Checklist · Litigation

Issuing a Litigation Hold and Preserving ESI: A Practical Checklist

Type
Checklist
Jurisdiction
National
Date
2024-10-04
Topic
Litigation

A litigation hold is the set of steps a party takes to preserve potentially relevant electronically stored information once litigation is reasonably anticipated. This checklist walks through the full lifecycle: identifying the trigger date, scoping custodians and data sources across email, chat, cloud, and mobile, drafting and distributing a defensible hold notice, suspending auto-deletion, monitoring compliance, and eventually collecting and producing the data. It explains the Rule 37(e) spoliation framework introduced by the 2015 amendments and the prejudice-versus-intent distinction that determines whether a court imposes curative measures or case-ending sanctions. Grounded in Zubulake v. UBS Warburg and the Sedona Principles, the guide gives litigators, in-house counsel, and IT teams a phase-by-phase workflow with worked examples and common traps. Get the hold right early and you protect both your evidence and your credibility with the court.

Issuing a Litigation Hold and Preserving ESI: A Practical Checklist

Litigation > Discovery | Published 4 October 2024 - Updated 8 June 2025 | UpLaw - uplaw.us

The most expensive mistake in modern litigation is not a bad argument. It is a deleted email. A litigation hold is cheap insurance against a catastrophe you cannot undo — and the duty to preserve almost always attaches before the complaint is ever filed.

Keywords: litigation hold, ESI preservation, duty to preserve, spoliation, Rule 37(e), Zubulake, hold notice, custodians, auto-deletion, cloud and chat data, Sedona Principles, adverse inference, forensic imaging, form of production

How to use this checklist

Preservation is not a single event; it is a process with a beginning (the trigger), a middle (scoping, notice, and monitoring), and an end (collection, production, and release). This checklist is organized as phases. Under each phase are real - [ ] action items you can lift into a workplan, followed by a short "Why it matters, and the traps" explanation that ties the tasks back to the governing law. A running hypothetical — Larkspur Analytics, a mid-size data-science company — makes the doctrine concrete.

The governing sources are compact but unforgiving. The common-law duty to preserve was articulated for the digital age in Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 (S.D.N.Y. 2003), and Silvestri v. General Motors Corp., 271 F.3d 583 (4th Cir. 2001). The remedy for getting it wrong now lives in Fed. R. Civ. P. 37(e), rewritten in the 2015 amendments to create a single, nationwide standard for lost ESI. The practical playbook — proportionality, defensible process, form of production — comes from Rules 26(f) and 34 and The Sedona Principles (Third Edition). If you want the wider map of how preservation fits into the discovery machine, keep Federal Civil Discovery: Mastering the Tools, Rules, and Pitfalls and The Federal Discovery Toolkit: A Roadmap From Rule 26(f) to Sanctions open in another tab.

Phase 1 — Identify the trigger: when the duty to preserve attaches

  • [ ] Determine whether litigation is "reasonably anticipated," not merely possible.
  • [ ] Record a specific trigger date and the facts that establish it (demand letter, threat, filed complaint, EEOC charge, subpoena, internal incident).
  • [ ] Ask whether you anticipate litigation you might bring — the duty runs to plaintiffs too.
  • [ ] Diary the trigger date in the matter file; you will defend it later.
  • [ ] Loop in counsel immediately; the trigger analysis is a legal judgment, not an IT one.

Why it matters, and the traps. The duty to preserve is triggered when a party "reasonably anticipates litigation," a standard that almost always predates the filing of a complaint. Zubulake made this the law of e-discovery, and Rule 37(e) presupposes it: the rule only bites where ESI "should have been preserved in the anticipation or conduct of litigation." The trigger is objective and fact-driven. A hostile demand letter, a threat to "see you in court," a formal EEOC charge, a preservation demand, or even a serious internal incident an experienced lawyer would recognize as litigation-bound can all start the clock.

Two traps recur. First, waiting for the complaint. By the time you are served, months of auto-deletion may have already run — and the court will measure your duty from the earlier trigger, not the filing. Second, forgetting that the duty is symmetric. A prospective plaintiff who lets its own evidence evaporate before suing can be sanctioned just as a defendant can; Silvestri dismissed a plaintiff's claim where he let the accident vehicle be repaired before the defendant could inspect it. If you are evaluating whether to sue, preserve first — see Evaluating a New Civil Case: A Practical Checklist and Writing an Effective Demand Letter: A Practical Checklist, because the demand letter you send is often the trigger for the other side.

