A legal hold notice tells the people who hold relevant information to stop deleting it. It is the first visible step in meeting a duty to preserve, and when a court later asks whether your organization took reasonable steps, the notice, the acknowledgments and the reminders are usually the evidence it looks at.
This guide covers when to send a legal hold notice, who should get it, what it must say, how to track acknowledgments and reminders, and how to release a hold when the duty ends. It draws on Federal Rule of Civil Procedure 37(e) and the Sedona Conference guidelines. If you want the notices drafted for counsel’s approval, issued and tracked for you, Honeybadger provides legal hold services, data mapping and custodian interviews.
This is general information, not legal advice. Counsel decides whether a duty to preserve exists, what it covers and when it ends.
Key takeaways
- The duty to preserve usually starts when litigation is reasonably foreseeable, often before any lawsuit is filed.
- Send the notice to custodians and to the data stewards who run the systems where their data lives.
- The Sedona Conference says an effective notice explains how to preserve, names a contact, requires acknowledgment, covers auto-delete features and is followed by periodic reminders.
- A notice does not stop automatic deletion. Mailbox, chat and cloud holds have to be set in the systems too.
- Release the hold in writing when counsel says the duty has ended, and tell every custodian.
Where this guidance comes from. This article is based on Federal Rule of Civil Procedure 37(e) and its 2015 committee note, Rule 26(f), The Sedona Conference Commentary on Legal Holds, Second Edition: The Trigger & The Process (June 2019), and current vendor documentation for Microsoft Purview eDiscovery holds and Google Vault. It also reflects what our veteran-led eDiscovery and forensics team sees when holds go out late, go to the wrong people or never reach the systems that auto-delete.
When do you need to send a legal hold notice?
The Sedona Conference says a reasonable anticipation of litigation arises when an organization is on notice of a credible probability that it will be involved in litigation, seriously contemplates suing, or takes specific steps to start a case. It applies the same principle when an investigation is reasonably anticipated.
The 2015 committee note to Rule 37(e) puts it similarly: many courts hold that the duty to preserve arises when litigation is reasonably foreseeable. Common triggers include:
- A demand letter, a preservation letter or a threatened claim.
- A regulator’s inquiry, subpoena or civil investigative demand.
- An internal investigation into fraud, harassment or data theft.
- A departing executive or a dispute with a key customer, vendor or partner.
- A decision by your own organization to file suit.
The stakes are set by Rule 37(e). If electronically stored information that should have been preserved is lost because a party failed to take reasonable steps, and it cannot be restored or replaced, a court may order measures no greater than necessary to cure the prejudice. If the court finds intent to deprive the other side of the information, it may presume the information was unfavorable, instruct the jury it may or must do so, or dismiss the case or enter a default judgment.
The committee note also offers some comfort. Rule 37(e) calls for reasonable steps, not perfection, and courts weigh proportionality and a party’s sophistication. A documented, timely legal hold notice is how you show those reasonable steps. For the broader preservation picture, see our guide to forensic data preservation and legal hold.
Who should receive a legal hold notice?
Sedona Guideline 8 says a notice is most effective when the organization identifies the custodians and data stewards most likely to have discoverable information. In practice that means two groups.
- Custodians. The people involved in the events: decision makers, the employees named in the dispute, their managers and assistants, and anyone who handled the key documents.
- Data stewards. The people who control systems where relevant data lives: IT, the Microsoft 365 or Google Workspace admin, HR and payroll system owners, records management and anyone who manages backups or retention settings.
Do not forget the gaps. Departed employees’ mailboxes and laptops, shared mailboxes, team channels, phones issued to staff and outside vendors that host your data may all need attention. A data map, meaning a written inventory of where relevant information lives and how long each system keeps it, is the fastest way to find those sources before someone deletes them.
What a legal hold notice must say
No statute dictates the wording of a legal hold notice. A widely used checklist is Sedona Guideline 8, which says an effective notice communicates in a way that helps people act, may be in writing and sent by email, explains how to preserve, names who can answer questions, includes a way to acknowledge it, addresses auto-delete and other system features, is reviewed and amended when needed, and is followed by periodic reminders.
