The email arrives on a Tuesday afternoon. It is from a law firm you have never heard of, it uses the phrase “preserve all documents,” and it names a former employee you have not thought about in two years. Your first instinct is to forward it to your attorney. Your second instinct, four seconds later, is a cold feeling as you remember the rule you turned on last year that automatically deletes email older than thirty six months.
This article is general information, not legal advice. We are an IT company, not a law firm. Whether a preservation obligation applies to you, when it started, and what it covers are legal questions for an attorney. What we can do is explain the technology side, so that when your attorney tells you what is required, you already know where your data lives and who can reach the controls. That preparation is the difference between a stressful week and an expensive one.
What a preservation obligation generally means
The broad idea is simple even though applying it is not. Once litigation is reasonably anticipated, a party is generally expected to stop destroying information that might be relevant to it. A continuing legal education paper on litigation holds hosted by the United States District Court for the District of Nebraska, written by attorney Stephanie F. Stacy, puts the trigger this way: “The obligation to preserve evidence begins when a party knows or should have known that the evidence is relevant to future or current litigation.” Note the “should have known.”
On the federal side, Rule 37(e) of the Federal Rules of Civil Procedure addresses what happens when electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery. The rule contemplates that a court may order measures in response, and it treats loss where a party acted with intent to deprive another party of the information differently from ordinary loss. We are describing that rule’s shape, not applying it to you.
The practical translation is short. When your attorney says a hold is in place, “delete” is a word you cannot use on the affected accounts until they say otherwise.
Why the deletion rule you set up last year suddenly matters
Automatic deletion usually gets installed for good reasons. It cuts clutter, storage cost, and the volume of old material waiting to be stolen. We have recommended it ourselves. The problem is that it is a machine, it runs on a schedule, and it has no idea a lawsuit exists. The Nebraska paper describes the expected response as suspending the routine document retention and destruction policy and putting a litigation hold in place to ensure preservation of relevant documents. Easy to say, easy to get wrong, because deletion in a modern business is not one setting in one place.
- The company wide retention policy. The rule that quietly removes mail past a certain age, plus trash folders that empty on a timer.
- Individual mailbox rules. The person who built a rule years ago to auto delete anything from a specific sender, and forgot.
- Chat and collaboration tools. Team chat, file sharing, and meeting recordings carry their own retention settings that nobody has reviewed.
- Departed employee accounts. Mailboxes converted or closed at offboarding, and the automation that eventually purges them.
- Backups with their own expiration. A backup set that rolls off after a fixed window whether or not anyone is watching.
Turning off one of these and assuming you are finished is the most common mistake we see. Somebody has to walk the whole list and write down what changed and when.
A hold and a search are two different jobs
People collapse these into one task and then panic, because the combined job sounds impossible. Separate them and both become manageable.
The hold is defensive and urgent. Its only purpose is to stop the clock. Nothing gets deleted, aged out, or purged on the accounts your attorney identifies. It does not require you to read, organize, or produce anything. It is a freeze, and it should happen fast.
The search is investigative and deliberate. It comes after, on a scope your attorney defines: which people, which dates, which terms. The search can take weeks. The hold should take hours. Rushing the search before the freeze is complete is how information disappears while everyone is busy being productive.
Who should be in the room
- Your attorney, driving. Scope, timing, and the wording of any hold notice are legal decisions. The technical work follows from what they define.
- One owner or executive. Someone who can say yes quickly, because a hold that waits for a committee is a hold that ran late.
- Whoever holds administrative access. Your internal IT person or your IT provider, executing rather than deciding.
- Nobody else, at first. The people whose accounts are involved get written notice from counsel. They do not get a hallway conversation, and they do not get put in charge of their own data.
That last point deserves weight. The Nebraska paper advises against leaving a voicemail or sending a casual email to communicate a hold, and against walking down the hallway to tell a custodian to “save everything.” It also notes a hold notice should reach all key players rather than only the official record custodian, and that someone has to confirm the hold was implemented and is being followed. Preservation should be something your system does centrally, not something eleven people execute correctly on their own.
The preparation that makes this survivable
- Know where mail actually lives. One written page: email platform, chat platform, file storage, where old employee accounts go, and how far back each reaches. If you cannot answer that today, it is your first gap.
- Make sure someone at your company holds real administrative access. Not a former web developer. Not a vendor who stopped returning calls. If you cannot reach the admin console within the hour, fix that this month.
- Keep company communication on company systems. Business done in personal text threads and personal email is the hardest kind to find or freeze. That is the risk we described in our article on shadow IT and the hidden security, legal, and financial risk inside your own organization.
- Write down your retention settings and review them yearly. Every deletion rule, where it lives, who set it, and how to switch it off.
- Keep a log when a hold happens. What was frozen, by whom, on what date, and what was verified afterward. Notes written at the time beat a reconstruction six months later.
The bottom line
A preservation letter is a bad day, not a catastrophe, as long as your data sits somewhere central and somebody can reach the controls. The businesses that get hurt are usually not the ones that did something wrong. They are the ones that could not find their own information, or that discovered an automated process had been quietly deleting things all along. Freeze first, search second, keep the circle small, write down what you did. The rest is your attorney’s job: this is general information, not legal advice, and an attorney has to confirm what applies to you.
Harrison Ward Technology helps small and mid sized businesses in Denton County get their email, files, and chat into a shape where a request like this is a phone call rather than a crisis: central administration, documented retention, clean offboarding, and access that belongs to you. If you are not confident you could freeze your own email today, our article on why cybersecurity is no longer optional for mid sized businesses is a good place to begin. Contact us today
Sources:
Comments are closed