preserve everything indefinitely.

Reminders help keep an instruction active across changes in personnel, systems, and priorities. Acknowledgements provide a record that the notice reached the intended recipient and that the recipient had an opportunity to raise concerns. A reminder or acknowledgement system does not replace a meaningful inquiry into whether the recipient understood the scope of the hold or could comply with it.

The hold process should also address release. When the matter ends or the preservation basis ends, the legal team should communicate that the hold is no longer active, restore normal deletion practices where appropriate, and document the release. An indefinite hold creates operational burdens and can make the original preservation decision harder to evaluate. A release also signals that the decision was tied to the matter rather than treated as a permanent feature of the information-governance program.

Identifying custodians and data sources#

Custodian identification should begin with the people likely to possess relevant information, but it should not end there. Relevant ESI can reside in systems that no individual controls directly: shared drives, databases, ticketing systems, collaboration platforms, messaging archives, mobile-device containers, and records maintained by third parties. The hold should map those sources to the people and technical owners who can act on them.

Non-custodial sources are especially difficult because no obvious witness can explain their contents or confirm that a preservation instruction was followed. A shared drive may accumulate presentations, spreadsheets, and draft communications from several groups. A project channel may contain messages posted by participants who never received a custodian inquiry. A database may contain a history assembled by a business process rather than by any individual. Preservation decisions should therefore consider the data flow and ownership of each source, not just the list of named custodians.

Third-party sources add another layer. The organization may not control the retention setting, deletion behavior, or export process for a service operated by another entity. It may also be unclear whether a third party’s data includes responsive material, whether the third party will preserve it, and whether contractual or technical arrangements permit action in time. The hold file should identify the source, the relationship with the third party, the preservation request or other available step, the response, and any unresolved limitation.

Collaboration tools are a recurring source of difficulty because retention is often set by someone outside legal. An administrator may control automatic deletion, message editing, or channel-history behavior while a legal team controls the hold notice. The preservation instruction must therefore reach the technical owner as a concrete request: suspend deletion, preserve an export, preserve message and file history, or confirm the relevant limitation. A request to a business group that does not own the control may not change the underlying retention behavior.

Suspending deletion without losing control#

The purpose of a preservation step is to prevent destruction of ESI that should remain available for the dispute. In practice, that can involve suspending automatic deletion for identified custodians, disabling retention expiration on targeted collaboration data, preserving inboxes or chat histories, and capturing data that would otherwise be overwritten. The step should be connected to a source and custodian rather than applied as an unexplained system-wide exception.

Organizations commonly need to distinguish suspension from collection. Suspending deletion leaves information in its source environment while the matter develops. Collection creates a preserved set that can be processed, reviewed, and produced. A hold that requires only suspension does not necessarily require copying the entire source, but it does require confidence that the source will not destroy the relevant information. The record should show which technical measures were selected, who implemented them, and how the organization confirmed their operation.

It is also important to identify what remains outside the hold. Some sources may be too broad to preserve wholesale, or may contain information whose preservation would create disproportionate operational friction. That does not make the source disappear from analysis. It makes the decision a documented judgment: the issue considered, the source’s relevance, the limitation identified, the mitigation attempted, and the residual risk accepted. Specificity is more defensible than a generic assertion that the hold was “comprehensive.”

Administration is part of the preservation record#

The hold file should show more than the initial notice. It should include the hold owner, the date the trigger was recognized, the custodians and sources identified, the notices sent, reminders, acknowledgements, technical preservation actions, third-party communications, and any changes in scope. Each material decision should have a date and a short explanation.

That record answers practical questions later. Was the hold issued before a known deletion event? Did the organization identify a shared workspace and preserve it? Was an administrator warned about a retention setting? When a source could not be preserved, did anyone seek a substitute or document the limitation? A dated record does not guarantee a favorable outcome, but it allows the organization to explain how it handled the information it knew about and why it acted or declined to act.

The documentation should also preserve uncertainty. An early hold may later prove broader than necessary, and new custodians or systems may appear as the dispute develops. Recording the reason for narrowing or expanding the hold makes the evolution intelligible. Silent changes invite the impression that the preservation decision was made after the fact.

How Rule 37(e) treats lost ESI#

Rule 37(e) addresses a specific failure involving electronically stored information that should have been preserved in anticipation of litigation, was lost because a party failed to take reasonable steps to preserve it, and cannot be restored or replaced. The rule therefore does not convert every preservation lapse into an automatic sanction. The court must assess the nature of the information, the party’s preservation obligations, the reasonableness of the steps taken, and whether the information can be restored or replaced before considering the prescribed relief.

Under Rule 37(e)(1), if the court finds that the loss caused prejudice to another party, it may order measures no greater than necessary to cure that prejudice. The remedial language is deliberately tied to the harm identified. The court may consider measures that restore the information’s evidentiary value, permit additional discovery, or address another prejudice caused by the loss. The provision does not authorize disproportionate relief merely because a preservation failure occurred.

