Legal Hold Checklist

Record what created the duty to preserve — complaint served, demand letter, subpoena, government inquiry, or credible threat of litigation. The duty under Zubulake attaches when litigation is reasonably anticipated, not when filed. Note the date the duty arose; this anchors any later spoliation analysis.

Set start and end dates for the preservation window based on the underlying claims. Err earlier on the start date — overpreservation is recoverable, underpreservation is not. Reassess if claims expand during pleadings.

Build the custodian list with help from business stakeholders — direct actors, supervisors, assistants. Map data sources beyond email: Slack/Teams, OneDrive/SharePoint, mobile devices, voicemail, departed-employee archives, third-party cloud apps, paper files. Missed custodians are the most common spoliation failure.

Determine whether vendors, contractors, or cloud providers hold responsive data the firm or client controls. If yes, separate preservation letters go to each — see the third-party section that follows.

Use the firm's hold-notice template. Include subject matter, date range, categories of data to preserve, prohibition on deletion, instructions to disable auto-delete and retention rules, and a contact for questions. Mark the notice itself as privileged work product.

Send via the firm's hold-tracking platform (Onna, Exterro, Zapproved, or PMS hold module) so receipts are logged. Email-only distribution without tracking is the second-most-common spoliation failure after missed custodians.

Send preservation demand letters to vendors, opposing parties, or cloud providers identified in scope. Use certified mail or trackable email. Note that preservation letters to opposing parties also create a record of their notice for spoliation purposes.

Every custodian must acknowledge receipt and understanding. Follow up with non-responders at 3, 7, and 10 days. Escalate to the custodian's manager if no acknowledgment by day 10. Acknowledgment failures are discoverable in any later sanctions motion.

Coordinate with IT to suspend Exchange/M365 retention policies, Slack message-deletion rules, and any 30/60/90-day backup rotation that would overwrite responsive data. Document each system touched and the suspension date.

Apply M365 Purview / eDiscovery in-place holds, Google Vault holds, or equivalent on each custodian. In-place holds preserve without collecting and are reversible — preferred over forensic imaging at the notice stage.

If any custodian has left the organization or is leaving, intercept the standard offboarding wipe. Preserve the mailbox, OneDrive, and laptop image before HR processes the departure. This is a frequent spoliation trap.

Texts, iMessage, Signal, WhatsApp, and BYOD content require separate preservation steps — MDM export, forensic image, or custodian-assisted collection. Disappearing-message settings must be turned off; courts treat ongoing auto-delete after notice as willful spoliation (Goodyear, WeRide).

Boxed files, original signed documents, lab notebooks, security-camera footage, or physical product samples go to a locked location with chain-of-custody logging. Photograph the as-found state before moving anything.

Reissue the hold reminder every 90 days while the matter is open. Reminders refresh custodian attention and create a continuing record of preservation discipline. Track each reminder cycle in the hold log.

Amended pleadings, deposition testimony, and document review often surface custodians not on the original list. Issue a supplemental hold notice within 5 days of identifying each new custodian and update the IT preservation scope accordingly.

HR onboarding should flag new employees who inherit responsibilities falling within an active hold. The paralegal issues the notice on day one of their access. Stale custodian lists that don't track org changes are a documented Rule 37(e) sanctions risk.

Record any data loss, system migration, or custodian non-compliance contemporaneously. Under FRCP 37(e), reasonable steps to preserve are a defense even when ESI is lost — but only if the steps are documented at the time, not reconstructed later.

Verify with the responsible partner that the matter is resolved, all appeals exhausted, settlement releases executed, and no related or follow-on matters share the data. Premature release is irreversible if a related claim surfaces.

Send a clear written release identifying the matter being released and confirming that normal retention resumes. Custodians under multiple holds need explicit clarification that other holds remain in force.

Coordinate with IT to lift in-place holds, restore auto-delete schedules, and resume normal backup rotation. Keep collected/produced data for the matter under the firm's matter-retention schedule, not the operational retention schedule.