E-discovery, or electronic discovery, is the process of identifying, preserving, collecting, reviewing and producing electronically stored information for lawsuits, regulatory investigations and audits. A legal hold, also called a litigation hold, is the instruction and the technical control that preserves relevant information so it isn’t deleted or altered while a matter is pending or reasonably anticipated. The two go together: a hold protects the data, and e-discovery finds and produces it. Requirements depend on the jurisdiction, court and matter; this is not legal advice.
At a glance
- A legal hold suspends normal deletion for specific people, mailboxes, sites or data types tied to a legal matter.
- E-discovery covers finding, collecting, reviewing and producing relevant electronic records, often in a standard format.
- Data in scope can include email, chat, documents, call recordings, mobile messages and cloud application data.
- Many collaboration suites include hold and search tools, with capabilities depending on license tier; specialist platforms handle larger or more complex matters.
- Holds interact with retention policies and backups, so legal, IT and records teams need a shared process.
What problem it solves
When an organization expects litigation or an investigation, it generally has a duty to preserve relevant information. If emails, chats or files are deleted afterward, even by an automatic retention rule, the organization can face court sanctions or damage to its case. At the same time, legal teams need to find relevant records quickly among years of data spread across many systems.
Without a defined process, IT ends up running ad hoc searches, keeping departing employees’ accounts and licenses alive indefinitely “just in case”, or paying outside firms to collect data. A legal hold and e-discovery process gives a repeatable way to preserve the right data, release it when the matter ends, and produce it efficiently.
How it works
Trigger and scope. Counsel decides when a hold is needed and who and what it covers: custodians, date ranges, systems and data types.
Notice. Custodians receive a hold notice explaining what to preserve. Many organizations track acknowledgments.
Technical preservation. IT applies holds in the systems involved. In platforms such as Microsoft 365, holds can preserve mailboxes, sites and chats in place, keeping deleted or edited items in a protected location. Other systems may need exports or snapshots.
Interaction with retention. A hold should override the normal backup retention policy and records schedules for data in scope. Archiving and backup systems may need their own holds so copies aren’t expired.
Search and collection. Legal or IT teams search across held data using keywords, dates and custodians, then collect results in a defensible way that preserves metadata.
Review and production. Collected data is reviewed, often in a dedicated review platform, and relevant, non-privileged records are produced to the other party or regulator.
Release. When the matter ends, counsel releases the hold and normal retention resumes.
When it matters for buyers
- When choosing collaboration licenses. Hold and e-discovery features often differ by license tier.
- When a compliance deadline or audit lands. Regulators and auditors may expect documented preservation processes.
- When offboarding employees. Holds can let you remove licenses without losing data a matter requires, depending on the platform.
- When choosing backup or archiving. Ask how these tools support holds and searches, as part of broader data governance.
Questions to ask vendors
- Which hold and e-discovery features are included in our current licenses, and which need an upgrade or add-on?
- Can holds cover email, chat, files, recordings and mobile messages in your platform?
- Does a hold preserve edited and deleted items, and their metadata?
- Can we place holds on backup or archive copies so they aren’t expired on schedule?
- How do we export data in formats our legal team or review platform can use?
- How are holds released, and is there an audit trail of who applied and removed them?
How it differs from SaaS backup
SaaS backup and legal hold both keep data longer than an application would by default, so they are easy to confuse. A legal hold is built to preserve specific content for a legal matter, usually inside the same application and under the same admin accounts, with search and export for discovery. SaaS backup is built to restore data after deletion, corruption or attack, keeping copies outside the application. Many organizations use both, and some backup services offer search and hold features too. Our Microsoft 365 backup overview covers how backup fits alongside built-in retention and holds.