Legal hold for email: what it is and how it works

What a legal hold is

A legal hold is an instruction, backed by a technical control, that relevant information must be kept and not deleted while a legal matter is live or in prospect. Litigation hold means the same thing; it is also the name of a specific Microsoft Exchange feature, which is why searches for "litigation hold Office 365" land here.

A hold has two parts:

• The notice: telling the people who hold relevant information that they must preserve it, and that normal clear-outs stop for that material
• The technical hold: settings in your email platform or archive that stop the relevant mail being deleted or altered, whatever users do and whatever the retention policy says

The technical part is what an archive provides. It turns a request to "please don't delete anything" into a control that does not rely on everyone remembering.

When to apply a legal hold

The usual trigger is when litigation or an investigation is reasonably anticipated, not when a claim form arrives. In the civil courts of England and Wales, Practice Direction 31B says that "as soon as litigation is contemplated", legal representatives must tell their clients to preserve disclosable documents, including electronic documents that would otherwise be deleted under a document retention policy or in the ordinary course of business.

Typical triggers include:

• A letter before claim, or a customer or supplier threatening proceedings
• An employee grievance or tribunal claim, or a dismissal likely to be challenged
• A regulator's enquiry or an internal whistleblowing investigation
• A data breach or fraud that may lead to claims or reporting
• Instructions from your solicitor to preserve documents

Your solicitor decides whether a hold is needed and what it should cover; this page is general information, not legal advice. The practical point for IT is to be able to apply a hold quickly and precisely once someone says so.

How a hold overrides retention

Retention policies keep mail for a set period and then delete it, which is how you meet UK GDPR's storage limitation principle (see email retention and UK GDPR). A hold sits on top: while it is in place, the held mail is kept even if its retention period ends.

The last row is the one to plan for. A hold left in place indefinitely keeps personal data longer than your policy says, so record why each hold was applied and who can release it. See email retention policy for how holds fit into the wider policy.

Legal hold in Microsoft 365

Microsoft 365 has several ways to preserve mail, and Microsoft's current documentation is clear about which it prefers.

• Microsoft 365 retention policies and retention labels: Microsoft's recommended method for keeping mailbox content, including former employees' mailboxes
• eDiscovery holds: holds created inside an eDiscovery case in the Microsoft Purview portal, intended for specific, time-bound legal matters; they cannot be time-based, and if the hold is released or the case is closed, an inactive mailbox kept only by that hold is permanently deleted
• Litigation Hold: the older Exchange feature that preserves a whole mailbox, including deleted items and original versions of modified items, indefinitely or for a set number of days from when each item was received or created; Microsoft says it remains supported but recommends Microsoft 365 retention instead
• In-Place Holds: retired in Exchange Online; new In-Place Holds have not been possible since 1 July 2020

Holds in Microsoft 365 work on the live tenant. They depend on licences, on the right policy being applied before an account is deleted, and on the tenant itself. A hold in a separate archive adds an independent copy outside the tenant. More on the native options is on our Office 365 email archiving and Exchange Online Archiving pages.

Legal hold in NinjaOne Archiver

In NinjaOne Archiver, legal hold is part of the Archiver plan. NinjaOne says it freezes all retention for data placed in the hold until the hold is removed, so held mail is not deleted when its retention period ends.

1. A user with a compliance role, such as a Data Protection Officer, signs in to the organisation in the End-User Portal
2. They open Compliance > Legal Hold from the navigation menu
3. They name the hold, choose the data type and specifics from the drop-down menus, and select Enable Hold
4. The held data is kept regardless of retention until the hold is removed

Because Archiver captures mail by journaling, the archive already holds messages that users have since deleted from their mailboxes. A hold applied today can therefore preserve mail that would no longer be in the live mailbox. Combined with eDiscovery saved searches and tags, it lets you find the relevant mail, hold it and review it in the same place.

Releasing a hold and keeping a record

A hold is not finished when it is applied. Good practice includes:

• Record the matter, the scope, who asked for the hold and the date it was applied
• Review open holds regularly with whoever runs the matter
• Release the hold when your adviser confirms the matter has ended, so normal retention resumes
• Keep the record of the hold after release, in case its scope is questioned later

Contact us to talk about legal hold and archiving for your Microsoft 365 or Google Workspace mail. We can set up NinjaOne Archiver, assign the compliance roles and show your team how to apply and release holds; the legal decisions stay with you and your advisers.