Skip to main content
DataRidge
Category: Data Lifecycle and Disposal

Preservation Order

Also known as: Preservation Letter, Litigation Hold, Hold Order
Simply put

A preservation order is an instruction requiring a party to keep specified materials intact and not destroy, alter, or discard them. In a litigation context, it typically directs the recipient to preserve documents, records, and electronic materials that may be relevant to a legal matter. The term also has a separate meaning in some jurisdictions where it refers to an official designation protecting a building or area of special value from alteration or destruction.

Formal definition

In the context of litigation and electronic discovery, a preservation order (also referred to as a preservation letter, litigation hold, or hold order) is an instruction, which may be issued by a court or communicated between parties, directing a recipient to preserve materials relevant to a matter and refrain from destroying, altering, or discarding them. Such an order may extend beyond active documents to include sources at risk of routine loss, such as backup tapes, deleted emails, and older email archives, and it typically encompasses originals and related copies of the identified materials. This concept relates to the underlying duty to preserve potentially relevant evidence. Note that this practitioner meaning is distinct from a separate sense of the term used in some jurisdictions, where a preservation order is an official decision protecting a building, tree, or area of special value from alteration or destruction. This entry addresses the definition and scope of the term only; it does not cover the mechanics of enforcement, penalties for non-compliance, retention scheduling, cross-border considerations, or how a preservation order intersects with data protection obligations under any specific regime, all of which vary by jurisdiction and context.

Why it matters

A preservation order sits at the point where a legal duty to preserve evidence meets an organization's routine information handling. Once a party is on notice that materials may be relevant to a matter, ordinary practices that would otherwise be unremarkable, deleting emails, overwriting backup tapes, retiring old archives, can become problematic if they eliminate potentially relevant evidence. The preservation order operationalizes that duty by instructing the recipient to keep specified materials intact and refrain from destroying, altering, or discarding them.

The practical challenge is that relevant material is frequently not confined to active, easily accessible documents. As the discovery context illustrates, day-to-day use of systems can place evidence at risk through routine loss, so a preservation order may extend to sources such as backup tapes, deleted emails, and older email archives, and typically encompasses originals along with related copies. This breadth is why litigation holds are difficult to execute reliably: they require identifying and suspending normal disposition across systems that were often designed to purge data automatically.

Because the term carries a second, unrelated meaning in some jurisdictions, an official designation protecting a building, tree, or area of special value from alteration or destruction, practitioners should confirm which sense is intended in a given document. This entry addresses the litigation and electronic discovery meaning; it does not cover the mechanics of enforcement, penalties for non-compliance, retention scheduling, cross-border considerations, or how a preservation order intersects with data protection obligations under any specific regime, all of which vary by jurisdiction and context.

Who it's relevant to

Legal and litigation teams
In-house counsel and litigation practitioners issue, receive, and scope preservation orders and litigation holds, and are responsible for translating the duty to preserve into specific instructions identifying the materials and sources to be kept intact.
Information governance and records leads
Governance and records professionals must reconcile a preservation order with routine information handling, since a hold typically requires suspending normal disposition, including automatic deletion and backup overwriting, for the specified materials. This is a governance concern around ownership and disposition, distinct from the mechanics of retention scheduling, which is out of scope here.
IT and eDiscovery custodians
Those who administer email systems, backups, and archives may need to preserve sources at risk of routine loss, such as backup tapes, deleted emails, and older email archives, and to ensure originals and related copies of identified materials are retained pending the matter.
Property, planning, and heritage professionals
In some jurisdictions the same term denotes an official designation protecting a building, tree, or area of special value from alteration or destruction. Professionals working in property or heritage contexts should be aware this sense is entirely separate from the litigation meaning addressed in this entry.

Inside Preservation Order

Scope of Data Covered
A preservation order (often called a legal hold or litigation hold) specifies the categories of records, systems, custodians, and time periods for which data must be retained. Precise scoping is generally critical to avoid over-preservation, which can conflict with data minimization and retention obligations, or under-preservation, which risks spoliation.
Trigger and Legal Basis
The order arises from a reasonably anticipated or active legal proceeding, regulatory investigation, or comparable obligation. The specific triggering standard and enforcement consequences vary by jurisdiction and legal system, and this entry does not cover jurisdiction-specific procedural thresholds.
Suspension of Routine Deletion
A preservation order typically overrides otherwise applicable retention schedules and routine deletion processes for the affected data. This creates tension with data protection principles such as storage limitation, and the interaction between a hold and a lawful retention or erasure obligation must be assessed on the facts.
Custodian and Systems Identification
The order generally identifies the individuals (custodians) and systems, repositories, or data stores where relevant data resides. This overlaps with data governance capabilities such as data cataloging and lineage, though a governance inventory alone does not discharge the legal preservation duty.
Preservation Method and Integrity
Preservation involves controls to maintain the integrity and, where relevant, the confidentiality and availability of the held data. This is where information security controls support a governance and legal obligation, without the two disciplines being interchangeable.
Duration and Release
A preservation order remains in effect until formally lifted, and generally includes or requires a documented release process once the underlying matter concludes. Ongoing tracking of active holds is typically necessary to know when normal retention and deletion may resume.

Common questions

Answers to the questions practitioners most commonly ask about Preservation Order.