Worked example. On 12 March, Larkspur Analytics receives a demand letter from counsel for a former enterprise client, alleging that Larkspur misused confidential datasets and threatening suit under the DTSA within thirty days. Larkspur's GC, Priya Raman, does not wait. She records 12 March as the trigger date, notes the letter as the triggering fact, and treats the duty to preserve as live that afternoon — even though no complaint exists and none may ever be filed.

Phase 2 — Scope the hold: custodians, systems, and data sources

  • [ ] Identify key custodians — the people likely to hold relevant information (decision-makers, witnesses, their assistants, IT admins).
  • [ ] Map the data sources: email, network shares, document management, ERP/CRM, ticketing, source-code repos, and backups.
  • [ ] Inventory collaboration and chat: Slack, Microsoft Teams, chat channels, and DMs.
  • [ ] Address cloud services: Google Workspace, Microsoft 365, Box, Dropbox, Salesforce, and third-party SaaS.
  • [ ] Flag mobile and personal devices, BYOD, and text/SMS relevant to the dispute.
  • [ ] Identify ephemeral messaging (Signal, disappearing messages, auto-delete channels) and stop the disappearing.
  • [ ] Capture departing-employee data before offboarding wipes or reissues the device.
  • [ ] Interview IT and each custodian about where they actually keep things.

Why it matters, and the traps. Scope is where holds succeed or fail, and it is governed by proportionality: Rule 26(b)(1) and the Sedona Principles both make clear you must preserve what is relevant and proportionate, not every byte the company owns. But underscoping is the far more common and more dangerous error. Courts expect a reasonable, good-faith investigation into where relevant ESI lives — and "we forgot about Slack" is not a defense a court will credit in 2025. The Sedona Principles (Third Edition) direct that preservation and production decisions be made by the responding party through a defensible process, but "defensible" requires that you actually looked.

The three modern traps: (1) Chat and collaboration tools. Slack and Teams are treated as ordinary business records. If your Slack workspace is on a free or standard plan that only retains messages for a limited window, you must change the retention setting the moment the hold attaches. (2) Ephemeral and disappearing messages. Auto-deleting messages are radioactive in litigation; continuing to use disappearing-message features after a trigger looks like intentional destruction under Rule 37(e)(2). (3) Departing employees. The single most common source of catastrophic spoliation is the laptop of an employee who quit, wiped and reissued as a matter of routine. When the departing employee is also the alleged bad actor, that laptop is the case. See Protecting Trade Secrets When Employees Leave: A Practical Checklist.

Worked example. Priya maps Larkspur's sources: the Google Workspace tenant (Gmail, Drive, shared drives), the company Slack (where the data-science team argued about which client datasets were "reusable"), the GitHub org, and — critically — the MacBook of Devin Okafor, the lead engineer who resigned two weeks before the demand letter. IT was scheduled to wipe and reissue Devin's laptop on 15 March. Priya freezes that ticket, pulls the laptop from the reissue queue, and adds Devin as a custodian even though he no longer works there. She also discovers the data-science channel had disappearing messages enabled; she has IT disable it and preserve what remains.

Phase 3 — Draft the hold notice and the litigation-hold memo

  • [ ] Draft a clear, plain-English hold notice to each custodian.
  • [ ] State the matter, the duty to preserve, and that it overrides routine deletion policies.
  • [ ] Describe the categories and date range of information to preserve, specifically.
  • [ ] Include a non-exhaustive list of sources (email, Slack, texts, cloud folders, notebooks, devices).
  • [ ] Give affirmative instructions: do not delete, alter, or move relevant material.
  • [ ] Require an acknowledgment of receipt and understanding.
  • [ ] Provide a contact for questions and mark the notice privileged and confidential.
  • [ ] Prepare a separate litigation-hold memo to file documenting scope decisions and rationale.

Why it matters, and the traps. Zubulake V placed an affirmative obligation on counsel to issue a written litigation hold and to communicate directly with key players — a duty that has hardened into universal practice. The notice must be understandable to non-lawyers, specific enough that a custodian knows what to keep, and broad enough that it does not accidentally exclude the smoking gun. Over-generic notices ("preserve everything relevant") shift the identification burden onto employees who cannot make relevance calls; over-narrow notices invite the argument that you tipped custodians off about what to quietly lose.