| Element | What to write | Why it matters |
|---|---|---|
| Plain-language purpose | The organization must keep certain information because of a dispute or investigation | People follow instructions they understand |
| Matter description | A short neutral description, without legal analysis or privileged detail | Lets recipients recognize relevant material |
| Date range and subjects | The time period, people, products, deals or events covered | Keeps scope proportional and specific |
| Data types and locations | Email, chat and text messages, documents, shared drives, phones, laptops, paper, cloud apps, personal devices used for work | Vague “keep everything” notices get ignored |
| What to do and not do | Do not delete, edit, wipe, reset or move; turn off auto-delete where you control it; do not forward data to personal accounts | Sedona Guideline 8(c) and 8(e) |
| Duration | The hold lasts until a written release, regardless of normal retention schedules | Prevents routine deletion from resuming |
| Contact person | Name or role of who answers questions | Sedona Guideline 8(c) |
| Acknowledgment | A deadline to confirm the notice was received, read and understood | Sedona Guideline 8(d); proves receipt |
| Confidentiality line | Do not discuss the matter beyond what is needed to comply | Limits new discoverable chatter |
Keep the notice short enough to read in a few minutes. Send a separate, more technical instruction to data stewards that lists the exact systems, accounts and settings to change.
How to issue a legal hold notice, step by step
- Record the trigger. Write down the date, the event and counsel’s decision that a hold is needed. Sedona Guideline 5 says decisions are judged by what was reasonable when they were made, so the record matters.
- Define the scope. Counsel sets the subjects, date range and data types, weighing the factors in Sedona Guideline 7: the issues, accessibility of the data, its probative value and the burden of preserving it.
- Map the data. Interview key custodians and IT to find where relevant information lives, including texts, chat apps and departed employees’ accounts.
- Draft and approve. Counsel approves the custodian notice and the data steward instructions.
- Send it. Email is acceptable under Sedona Guideline 8(b). Use a method that records delivery and opens.
- Set system holds. IT places mailbox, chat and cloud holds and pauses reimaging and account deletion for in-scope users.
- Track acknowledgments. Follow up on anyone who has not confirmed by the deadline, then escalate to counsel.
- Document everything. Keep the notice versions, distribution list, acknowledgments, reminders and system hold settings in one file.
Need a hold out this week? Tell us the matter, the custodians you know about and your deadlines, and we will scope notice drafting, tracking and system holds with your counsel. Request legal hold support online, or book a consultation online to walk through scope first.
A notice is not enough: set system holds too
A common gap is assuming the notice stops deletion. It does not. Retention policies, disappearing messages, mailbox cleanup rules and account deletion keep running unless someone changes them. Sedona Guideline 8(e) specifically calls out auto-delete features that should be suspended.
Vendor tools help, but each has details that trip people up. As of October 2026:
- Microsoft Purview eDiscovery. Holds can cover Exchange mailboxes, OneDrive accounts, SharePoint sites and the mailboxes and sites behind Teams and Microsoft 365 groups. Microsoft says a new hold can take up to 24 hours to take effect, and group membership is captured as a snapshot, so people added to a group later are not automatically held. Microsoft also says an eDiscovery hold always takes precedence over retention settings.
- Google Vault. Holds can be placed on accounts, organizational units and groups, override retention rules and never expire, and held data stays protected even if the user deletes it. Google warns that deleting a user or removing a required license may irreversibly purge that user’s data.
- Phones and chat apps. Text messages, messaging apps and personal devices used for work often sit outside these tools. They may need a settings change or a defensible collection rather than a notice alone.
Departing employees deserve special attention. A laptop that is reimaged or a phone that is reset during a hold can destroy the most important evidence. Our guide to departing employee data theft investigations explains what to secure first, and our article on Slack and Teams message forensics covers chat platforms.
Acknowledgments, reminders and new custodians
Sedona Guideline 8(d) calls for a way for each recipient to confirm the notice was received, read and understood. Guideline 10 says compliance should be regularly monitored, and Guideline 8(g) calls for periodic reminders so the hold stays fresh. A workable routine looks like this:
- Set an acknowledgment deadline of a few business days and log each response with a date.
- Escalate non-responders to their manager and to counsel, and record the escalation.
- Send reminders on a fixed schedule, such as quarterly, and whenever the scope changes.
- Add new custodians as the case develops, and check that new hires into covered roles get the notice.
- When a custodian leaves, preserve their mailbox, files and devices before HR and IT run normal offboarding.
Guideline 8(f) adds that the notice itself should be reviewed and amended when necessary. If new claims, products or date ranges come into the case, send an updated notice rather than relying on people to infer the change.
How to release a legal hold
Sedona Guideline 11 says every hold process should include a way to release the hold when the duty to preserve ends, so the organization can return to its normal retention schedule. Holds that run forever cost money in storage and keep data you no longer need, which can raise your exposure in a future breach.