Rule 37(e)(2) addresses a materially different circumstance. Only if the court finds that the party acted with the intent to deprive another party of the information’s use in the litigation may it presume that the information was unfavorable, instruct the jury that it may so presume, or dismiss the action or enter default judgment. The finding is not that the loss was accidental, that the information was important, or that the preservation process was poorly administered. The finding is that the party acted with the specified intent.

The 2015 rewrite put intent at the center of the more severe consequences. Negligence and intent lead to very different places under the rule. A negligent failure to preserve information that cannot be restored or replaced may lead to a court-ordered cure if prejudice is found. The severe presumptions and terminating sanctions require the separate finding of intent to deprive. That distinction is why the preservation record must explain what was known, what steps were considered, what was done, and what happened when the failure was discovered.

Rule 37(e) should not be read as removing the importance of preservation. The rule supplies a framework for assessing loss and relief; the underlying preservation duty still determines whether information should have remained available. The amendments to the Federal Rules of Civil Procedure took effect on 1 December 2015 and govern cases pending on, and commenced after, that date. They also placed proportionality factors into the scope of discovery itself under Rule 26(b)(1), including the parties’ relative access to relevant information. A preservation decision therefore sits within a broader discovery framework that recognizes both the information at stake and the practical ability of the parties to reach it.

Preservation, production, and the discovery record#

Preservation is one stage in a connected discovery process, not an isolated event. The Electronic Discovery Reference Model, or EDRM, identifies information governance, identification, preservation, collection, processing, review, analysis, production, and presentation as its stages. EDRM is a reference model rather than a mandatory sequence, and real matters loop between stages. A new custodian identified during review may require a hold expansion; a technical limitation encountered during collection may require a source-specific decision; and a production issue may lead back to preservation.

That loop has two implications. First, a hold should be capable of receiving new information without being treated as a finished document. Second, the preservation record should connect to the discovery record so that the organization can show how the information it preserved was processed, reviewed, analyzed, and presented. The significance of Rule 34(b)(2)(B) and (C) is also procedural: a responding party must state the grounds for an objection with specificity and state whether responsive materials are being withheld on that basis. Preservation decisions can affect the completeness of later production, but the rules governing objection and production are separate from the preservation analysis.

Technology-assisted review, or TAR, does not eliminate preservation. TAR and related methods operate after information has been collected and processed; they do not preserve data that a source deleted before collection. The same is true for predictive coding, continuous active learning, keyword search, de-duplication, email threading, and near-duplicate detection. These tools address different portions of the discovery workflow, but none substitutes for a hold that reaches the relevant custodians, sources, and deletion controls.

Where technology-assisted review is involved, the judicial decisions described in the Southern District of New York illustrate that disputes can arise about the process for finding responsive material. In Da Silva Moore v. Publicis Groupe, Magistrate Judge Andrew Peck held that computer-assisted review was an acceptable way to search for relevant ESI in appropriate cases, and the importance of the parties’ agreement mattered; District Judge Andrew Carter affirmed in April 2012. In Rio Tinto PLC v. Vale S.A., Judge Peck described permission for technology-assisted review as black-letter law where the producing party wants to use it, and Maura Grossman was later appointed special master to resolve technology-assisted review disputes. In Hyles v. City of New York, Judge Peck stated on 1 August 2016 that a court will not force a producing party to use technology-assisted review when it prefers keyword searching, consistent with Sedona Principle 6’s view that the responding party is best situated to decide how to search for and produce its own ESI. Some language in Rio Tinto and Hyles is dicta rather than holding, so those decisions signal judicial attitude rather than establish a binding rule.

Those cases do not decide whether a legal hold was adequate. They underscore why the organization should distinguish preservation from later search and production decisions. The preservation file should identify the source and its owner, the hold communication, the technical action, and the confirmation of that action. The discovery file can separately address how the preserved information was searched and reviewed. Conflating the two records makes it harder to diagnose a real failure.

What a defensible preservation effort shows#

A defensible preservation effort is documented through a dated record of what was decided and why. The record need not show perfection. It should show a recognized trigger, a reasoned hold scope, identified custodians and sources, written communications that people could understand, technical steps matched to deletion risks, reminders and acknowledgements, third-party and collaboration-tool follow-up, and a documented release when the hold ends.

When information is lost, the same record helps the organization assess the matter under Rule 37(e). It can establish what information should have been preserved, what the organization knew, whether reasonable steps were attempted, whether the information can be restored or replaced, and whether the loss appears attributable to negligence or to an intent to deprive another party. Those are matter-specific determinations for the court, but the organization can provide the factual foundation for them.

The central point is operational rather than rhetorical: a legal hold succeeds when it changes what happens to information before it disappears. The strength of the preservation record is not measured by whether it presents an unimpeachable outcome. It is measured by whether a reviewer can follow the decision path from the reasonably anticipated dispute to the sources, instructions, actions, limitations, and later release. That is the record that distinguishes a documented preservation effort from an unsupported claim that nothing was lost.