What is a legal hold?

A legal hold is a formal instruction to preserve information that may be relevant to a lawsuit, investigation or claim, and to suspend normal deletion of it. In the US it is usually called a litigation hold. In Canada the same idea is framed as the duty to preserve evidence.

What it means in practice

A hold is normally a written notice from legal counsel to the people who hold relevant information, plus technical steps by IT to stop automatic deletion. Scope can include email, chat, shared drives, devices, cloud logs and backups. The Sedona Conference, a US legal research group, prefers “legal hold” because holds also apply to investigations, not just lawsuits.

The duty starts when litigation is reasonably anticipated, not when a lawsuit is filed. Sedona describes that as a credible probability of being involved in litigation.

In the US, Federal Rule of Civil Procedure 37(e) covers electronically stored information that should have been preserved but was lost because a party didn’t take reasonable steps. A court can order measures to cure the harm. If the party meant to deprive another of the information, the court can presume it was unfavourable, or even enter default judgment.

Canada has no single national rule. The duty comes from court rules and common law. The Sedona Canada Principles say that once litigation is reasonably anticipated, parties should take reasonable, good-faith steps to preserve relevant electronic information, and Ontario’s rules tell parties preparing a discovery plan to consult them. In 2026 the Supreme Court of Canada (SS&C Technologies Canada Corp. v. Bank of New York Mellon Corp., 2026 SCC 29) addressed spoliation: intentionally destroying, changing or hiding relevant evidence to influence a lawsuit. Once it is established, courts must presume the missing evidence was unfavourable to the party responsible. Law firm commentary reads the duty as starting once litigation is reasonably contemplated.

A hold is different from a separate Canadian duty. PIPEDA’s breach regulations require a record of every breach of security safeguards for 24 months after the organization determines it occurred. A hold can require keeping more, for longer.

Where it shows up in an incident

A serious breach can lead to class actions, regulator inquiries, insurer disputes and claims from customers or vendors, so preservation is a day-one task. Legal counsel, internal or external, decides when the duty has been triggered and issues the notice. IT carries out the technical side.

The tension is with recovery. Rebuilding a server destroys the evidence on it, and logs get overwritten. The Canadian Centre for Cyber Security advises against destroying forensic evidence during an investigation. An article on the American Bar Association’s cyber and data privacy committee site argues that most preservation work can be done without slowing recovery.

The usual failures are wiping or restoring systems before they are imaged, log retention short enough to overwrite evidence within days, and a notice that reaches IT but not executives, HR or anyone using chat and personal devices. Another is never releasing the hold, or never recording who received it. An incident response checklist is a good place for a preservation step.

In a tabletop exercise

Sample inject: “It is day three of a ransomware incident. A customer’s lawyer sends a letter saying they intend to sue over exposed data and demands that you preserve all related records. Meanwhile IT wants to wipe and rebuild dozens of servers today to meet its restore target, and the email system deletes messages after a short window. What gets preserved, who decides, and who has to be told today?”

Discussion question: “Who has the authority to pause automatic deletion across email, chat and logs, and how fast could they do it?”

Sources

• The Sedona Conference, Commentary on Legal Holds, Second Edition: The Trigger and the Process (2019)
• Federal Rules of Civil Procedure, Rule 37 (Legal Information Institute)
• The Sedona Conference, Sedona Canada Principles Addressing Electronic Discovery
• Slaw, Ontario e-discovery rules of civil procedure now in effect
• Supreme Court of Canada, Case in Brief, SS&C Technologies Canada Corp. v. Bank of New York Mellon Corp., 2026 SCC 29
• Blakes, Handle with care: Supreme Court of Canada affirms severe penalties for spoliation of evidence (August 2026)
• Breach of Security Safeguards Regulations, SOR/2018-64, section 6 (Justice Laws)
• Canadian Centre for Cyber Security, What to do when your organization has been compromised by a cyber attack (ITSAP.00.009)
• American Bar Association, Evidence preservation (cyber and data privacy committee)