- Counsel confirms in writing that the matter has ended, for example through final judgment, settlement or a closed investigation, and that any appeal periods have run.
- Check whether the same custodians or data are covered by another active hold before releasing anything.
- Send a written release notice to each custodian and data steward.
- Remove system holds only for the released matter, and record the date.
- Return to the normal retention schedule and file the release with the hold records.
Common legal hold notice mistakes
- Waiting for the complaint. The duty can start with a demand letter or an internal investigation.
- Writing a vague notice. “Keep everything” without naming data types, apps and phones gets ignored.
- Skipping IT. Without system holds, auto-delete keeps running in the background.
- No acknowledgment tracking. If you cannot show who received it, you cannot show reasonable steps.
- Forgetting departed employees. Their accounts are often the first to be deleted under normal offboarding.
- Never releasing. Open-ended holds keep data and cost you money long after the matter ends.
Once data is preserved, it often has to be collected, processed and reviewed. Our eDiscovery and litigation support guide explains how holds connect to collection and production.
How Honeybadger supports legal hold notices
Honeybadger Solutions is a veteran-owned firm based in Casa Grande, Arizona, an Arizona DPS-licensed private investigation agency (License No. 1759795), and delivers eDiscovery support nationwide. Counsel directs every legal judgment; we run the process and keep the records.
- Notice drafting for counsel’s approval, issuance, acknowledgment tracking and escalation of non-responders.
- Monthly hold administration: reminders, new custodians, departures and releases counsel authorizes.
- Data mapping and custodian interviews that produce a written source map of mailboxes, chat, shared drives, phones, SaaS apps and backups.
- Guidance to your IT team on Microsoft 365 and Google Workspace holds, plus defensible collection when a notice is not enough.
- Encrypted preservation storage, with a path to document review and hosting when review starts.
We work for the organization through its counsel, or for counsel directly, and we access only systems the organization owns or controls. Use the request form to send the matter, the custodians you know about and your deadlines, or book a consultation to talk through scope first.
Why the online intake is faster than a phone call. The request takes about two minutes. Picking the service routes it straight to the specialist team that handles that type of case, so there is no phone tag and no waiting for a call-back to explain it all again. For anything happening right now, use the urgent intake form.
Frequently asked questions
When should a legal hold notice be sent?
As soon as practicable after litigation or an investigation becomes reasonably foreseeable, which is often before a lawsuit is filed. Counsel makes that call, and the date and reason should be recorded.
Who should receive a legal hold notice?
The custodians most likely to have relevant information and the data stewards, such as IT and system administrators, who control where that information is stored. Departed employees’ accounts and shared mailboxes need attention too.
Can a legal hold notice be sent by email?
Yes. The Sedona Conference says a notice may be in writing and sent by email, as long as it is in an appropriate form and includes a way for recipients to acknowledge it.
Do employees have to acknowledge a legal hold notice?
Sedona recommends a mechanism for each recipient to confirm the notice was received, read and understood. Tracking those acknowledgments and escalating non-responders is how you show reasonable steps.
How often should legal hold reminders go out?
No rule sets a fixed interval. Sedona calls for periodic reminders so the hold stays fresh. A fixed schedule, such as quarterly, plus a reminder whenever the scope changes is easy to follow and document.
How do you release a legal hold?
Counsel confirms in writing that the duty to preserve has ended, you check for overlapping holds, send a written release to every custodian and data steward, then remove system holds for that matter only.
Sources and further reading
- Federal Rule of Civil Procedure 37 and committee notes (LII) — Rule 37(e) remedies, reasonable steps and when the duty arises.
- Federal Rule of Civil Procedure 26 (LII) — Rule 26(f) discovery plan and preservation of ESI.
- The Sedona Conference Commentary on Legal Holds, Second Edition (June 2019) — Publication page for the full commentary.
- Sedona Conference legal holds handout (2019) — The 12 guidelines on triggers, notices, reminders and release.
- Microsoft Learn: Create holds in eDiscovery — Hold locations, 24-hour delay and group membership snapshots.
- Microsoft Learn: Learn about retention policies and labels — eDiscovery holds take precedence over retention settings.
- Google Vault Help: Get started with holds — Holds override retention rules and protect data users delete.
- Google Vault Help — Hold scope and the user deletion warning.
Written and reviewed by the Honeybadger Solutions security and investigations team, a veteran-led Arizona firm (Arizona DPS private investigation agency license No. 1759795). Facts checked against the cited sources on October 2, 2026. This article is general information, not legal advice.