Does a preservation order override or suspend our data protection obligations to delete personal data?
Not in the way this question implies. A preservation order generally creates a legal duty to retain specific data relevant to actual or anticipated litigation or an investigation, which can act as an exception to routine retention or deletion schedules. However, it does not blanket-suspend all data protection obligations. The data preserved remains personal data and continues to be subject to applicable requirements around security, purpose limitation, and access. Preservation typically narrows to the data within scope of the order rather than authorizing indefinite retention of everything. The interaction between a preservation duty and deletion obligations depends on the jurisdiction and the specific legal instrument, so you should treat this as a documented, scoped exception rather than a general override. Cross-border transfer mechanics and specific retention periods are outside the scope of this entry.
Is a preservation order the same as a legal hold, or the same as a records retention policy?
These are related but distinct. A preservation order or preservation obligation generally arises from a legal or regulatory source and compels retention of specific data. A legal hold is typically the internal process an organization uses to implement and enforce such a preservation duty across its systems and custodians. A records retention policy is a governance instrument setting default retention periods for categories of records in the ordinary course of business. A preservation duty commonly overrides the default deletion actions that a retention policy would otherwise trigger, but it does not replace the policy itself. Keeping these separate matters for accountability: governance frameworks generally require you to demonstrate, with evidence, both how the duty was recognized and how it was operationalized.
How do we scope a preservation order so we retain the right data without over-preserving?
Scoping generally begins by identifying the data relevant to the matter, including custodians, systems, date ranges, and data types. Over-preservation carries its own risks, since retained personal data remains subject to data protection obligations and increases exposure. In practice, organizations document the scope decision, the rationale, and the boundaries so the retention can be defended as proportionate. Coordination between legal, the data protection function, and information security is typically needed to align the preservation scope with lawful retention and to avoid retaining more special category or sensitive data than the matter requires. This entry does not address specific procedural rules of any court or regulator.
Which roles are accountable for implementing a preservation order?
Accountability is generally shared across functions. Legal or the party issuing internal instruction typically identifies the preservation duty and its scope. The organization acting as data controller usually bears the primary obligation to ensure relevant data is preserved and remains protected. Where a data processor holds relevant data, the controller commonly must instruct the processor, and the processor generally acts on documented instructions. Information security supports by ensuring the preserved data retains appropriate confidentiality and integrity controls. Data governance functions such as stewardship and cataloging help locate in-scope data. Under governance and accountability principles, these responsibilities should be assigned and evidenced rather than assumed.
What evidence should we maintain to demonstrate compliance with a preservation order?
Because accountability under governance frameworks generally requires demonstrable evidence rather than stated intent, organizations typically maintain documentation of when the preservation duty was recognized, its defined scope, the systems and custodians affected, the actions taken to suspend routine deletion, and confirmation that in-scope data was retained without alteration. Where a processor is involved, records of the controller's instructions and the processor's acknowledgment are commonly retained. Evidence of integrity controls protecting the preserved data is also useful. The specific evidentiary standards required by a given court or regulator are outside the scope of this entry.
How does a preservation order interact with automated deletion and data minimization processes?
Automated deletion routines and data minimization practices generally operate against default retention rules, so a preservation duty typically requires suspending or exempting the in-scope data from those routines. In practice this means configuring holds so that relevant records are not deleted by scheduled jobs, backup rotation, or lifecycle automation, while allowing minimization to continue for out-of-scope data. Preserved data remains personal data and does not become exempt from data protection principles simply because it is held for a legal purpose. Coordination is generally needed to ensure the technical controls actually enforce the hold and that lifting the hold is also controlled and documented when the duty ends.

Common misconceptions

A preservation order permanently exempts the held data from all data protection obligations, including erasure requests.
A preservation obligation may provide grounds to defer or resist certain requests, such as an erasure request, but it does not universally suspend all data protection duties. The interaction between a legal hold and rights such as erasure depends on jurisdiction, lawful basis, and the specific facts, and must be assessed rather than assumed.
Having a data inventory or data catalog means an organization automatically satisfies a preservation order.
A governance inventory or catalog can help locate relevant data, but it is a discovery aid, not a discharge of the legal duty. Preservation requires actively suspending deletion and maintaining the identified data, which is a distinct obligation from maintaining a data map.
Preservation is purely a security task handled by IT.
Preservation sits at the intersection of legal, governance, and security functions. Legal defines scope and duration, governance identifies custodians and systems, and security supports integrity and availability. Treating it as solely a security exercise risks incomplete scoping and unmet legal accountability.

Best practices

Document the trigger, scope, custodians, systems, and time period of each preservation order, and retain that documentation as demonstrable evidence of the accountability the obligation requires.
Suspend routine deletion for the affected data promptly, and record where a hold overrides an otherwise applicable retention schedule.
Assess, on a case-by-case basis, how the preservation obligation interacts with data protection duties such as erasure requests and storage limitation, rather than assuming the hold overrides them universally.
Coordinate across legal, information governance, and security functions so that scope definition, data location, and integrity controls are each owned by the appropriate team without conflating their roles.
Maintain an auditable register of active holds and their status so that normal retention and deletion can resume only after a documented, formal release.
Scope holds precisely to avoid both under-preservation, which risks spoliation, and over-preservation, which conflicts with data minimization, and reassess scope as the matter evolves.