Legal Hold: What Triggers the Duty to Preserve, and What Actually Satisfies It

By the Legal Cyber Academy editorial team · September 7, 2026

The duty to preserve attaches when litigation is reasonably anticipated, not when a complaint arrives

A legal hold is what a party does to stop the routine destruction of relevant information once litigation is reasonably anticipated. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212 (S.D.N.Y. 2003), states the obligation directly: once a party reasonably anticipates litigation, it must suspend its routine document retention/destruction policy and put a litigation hold in place. Federal Rule of Civil Procedure 37(e) then governs what a court may do when electronically stored information that should have been preserved is lost anyway.

Fixing the trigger date is the first fact you will litigate

The trigger is not the complaint, not service, and not the preservation letter from the other side — and it is usually proved out of the client's own files. Zubulake is a district court decision rather than binding appellate authority, but its account of the trigger is widely followed. There, the court held the duty attached at the latest on August 16, 2001, when Zubulake filed her EEOC charge, and then found it had attached earlier still, on three pieces of the client's own record: emails about Zubulake labeled "UBS Attorney Client Privilege" starting in April 2001 although no attorney was copied and the substance was not legal; her supervisor's deposition admission that a suit was "in the back of my head" in late April 2001; and a co-worker's late-April email, circulated to supervisors, that anyone threatening the desk "should be firmly dealt with." From that the court concluded that "the relevant people at UBS anticipated litigation in April 2001. The duty to preserve attached at the time that litigation was reasonably anticipated" — months before the EEOC charge and roughly ten months before the complaint, which was filed on February 14, 2002.

The 2015 Committee Note to Rule 37(e) frames the same inquiry: a court "may need to decide whether and when a duty to preserve arose," considering "the extent to which a party was on notice that litigation was likely and that the information would be relevant."

Zubulake also states that "anyone who anticipates being a party or is a party to a lawsuit must not destroy unique, relevant evidence that might be useful to an adversary," so a plaintiff sitting on a claim is already bound. And write the date down when you set it: a memo of what was known, when, and who decided beats a later reconstruction.

The Committee Note observes that "[a] variety of events may alert a party to the prospect of litigation." The ones that commonly fix the date earlier than counsel expects: a demand letter; a regulatory inquiry; a decision to terminate an employee who has already complained internally; a security incident that has triggered a breach-notification analysis (see Navigating Ransomware Response and Legal Obligations).

Scope: less than everything, and the narrowing has to be on the record

Zubulake asks whether a corporation must "preserve every shred of paper, every e-mail or electronic document, and every backup tape," and answers no, because such a rule "would cripple large corporations ... that are almost always involved in litigation." What it does require:

Custodians. The duty covers documents made by individuals "likely to have discoverable information that the disclosing party may use to support its claims or defenses," documents prepared for them to the extent they can be readily identified, and information relevant to any party's claims or defenses — in the court's shorthand, "those employees likely to have relevant information — the 'key players' in the case." (Zubulake also reached information "relevant to the subject matter involved in the action," tracking Rule 26(b)(1) as it then read; the 2015 amendment removed subject-matter scope, so do not reuse that branch verbatim.)
Content. A party "must retain all relevant documents (but not multiple identical copies) in existence at the time the duty to preserve attaches, and any relevant documents created thereafter." The second half gets missed: a hold runs forward, not only backward.
Backup media. The hold generally does not reach inaccessible backup tapes kept solely for disaster recovery, which may keep rotating; accessible backups actively used for information retrieval likely are covered. And where the company can identify which media hold a key player's documents, those should be preserved if the information is not otherwise available.

Rule 26(b)(2)(B) is the companion limit on the discovery side: "[a] party need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost." Two qualifiers travel with it. On a motion to compel or for a protective order, the responding party carries the burden of showing the source is not reasonably accessible, and even then the court "may nonetheless order discovery from such sources if the requesting party shows good cause." And it limits production, not preservation — it is not authority to let an identified source be destroyed. Note the verb, too: identifies. A source never identified is hard to defend later as reasonably excluded.

The Committee Note carries proportionality into preservation itself: aggressive preservation "can be extremely costly," and "[a] party may act reasonably by choosing a less costly form of information preservation, if it is substantially as effective as more costly forms."

