A legal hold notice is not a formality sent after a dispute becomes visible. It is an operational instruction that can determine whether relevant evidence remains available when counsel needs it. The best practices for legal hold notices begin with speed, but they depend just as heavily on scope, clear custodial direction, documented follow-up, and a preservation process that holds up under scrutiny.
For law firms, in-house teams, and government agencies managing sensitive matters, the notice is only one component of a defensible preservation program. The real test is whether the organization can show that it identified likely sources, informed the right people, suspended ordinary deletion where necessary, and responded when custodians did not comply.
Issue the Notice When the Duty to Preserve Is Reasonably Anticipated
A legal hold should not wait for a complaint, subpoena, or formal discovery request if litigation, an investigation, or a regulatory inquiry is reasonably anticipated. Delayed action creates a predictable problem: ordinary business systems may continue deleting email, chat messages, mobile data, backup content, or paper files before preservation steps are in place.
The trigger is fact-specific. A demand letter may be enough in one matter. In another, an employee complaint, a safety incident, an internal investigation, a government inquiry, or a contract dispute may establish the need to preserve. Counsel should assess the facts promptly and document the basis for the preservation decision. That record is useful if timing is later challenged.
Speed does not mean issuing an overbroad notice without analysis. A rushed notice sent to hundreds of employees can create unnecessary burden, confuse recipients, and complicate later release. The better approach is to preserve broadly enough to protect potentially relevant information while refining scope as facts develop.
Define Scope Before Sending the Legal Hold Notice
A defensible legal hold notice identifies what must be preserved and why. Vague instructions such as “save all documents related to this matter” invite inconsistent interpretation. A custodian may preserve a folder of obvious emails while overlooking text messages, shared-drive material, handwritten notes, or data stored on a personal device used for work.
Start with a focused matter description. It should provide enough context for custodians to recognize relevant information without disclosing privileged strategy or confidential investigative details unnecessarily. Define the relevant date range, people, departments, transactions, projects, locations, and subject areas. If the date range is preliminary, say so and reserve the right to revise it.
The notice should also identify likely information types in plain language. Depending on the matter, that may include email, attachments, calendars, Microsoft Teams or Slack messages, text messages, call logs, cloud-storage files, databases, paper records, photographs, recordings, social media content, and data on company-issued or personal devices.
Scope should account for the organization’s actual information environment. A hold that mentions email but ignores a team’s primary messaging platform is not tailored to how the business operates. Early interviews with information technology, records management, human resources, and knowledgeable business personnel can expose systems and repositories that a standard notice would miss.
Identify Custodians and Data Sources Separately
Custodians are people who may possess relevant information. Data sources are the places where that information resides. Treating them as the same exercise leaves gaps.
A senior executive may be a key custodian, but relevant material may also exist in the accounts and systems of administrative staff, project managers, departing employees, vendors, and former personnel. Conversely, an enterprise database may contain critical evidence even if no individual custodian can personally preserve or export it.
Create a preservation map that connects each likely custodian to the systems, devices, physical records, and third-party platforms they use. Include shared mailboxes, shared drives, departmental repositories, archived material, litigation databases, and hard-copy files. For a high-stakes matter, the map should also capture what is already subject to retention schedules, automatic deletion, or routine overwriting.
This step matters especially when mobile devices are in scope. Text messages and application data can disappear through device replacement, mobile-device-management settings, message expiration policies, or user action. When potentially relevant iPhone, Android, or cloud data is identified, preservation and forensic collection decisions should be made early, with chain-of-custody controls appropriate to the matter.
Make Instructions Specific Enough to Follow
The strongest notices are written for busy professionals, not only for lawyers. State what recipients must do, what they must not do, and where to get help. Avoid unexplained legal terms when a direct instruction will work better.
Tell custodians not to delete, alter, overwrite, discard, or destroy potentially relevant information. Explain that they must preserve content across every location where they may have stored or communicated about the subject matter. If they have personal devices, personal email accounts, or home storage locations containing business-related information, the notice should clearly address those sources and provide a process for reporting them to counsel.
The notice should also address routine deletion. Recipients need to know that emptying deleted-items folders, replacing devices, disposing of paper files, changing phones, deleting chat threads, or allowing auto-delete settings to continue may affect preservation. At the organizational level, counsel and IT should separately determine whether legal hold measures are needed to suspend deletion in email archives, collaboration platforms, backup systems, surveillance systems, or records-management applications.
Acknowledge that preserving information does not mean employees should forward sensitive files to themselves, print unnecessary copies, or move documents into unapproved locations. Preservation should maintain security and metadata, not create uncontrolled duplicates.
Require Acknowledgment and Verify Understanding
Sending a notice is not the same as confirming compliance. Each recipient should acknowledge receipt and certify that they understand their obligations. An electronic workflow can efficiently track delivery, acknowledgment status, reminders, and notice versions, but the process still requires active oversight.
Nonresponsive custodians require follow-up. A reminder may be appropriate for an initial missed acknowledgment; a supervisor escalation or direct conversation may be necessary when a key custodian remains unresponsive. Document each effort. In a later dispute, the organization may need to demonstrate not only that notice was issued, but that it took reasonable steps to obtain compliance.
Acknowledgment alone is not always enough. For central custodians or sensitive data sources, counsel should conduct a short preservation interview. Ask where relevant information exists, whether the custodian uses personal devices or messaging applications, whether others may possess related materials, and whether any data is subject to deletion or retention limitations. These conversations frequently identify sources that were not apparent at the outset.
Monitor the Hold as the Matter Changes
Legal holds are not static. Claims change, new parties appear, employees leave, systems migrate, and investigations reveal additional facts. A notice that was reasonable at the outset can become inadequate if it is never revisited.
Set a review cadence appropriate to the matter’s risk and pace. For active litigation or government investigations, periodic review may be necessary. For a long-running commercial dispute with limited activity, a less frequent but documented review may be sufficient. The key is to reassess custodians, date ranges, repositories, and deletion risks when material developments occur.
Update notices when scope changes, and maintain version control. Custodians should understand whether an updated notice replaces, expands, or narrows earlier instructions. Do not silently narrow a hold simply because a case appears to be resolving. Release should occur only after counsel determines that the duty to preserve has ended or that specific sources are no longer required.
Preserve Documentation of the Preservation Process
A defensible process produces records. Maintain the hold notice, recipient list, issue date, acknowledgment history, reminders, escalation notes, custodian interview records, preservation actions, IT suspension steps, and release notices. Keep a clear record of why custodians and data sources were added or excluded.
Documentation should be organized and accessible, particularly when multiple law firms, business units, or service providers are involved. For large matters, a centralized matter file and clear ownership reduce the risk that critical decisions sit in individual inboxes.
Where evidence is collected, preserve chain-of-custody records, collection logs, source details, and processing documentation. This is particularly important for mobile-device collections, physical records, and materials transferred between offices or vendors. A reliable eDiscovery workflow should connect preservation to collection, review, production, and trial preparation without losing control of the underlying record.
Use the Notice to Create a Defensible Workflow
The best legal hold notice is direct, specific, and supported by action. It tells people what to preserve, while the legal and technical teams ensure that systems, devices, and physical records are actually protected. That distinction matters when the volume is high, the data is dispersed, or the consequences of spoliation are significant.
For complex matters, counsel should bring litigation support and forensic collection resources into the process early. The right operational support can help preserve email, mobile data, shared repositories, scanned records, and legacy paper files while maintaining defensible handling from the first notice through production.
A clear notice gives custodians direction. A disciplined preservation program gives counsel confidence that the direction was carried out. When the matter is tested, that is the record that matters.
