Litigation holds and preservation

Principle 3 of the Sedona Canada Principles Addressing Electronic Discovery (Third Edition) states that as soon as litigation is reasonably anticipated, parties must consider their obligation to take reasonable and good-faith steps to preserve potentially relevant electronically stored information. That moment often comes well before a claim is issued: a demand letter, a dismissal that is likely to be contested, a regulator's inquiry, or a cyber incident that may lead to claims.

Whether and when the duty has arisen in a particular matter is for counsel to advise. Our job begins when counsel decides to preserve: making sure the systems actually stop deleting what needs to be kept.

A proportionate hold, consistent with Sedona Canada Principle 2, targets the people and systems likely to hold relevant information, not the whole organization by default.

Place the custodian's mailbox on Litigation Hold. Microsoft says this preserves all mailbox content, including deleted items and original versions of modified items, and also holds the user's archive mailbox. The hold can take up to 60 minutes to take effect. Pair it with written custodian notices and a scope agreed with counsel, so preservation is defensible later.

In Microsoft 365, holds are created in Microsoft Purview eDiscovery: within a case, the Hold policies tab lets you place mailboxes, OneDrive accounts and SharePoint sites (including those behind Teams and Microsoft 365 groups) on hold, either entirely or by query and date range. Microsoft notes that a hold can take up to 24 hours to take effect, and that some query-based and custodian-scoped hold features require higher licence tiers. Exchange Online's mailbox-level Litigation Hold remains available as an alternative for whole mailboxes.

In Google Workspace, holds are placed through Google Vault matters on editions that include Vault, covering Gmail, Drive, Chat (where history is on), Meet recordings and other supported data. Holds in either platform override the user's ability to permanently delete held content and override retention rules that would otherwise remove it.

After applying holds we verify them: confirming each location shows as on hold, and testing that deleted items are retained. A hold that silently failed on one mailbox is worse than no hold, because everyone believes the data is safe.

Technical holds do not cover everything. Phones, personal devices used for work, paper, and data in third-party apps depend on people. A written hold notice tells custodians what to keep, in plain language, and records that they were told.

• What the matter concerns, in general terms, and the relevant period
• Categories of information and locations to preserve, including texts and messaging apps
• A clear instruction not to delete, wipe, reset or replace devices
• Who to contact with questions
• A request for written acknowledgment, and periodic reminders

The most common preservation failure is offboarding. When a Microsoft 365 user account is deleted without a hold in place, the mailbox is soft-deleted and then permanently removed. Microsoft's documentation explains that if a hold is applied before the account is deleted, the mailbox becomes an inactive mailbox and its content is retained.

We help clients build a step into offboarding: check whether the person is a custodian on any hold before their licence is removed, their laptop is reimaged, or their phone is reset. For Google Workspace, Vault holds are tied to user licences, so licence removal needs the same check.

Holds should not run forever. When the matter is resolved and appeal periods have passed, counsel confirms release in writing. Before removing a hold we check whether the same custodians are subject to any other hold or regulatory retention requirement, then release it and record the date. Content then becomes subject to normal retention, which may mean deletion, so the decision is documented.