Scope decided unilaterally is defended unilaterally, so move it into case management. Rule 26(f)(2) requires the parties to "discuss any issues about preserving discoverable information," Rule 26(f)(3)(C) requires the discovery plan to state their views on "any issues about disclosure, discovery, or preservation of electronically stored information," and Rule 16(b)(3)(B)(iii) lets the scheduling order "provide for disclosure, discovery, or preservation of electronically stored information" — which under Rule 16(b)(2) issues as soon as practicable and, absent good cause for delay, "within the earlier of 90 days after any defendant has been served with the complaint or 60 days after any defendant has appeared."

Issuing the hold: what a defensible notice does

Describes categories in the recipient's language. "All documents relating to the subject matter of this dispute" tells a sales manager nothing. Name the accounts, the date range and the systems.
Suspends deletion at the system level, rather than asking people to be careful. The Committee Note treats "intervention in the routine operation of an information system" as "one aspect of what is often called a 'litigation hold.'" Auto-deletion policies, mailbox quotas, expiring chat retention and device wipes at offboarding all run until someone turns them off.
Requires acknowledgment, tracked by name and date, and tells recipients not to self-triage — not to decide relevance by deleting, or tidy a device before handing it over. An unanswered notice is not evidence of a hold.
Assigns an owner per system, not only per custodian — chat, ticketing, HR platforms, source control and third-party processors each need someone accountable. That includes data the client controls but does not hold: Rule 34(a)(1) reaches items in the responding party's "possession, custody, or control," and Rule 34(a)(1)(A) covers ESI "stored in any medium from which information can be obtained."

Refreshing and monitoring: the part that gets skipped

Zubulake v. UBS Warburg LLC, 229 F.R.D. 422 (S.D.N.Y. 2004), is blunt about what follows issuance: a hold is "only the beginning," and "[c]ounsel must oversee compliance with the litigation hold, monitoring the party's efforts to retain and produce the relevant documents."

Three steps follow. The hold "should be periodically re-issued so that new employees are aware of it, and so that it is fresh in the minds of all employees." Key players — in the court's description, "the people identified in a party's initial disclosure and any subsequent supplementation thereto" — "should be periodically reminded that the preservation duty is still in place." And counsel "should instruct all employees to produce electronic copies of their relevant active files," and make sure that backup media the party is required to retain "is identified and stored in a safe place."

Monitoring means counsel "must become fully familiar with her client's document retention policies, as well as the client's data retention architecture" — which "will invariably involve speaking with information technology personnel." The example is precise: counsel learned that a human resources custodian kept her files on the plaintiff in an "archive" but "apparently made no effort to learn what that meant"; a few simple questions would have revealed that she kept those files in a separate active file on her computer. Counsel "cannot be obliged to monitor her client like a parent watching a child," but "it is not sufficient to notify all employees of a litigation hold and expect that the party will then retain and produce all relevant information."

Calendar the refresh, and re-run it on amended pleadings, new custodians, system migrations and device refresh cycles. The most common failure is departure — a custodian under hold resigns, and ordinary offboarding reclaims the laptop, wipes it and deletes the mailbox on schedule. That needs an owned exception process inside IT and HR.

Rule 37(e): four predicates, then two very different tiers

Rule 37(e) applies only where four things are true together. ESI (1) "should have been preserved in the anticipation or conduct of litigation," (2) "is lost," (3) "because a party failed to take reasonable steps to preserve it," and (4) "it cannot be restored or replaced through additional discovery." Each is a defense, and the fourth is often the most winnable — as the Committee Note puts it, "[b]ecause electronically stored information often exists in multiple locations, loss from one source may often be harmless when substitute information can be found elsewhere." Material still obtainable from a counterparty or a vendor system takes the dispute outside the rule.

If all four are met, the tiers diverge:

Rule 37(e)(1). "[U]pon finding prejudice to another party from loss of the information," the court "may order measures no greater than necessary to cure the prejudice" — the Committee Note's examples include "forbidding the party that failed to preserve information from putting on certain evidence" and "permitting the parties to present evidence and argument to the jury regarding the loss of information." Adverse-inference instructions are not available at this tier; the Note is explicit that the measures available under (e)(1) are those that "would not involve instructing a jury it may draw an adverse inference from loss of information."
Rule 37(e)(2). "[O]nly upon finding that the party acted with the intent to deprive another party of the information's use in the litigation" may the court presume the lost information was unfavorable, instruct the jury that it may or must so presume, or dismiss the action or enter a default judgment. The Note states that subdivision (e)(2) "does not include a requirement that the court find prejudice to the party deprived of the information."

