--- name: "legal_hold_management" description: "Run a legal hold end to end: recognise when the preservation duty attaches, scope custodians and data sources, issue the hold notice, suspend auto-deletion, track acknowledgements, monitor compliance, and release the hold cleanly. Use when someone mentions a legal hold, litigation hold, preservation duty, spoliation risk, a preservation letter, or a subpoena, investigation, or dispute that may need records kept." --- # Legal Hold Management ## Purpose Run a legal hold that would hold up if a court, regulator, or opposing party later asks how preservation was done. The output is a documented chain: trigger decision, scope, written notice, system holds, acknowledgements, monitoring, and a clean release. The worked framing is US federal civil litigation, where most of the published guidance sits. The process shape transfers to investigations, audits, and other jurisdictions, with counsel adjusting the legal tests. This is process guidance, not legal advice. The trigger call, the scope call, and the release call belong to counsel. This skill runs the work around those calls and records them. ## Workflow 1. **Catch the trigger and record the decision.** The duty to preserve attaches when litigation is reasonably anticipated, not when a complaint lands. The Sedona Conference Commentary on Legal Holds, Second Edition, Guideline 1 puts it as notice of a credible probability that the organisation will become involved in litigation, seriously contemplates starting litigation, or takes specific steps to start it. Complaints, subpoenas, preservation letters, regulator notices, demand letters, and serious incident reports are clear triggers. A vague rumor usually is not. Zubulake v. UBS Warburg is the standard warning: the court found the duty attached months before the formal charge was filed. Record the trigger event, the date the organisation was on notice, who decided, and the reasoning, whether the answer is hold or no hold. 2. **Scope custodians and data sources before writing anything.** Work the checklist in `references/scoping-checklist.md`. Custodians are the people likely to have relevant information, the key players in Zubulake terms, plus their managers and assistants and the data stewards who run the shared systems. Interview early custodians or use the questionnaire in `references/notice-templates.md` to find the sources nobody listed: personal phones, chat apps, local drives, paper. For each source, name the hold mechanism, not just the intention. 3. **Put the system holds in place.** Suspend or override every auto-delete path that touches in-scope material: retention policies, chat retention, backup rotation, account deletion for leavers. An in-place platform hold is the usual route for mailboxes, drives, and team sites. As one concrete example, Microsoft Purview eDiscovery holds cover Exchange mailboxes, OneDrive accounts, and the mailboxes and sites tied to Teams, Microsoft 365 Groups, and Viva Engage groups, and Microsoft states a hold may take up to 24 hours to take effect, so verify the hold status the next day rather than trusting the submission screen. Record ticket IDs and get confirmation from each system owner that the hold is in effect. 4. **Issue a written notice custodians can actually follow.** Use the templates in `references/notice-templates.md`. A good notice, following Sedona Guideline 8, names the matter in plain words, says exactly what to preserve and where, covers auto-delete and disappearing messages, gives a named contact for questions, and includes an acknowledgement mechanism that confirms the notice was received, read, and understood. Send it in a trackable way. One case shows the cost of skipping this step: in Pension Committee v. Banc of America Securities, the court treated the failure to issue a written hold as gross negligence on those facts. Treat that as a warning about written notice, not as a rule that every oral instruction is negligence everywhere. 5. **Track every custodian from notice to release.** Create the tracker with `scripts/hold_tracker.py` (one CSV per matter) and keep it current: notice date, acknowledgement due date and received date, reminders, escalation, system holds per custodian, departures, and release. A worked example sits in `assets/worked-example-tracker.csv`. The tracker is the first thing you will be asked for if preservation is challenged, so it stays a factual record: dates and ticket IDs, no commentary about custodians. 6. **Chase acknowledgements on a set rhythm.