Two structural points. First, the acknowledgment is not bureaucratic theater — it is your proof, later, that the custodian received and understood the hold. Second, keep the notice separate from your internal analysis. The hold notice itself is often discoverable in a spoliation fight; the litigation-hold memo capturing your privileged reasoning about scope should be a separate, protected document. For how privilege lines are drawn and logged in discovery generally, see Building a Privilege Log: A Practical Checklist and note the clawback protections of Fed. R. Evid. 502, which you will invoke later at the collection stage.

Worked example. Larkspur's notice tells each recipient: preserve all communications and documents relating to the Meridian client engagement and any reuse of Meridian datasets, from 1 January of the prior year to the present, including Gmail, Google Drive, Slack messages and DMs, GitHub commits and issues, personal-device texts on the subject, and any local files. It instructs recipients not to delete or move anything, requires a reply acknowledging the hold within 48 hours, and names Priya as the contact. For Devin, who no longer has email access, Larkspur's counsel sends a preservation demand to Devin's personal counsel and forensically preserves the returned laptop before doing anything else.

Phase 4 — Suspend auto-deletion and document the process

  • [ ] Suspend email auto-archive/auto-delete for held custodians.
  • [ ] Change Slack/Teams retention to preserve rather than purge in-scope messages.
  • [ ] Halt or preserve backup-tape rotation and recycling for the relevant window.
  • [ ] Suspend cloud trash/version purging and enable retention/legal-hold features (Google Vault, Microsoft Purview eDiscovery hold).
  • [ ] Disable disappearing-message features on relevant channels.
  • [ ] Confirm device reissue/wipe processes exclude held custodians.
  • [ ] Log who did what, when, and keep IT tickets as evidence of good faith.

Why it matters, and the traps. The 2015 Committee Note to Rule 37(e) is explicit that a party's routine, good-faith operation of an information system — including automatic deletion — is a relevant factor, but only if the party took reasonable steps to suspend it once the duty attached. Letting the auto-delete keep running after a trigger is the paradigm of "failure to take reasonable steps to preserve." Most modern platforms have native legal-hold tooling — Google Vault, Microsoft Purview, Slack's Enterprise/legal-hold exports — and courts expect a sophisticated litigant to use them.

The traps here are operational. First, backups. Rule 37(e) and the Sedona Principles do not require you to preserve every disaster-recovery backup, but if backups are the only remaining copy of otherwise-deleted relevant data, they become preservation-critical. Second, the gap between the notice and the switch. Sending the hold notice does not stop the servers; someone in IT has to actually change the retention settings. Litigants get sanctioned all the time for a hold that existed on paper while auto-deletion quietly kept running. Third, document your steps. Your defense to a spoliation motion is a paper trail showing reasonable, contemporaneous action. Keep the IT tickets.

Worked example. Larkspur's IT lead, on Priya's instruction, places Google Vault holds on the custodians' Gmail and Drive, switches the Slack workspace to a legal-hold export of the data-science channel and relevant DMs, and pauses the 30-day backup-tape recycle so the January-through-March window is frozen. Every action is logged in a ticket. When opposing counsel later demands proof of preservation, Larkspur produces a clean timeline: trigger 12 March, notice sent 13 March, Vault and Slack holds applied 13-14 March, backups frozen 14 March, laptop imaged 15 March.

Phase 5 — Monitor, remind, and release the hold

  • [ ] Track acknowledgments and chase non-responders.
  • [ ] Send periodic reminders so the hold stays live in custodians' minds.
  • [ ] Update the hold as new custodians, sources, or claims emerge.
  • [ ] Issue holds to new employees who step into relevant roles mid-case.
  • [ ] Re-issue or modify the hold when the scope of the case changes (amended pleadings, new theories).
  • [ ] Do not release the hold until the matter and any appeal or related proceeding is fully resolved.
  • [ ] Release in writing, and confirm IT can safely resume normal deletion.

Why it matters, and the traps. A litigation hold is not "set and forget." Zubulake framed the ongoing duty as counsel's continuing obligation to monitor compliance, and courts have sanctioned parties whose holds went stale — custodians who ignored the notice, new employees who never received it, or sources that came online after the initial scope. Periodic reminders are the cheapest possible insurance and the first thing a court asks about.