The amendment "rejects cases such as Residential Funding Corp. v. DeGeorge Financial Corp., 306 F.3d 99 (2d Cir. 2002), that authorize the giving of adverse-inference instructions on a finding of negligence or gross negligence" — check that before reusing pre-2015 material. Zubulake's trigger and scope analysis remains the working framework, but its sanctions analysis, under which ordinary negligence satisfied the "culpable state of mind" element in the Second Circuit, no longer supplies the standard for lost ESI; the Note says the rule "forecloses reliance on inherent authority or state law to determine when certain measures should be used." Two further limits: the rule "applies only to electronically stored information," not tangible evidence; and loss occurring despite reasonable steps falls outside it, the Note giving the examples of a flooded computer room, a failed "cloud" service and a malign software attack.

How intent actually gets proved

Jones v. Riot Hospitality Group LLC, 95 F.4th 730 (9th Cir. 2024), affirmed dismissal with prejudice of a Title VII and common-law tort action under Rule 37(e)(2) where the plaintiff was the spoliator. Rule 37(e) does not define intent, but in context the word "is most naturally understood as involving the willful destruction of evidence with the purpose of avoiding its discovery by an adverse party" — and because intent can rarely be shown directly, a court may consider circumstantial evidence. "Relevant considerations include the timing of destruction, affirmative steps taken to delete evidence, and selective preservation."

The record features recur: threads that stopped abruptly with people the plaintiff had been messaging almost daily; a finding that she "affirmatively selected certain text messages for deletion while otherwise preserving text messages sent around the same time"; new phones obtained shortly after the order to hand over devices for imaging, with the earlier phones never produced; and an expert comparison of the volume of messages sent and received between phone pairs over time (see Digital Forensics for Litigators: How to Read a Forensic Report). Producing thousands of other messages did not negate intent — "production of some evidence does not excuse destruction of other relevant evidence." And the court set out what dismissal takes: "a district court need only find that the Rule 37(e) prerequisites are met, the spoliating party acted with the intent required under Rule 37(e)(2), and lesser sanctions are insufficient to address the loss of the ESI." Prejudice is not an additional prerequisite — "Rule 37(e)(2) does not mention prejudice as a prerequisite to sanctions, including dismissal" — though the district court there did find it.

The record that decides the motion

Build it as you go: the dated trigger memo; the notice, distribution list and acknowledgments; a log of which systems had automatic deletion suspended, by whom, when, and how that was verified; custodian interview notes; a data map; the refresh log; any Rule 16 order on preservation; and, for anything lost, an account of what was lost, why, and what was attempted to restore or replace it — the fourth Rule 37(e) predicate, in your words, before your opponent writes it in theirs.

Where a hold overlaps a federal investigation the exposure is not only procedural. 18 U.S.C. § 1519 reaches whoever "knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object" with the intent to impede, obstruct or influence a matter within the jurisdiction of a federal department or agency, "or in relation to or contemplation of any such matter," and carries imprisonment of up to 20 years. Both the knowledge and the intent elements matter: the statute is aimed at deliberate obstruction, not at a preservation failure that is merely careless. Release the hold in writing too, dated, once no other matter needs the same data.

Learn more

Legal Cyber Academy's faculty includes Katherine Charonko, partner and ESI practice group leader at Bailey & Glasser; David Shonka, partner and general counsel at Redgrave LLP, who served as acting general counsel of the Federal Trade Commission across three separate terms; Gail Gottehrer, vice president for global litigation, labor and employment, and government relations at Fresh Del Monte Produce; and Gregory M. Sleet, a JAMS neutral who served 20 years on the U.S. District Court for the District of Delaware, including seven as chief judge.

This article states general procedural principles and is not legal advice. Preservation practice varies by circuit and by district standing order, and the common-law duty may reach further than Rule 37(e); check the governing authority in your forum before relying on any statement here.