** Run `hold_tracker.py report` weekly while acknowledgements are outstanding. Reminder first, then escalation to the custodian and their manager, using the templates. Microsoft Purview follows the same shape in product form: issuance, reminders, then escalation notices until the custodian acknowledges. Sedona Guideline 8 also calls for periodic reminder notices on long holds, and Guideline 10 calls for regular compliance monitoring. No authority sets a fixed interval, so pick a cadence, write it in the matter file, and keep it. 7. **Maintain the hold while the matter lives.** Reissue or amend the notice when scope changes, custodians are added, or someone changes role or device. Handle leavers as a named step, not a surprise: a departing custodian's mailbox and device get preserved before the account closes, and the tracker records what was done. Do not rely on custodian self-collection as the only safeguard: system holds in step 3 are the backstop when a person forgets, misunderstands, or leaves. 8. **Release the hold cleanly, and only on counsel's word.** Release happens when the duty ends: the matter is concluded and related claims and appeal windows are closed, or the regulator has closed the inquiry. Before releasing, cross-check every custodian and source against all other active holds. `hold_tracker.py release --other-hold ` refuses to release a custodian who is still active on another matter, with exit code 3. Send the written release notice from the templates, record the approver and date, remove system holds under ticket IDs, and file the internal release memo. Normal retention resumes only from that point. ## Output Contract - **Trigger record:** trigger event, notice date, decision maker, hold or no-hold decision, reasoning in plain sentences. - **Scoping checklist:** the completed checklist from `references/scoping-checklist.md`, with every exclusion written down with its reason. - **Notice pack:** issuance notice, questionnaire, reminder, escalation, amendment, third-party notice, and release notice, drawn from `references/notice-templates.md` and tailored per custodian group. - **Custodian tracker:** one CSV per matter maintained by `scripts/hold_tracker.py`, plus a current report output showing overdue acknowledgements, custodians with no system hold recorded, and departed custodians. - **System hold record:** per source, the mechanism applied, ticket or change ID, owner confirmation, and the date effect was verified. - **Release pack:** cross-check result across other active holds, release notices, system hold removal tickets, and the internal release memo. ## Operating Rules - Reasonable steps are the standard, perfection is not. Rule 37(e) of the Federal Rules of Civil Procedure and its 2015 advisory committee note say a party that takes reasonable steps to preserve is not expected to be perfect. A documented, consistently followed process is the evidence of reasonableness, which is the whole point of the tracker and the trigger record. - Know what Rule 37(e) actually puts at stake, and quote it accurately. If electronically stored information that should have been preserved is lost because reasonable steps were not taken, and it cannot be restored or replaced through other discovery, a court may order measures no greater than necessary to cure prejudice. The severe outcomes, presuming the lost material was unfavorable, an adverse inference instruction, dismissal, or default, require a finding that the party acted with intent to deprive. Do not threaten custodians or managers with sanctions the rule does not support. - Written beats oral. Issue the hold in writing, get acknowledgements in writing, release in writing. An oral-only hold is hard to prove and easy to forget. - Preservation is not collection and not production. The hold stops material being lost. Deciding what gets collected, reviewed, or handed over is a later step with its own rules. Do not collect from personal devices or accounts on the strength of a hold notice alone: that decision goes to counsel. - Keep the notice plain and specific. A custodian who cannot tell what to keep will keep the wrong things or nothing. Name topics, date ranges, tools, and settings in ordinary words, and explain any technical term you cannot avoid. - Watch data protection and employment law outside the US. Sedona Guideline 12 flags this directly: preservation and monitoring that are routine in US litigation can collide with local privacy law elsewhere. Route cross-border holds through counsel in the affected country. - Never backdate, and never quietly edit the record. If a notice went out late or a source was missed, record the true dates and the fix. Courts forgive documented mistakes far more readily than tidy records that turn out to be wrong. - Privilege is counsel's call. Hold notices are often treated as instructions rather than legal advice and can end up produced in a preservation dispute. Write them so they would read well in that setting, and let counsel decide on any marking or handling.