The release side is equally important and often botched. Releasing too early — because the case "seems" over — reintroduces the auto-deletion risk while an appeal or a related second matter is still pending. Release too late, and you carry needless cost and preserve data that could itself become a liability. Release only when litigation is truly concluded, do it in writing, and keep the release memo. If the same facts might spawn a follow-on matter (a parallel regulatory inquiry, an insurance dispute, an indemnity claim), keep the hold up.

Worked example. Six weeks in, Meridian files suit and adds a claim that Larkspur's sales team promised exclusivity. That new theory pulls in two account executives who were never custodians. Priya expands the hold, issues fresh notices to the AEs, and applies Vault holds to their mailboxes. She sends monthly reminders to all custodians. When the case eventually settles, she waits until the settlement is signed and the release period runs before issuing a written hold-release memo and letting IT resume normal retention.

Phase 6 — Collection, the Rule 26(f) ESI protocol, and form of production

  • [ ] Distinguish preservation (freezing data in place) from collection (defensibly gathering it).
  • [ ] Collect in a forensically sound, defensible manner; preserve metadata.
  • [ ] Forensically image critical devices (like a departing employee's laptop) before analysis.
  • [ ] Negotiate an ESI protocol at the Rule 26(f) conference: sources, search terms, custodians, formats.
  • [ ] Agree on form of production under Rule 34 (native, near-native, or TIFF-plus-load-file with metadata).
  • [ ] Put a Rule 502(d) clawback order in place before producing.
  • [ ] Coordinate collection with initial disclosures and the discovery plan.

Why it matters, and the traps. Preservation buys you time; collection is where the data actually moves, and it must be done without altering the metadata that often decides authenticity and timing. For a departing-employee laptop, that means a forensic image before anyone browses the files, because opening documents changes access timestamps. The Rule 26(f) conference is where the parties are required to discuss preservation and ESI — the earlier you have your scope and sources mapped, the stronger your position at that conference. Rule 34 governs form of production; if the requesting party does not specify a form, you must produce in the form in which the ESI is ordinarily maintained or a reasonably usable form, and native format usually preserves the most metadata.

The clawback point is load-bearing. Large ESI productions inevitably risk inadvertent privilege disclosure; a Rule 502(d) order entered by the court makes clear that inadvertent production does not waive privilege, and it should be in place before you produce a single document. For the mechanics of what comes next in discovery, see Rule 26 Initial Disclosures and the Discovery Plan: A Practical Checklist, Serving Written Discovery Requests: A Practical Checklist, and Responding to Rule 34 Document Requests: A Practical Checklist. When the preserved ESI is web content — screenshots, cached pages, social posts — the authentication rules in Getting Website Evidence Admitted: A Practical Authentication Checklist will govern whether it comes into evidence.

Worked example. Larkspur retains a forensic vendor to image Devin's MacBook and the GitHub repository history. At the Rule 26(f) conference, Larkspur and Meridian agree on custodians, a set of search terms centered on "Meridian" and dataset filenames, native production for spreadsheets and code, and TIFF-plus-metadata for email. Larkspur asks the court to enter a Rule 502(d) order before production. Because the forensic image was taken before anyone touched the laptop, the file-access timestamps become powerful evidence about exactly when Devin last opened the disputed datasets.

Phase 7 — Rule 37(e) spoliation: prejudice, intent, and the sanctions ladder

  • [ ] Confirm the four predicates: ESI, that should have been preserved, was lost, because reasonable steps were not taken, and it cannot be restored or replaced.
  • [ ] If those are met, assess prejudice to the other party under Rule 37(e)(1).
  • [ ] Separately assess intent to deprive under Rule 37(e)(2) — the trigger for the harshest sanctions.
  • [ ] Match the remedy to the finding: curative measures for prejudice; adverse inference, issue preclusion, or dismissal only for intent.
  • [ ] Preserve your good-faith record as the defense: process, timing, proportionality.

Why it matters, and the traps. The 2015 amendment to Rule 37(e) was designed to replace a chaotic, circuit-by-circuit body of spoliation law with one federal standard for lost ESI, and to raise the bar for the most severe sanctions. The structure is a ladder. First come four gating predicates: the information was ESI that should have been preserved in anticipation of litigation, it was lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery. If any predicate fails — for example, the data can be recovered from a backup — the analysis stops and no sanction issues.

If the predicates are met, the rule splits sharply. Under Rule 37(e)(1), on a finding of prejudice to another party, the court "may order measures no greater than necessary to cure the prejudice" — permitting additional discovery, allowing evidence and argument about the loss, and similar proportionate fixes. Under Rule 37(e)(2), the severe sanctions — an adverse-inference instruction that the jury may or must presume the lost information was unfavorable, dismissal, or default — are available only on a finding that the party "acted with the intent to deprive another party of the information's use in the litigation." That intent requirement was the whole point of the amendment: negligence, even gross negligence, no longer supports a mandatory adverse inference. The trap is assuming that carelessness gets you a case-ending sanction; it does not. But intentional destruction — continuing to run disappearing messages after a hold, or wiping the very laptop at issue — invites the nuclear options.

Note that Rule 37(e) governs ESI specifically; the destruction of tangible evidence still lives under the courts' inherent authority and pre-amendment precedent like Silvestri. And the flip side of the sanctions coin is the failure-to-disclose remedy of Rule 37(c)(1), which excludes evidence you should have produced — see Rule 37(c)(1) and the Preclusion of Undisclosed Evidence: A Practical Guide.

Worked example. Meridian moves for sanctions, pointing to the disappearing messages in Larkspur's data-science channel. Larkspur's defense is its record: it disabled disappearing messages the day after the trigger, preserved everything that remained, imaged the laptop before analysis, and applied platform holds within 48 hours. The court finds that whatever was lost from the disappearing-message window is potentially prejudicial but that Larkspur did not act with intent to deprive — its contemporaneous, documented steps show good faith. The result is a modest curative measure under Rule 37(e)(1): Meridian may cross-examine on the gap and argue it to the jury. No adverse-inference instruction issues. Had Larkspur instead let the messages keep vanishing and wiped Devin's laptop on schedule, the same facts would have supported a 37(e)(2) finding and a potentially case-ending instruction.

Common Mistakes to Avoid

  • Waiting for the complaint. The duty attaches at reasonable anticipation — usually the demand letter, threat, or charge, not the filing. Diary the earlier date.
  • A paper hold that never reaches the servers. Sending the notice does not stop auto-deletion. Someone must actually change the retention settings and log it.
  • Forgetting chat and ephemeral tools. Slack, Teams, texts, and disappearing messages are ordinary business records. Continuing to use auto-delete features after a trigger looks intentional.
  • Losing the departing employee's device. The most common catastrophic spoliation. Freeze the reissue/wipe ticket and image the device before anyone touches it.
  • Over-generic or over-narrow notices. "Preserve everything relevant" pushes relevance calls onto employees; too-narrow notices invite the argument you cued custodians to lose the bad documents.
  • No acknowledgment and no reminders. Without tracked acknowledgments and periodic reminders, a court will find the hold was illusory.
  • Failing to update scope. New claims, new custodians, and new employees require fresh holds. A stale hold is a leaky one.
  • Releasing too early. Do not lift the hold while an appeal, indemnity claim, or parallel proceeding is alive.
  • Collecting sloppily. Browsing a laptop before imaging it destroys metadata. Preservation and collection are different disciplines.
  • Producing without a clawback order. Get a Rule 502(d) order in place before a large ESI production goes out the door.

Consolidated one-glance checklist

  • [ ] Trigger date identified and documented (reasonable anticipation, not filing)
  • [ ] Counsel engaged; symmetric duty (plaintiff or defendant) considered
  • [ ] Custodians mapped — decision-makers, witnesses, departing employees
  • [ ] Data sources inventoried — email, chat, cloud, mobile, code, backups
  • [ ] Ephemeral/disappearing messaging identified and stopped
  • [ ] Departing-employee devices frozen before wipe/reissue
  • [ ] Written hold notice drafted, specific, with acknowledgment
  • [ ] Separate privileged litigation-hold memo to file
  • [ ] Auto-deletion, chat retention, and backup recycling suspended
  • [ ] Native legal-hold tooling applied (Vault, Purview, Slack)
  • [ ] Every preservation step logged with date and actor
  • [ ] Acknowledgments tracked; periodic reminders sent
  • [ ] Hold updated as custodians/claims/sources change
  • [ ] Forensic imaging of critical devices before analysis
  • [ ] ESI protocol and form of production negotiated at Rule 26(f)
  • [ ] Rule 502(d) clawback order entered before production
  • [ ] Rule 37(e) predicates, prejudice, and intent assessed if data is lost
  • [ ] Hold released in writing only after full resolution

Primary Authority

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Statutes, rules, and fees change; verify current requirements and consult qualified counsel before acting.