eDiscovery and Legal Hold Guide: Preserving and Producing Electronic Evidence

When litigation or an investigation becomes likely, an organisation must stop the routine deletion of relevant electronic information, and most failures happen because nobody in IT or security knew which systems, chats or AI logs were in scope. Legal hold and eDiscovery are led by lawyers, but they are executed in mail platforms, collaboration tools, retention policies, backups and audit logs that security and IT teams run. This guide explains the US federal rules that drive preservation duties, the EDRM process model, how holds work in practice in platforms such as Microsoft Purview and Slack, and how to bring chat, AI assistant prompts and machine-generated logs into scope. It is written for security, IT and records teams who support legal counsel. It is not legal advice: obligations depend on jurisdiction and the facts of each matter, so decisions about scope and timing belong to counsel.

Key takeaways

• The duty to preserve starts before a lawsuit is filed. Under US Federal Rule of Civil Procedure 37(e), sanctions turn on whether information that should have been preserved "in the anticipation or conduct of litigation" was lost because reasonable steps were not taken.
• Reasonable, proportionate steps, not perfection. The 2015 committee note to Rule 37(e) says perfection is not required, and Rule 26(b)(1) ties the scope of discovery to proportionality factors.
• Retention automation is the main threat to a hold. Deletion policies, mailbox clean-up, chat retention, log rotation and account deprovisioning keep running unless someone suspends them for custodians and systems in scope.
• Chat and AI interactions are electronically stored information. Teams and Slack messages, Copilot and other AI assistant prompts and responses, and agent logs can be relevant and must be considered in every hold.
• Prepare before the first matter. A data map, a tested hold procedure, platform licences that support holds, and named owners for each system make a defensible response possible within days rather than weeks.

The legal drivers security teams need to understand

The US Federal Rules of Civil Procedure (FRCP) are the most influential source of eDiscovery practice. Other jurisdictions differ, but the same concepts of preservation, proportionality and production recur.

The 2015 committee note to Rule 37(e) also stresses that the rule applies only to ESI, only when information is actually lost, and does not create a new duty to preserve; the duty arises from the common law when litigation is reasonably anticipated. It rejects adverse inference instructions based on negligence or gross negligence alone.

England and Wales: in the Business and Property Courts, disclosure is governed by Practice Direction 57AD, which places express duties on parties and their lawyers to preserve documents, including electronic documents, once proceedings are contemplated, and to notify relevant employees and former employees in writing. Read the current text with counsel before relying on it, as practice directions are amended periodically.

Data protection law still applies to preserved data. A hold is a lawful reason to keep personal data beyond its normal retention period, but access to held data should be restricted and the hold released when the matter ends. See the GDPR Compliance Guide for Security Teams.

The EDRM model and who does what

The Electronic Discovery Reference Model (EDRM) is the common vocabulary for eDiscovery. Its current stages are Analysis, Identification, Preservation, Collection, Processing, Review, Production, Presentation and Disposition. EDRM describes it as a conceptual view rather than a linear workflow: teams loop back as they learn more, and analysis informs every stage. The latest version is anchored by the Information Governance Reference Model and adds Disposition, the defensible deletion or return of data after a matter closes.

Running a legal hold

A legal hold has two parts: a notice to people (custodians) telling them to keep relevant information, and technical preservation in systems so the information survives regardless of what custodians do. Relying on the notice alone is a frequent cause of loss. The Sedona Conference Commentary on Legal Holds (second edition, 2019) is the most widely used practitioner reference on hold triggers and process.

1. Trigger: counsel decides litigation, a regulatory investigation or a government inquiry is reasonably anticipated, and records the date and reason. Security incidents that may lead to claims, such as a data breach, can be triggers in their own right.
2. Scope: identify custodians, date ranges, subject matter and systems, including non-custodial sources such as shared drives, ticketing systems, source code repositories, databases and logs.
3. Notify custodians: issue a written hold notice, obtain acknowledgements, and escalate non-responders.
4. Preserve in place: apply platform holds to mailboxes, file stores and chat for each custodian and system; suspend conflicting retention and deletion jobs.
5. Preserve what cannot be held in place: export or image data from systems with no hold feature, from devices of departing staff, and from logs with short rotation.
6. Document: keep a hold register recording each custodian, system, action taken, date and person responsible.
7. Maintain: send periodic reminders, add new custodians as the matter develops, and check that holds survive platform changes, migrations and leavers.
8. Release: when counsel confirms the matter has ended and no other hold applies, release holds, record the release and let normal retention resume.

Integrating holds with joiner, mover and leaver processes

Leaver processing is where held data is most often destroyed: mailboxes deleted after a licence is removed, laptops reimaged for the next user, and cloud accounts purged after a grace period. Add a hold check to offboarding so that a custodian on hold has mailbox, OneDrive or equivalent storage and devices preserved before deprovisioning. See the Joiner-Mover-Leaver Guide.

Holds in practice: Microsoft 365 and Slack as examples

The following examples show the kinds of detail that determine whether a hold actually preserves what counsel expects. Other platforms differ; check vendor documentation for each system in scope. Products are named to explain the topic, not as recommendations.

Microsoft Purview eDiscovery

• Locations: holds in a case can cover Exchange mailboxes and OneDrive accounts of case members, mailboxes and SharePoint sites associated with Teams, Microsoft 365 groups and Viva Engage, and additional SharePoint sites by URL. Subsites cannot be held individually; the hold applies to the parent site.
• Scope options: an infinite hold preserves everything in the location; a query-based hold preserves only content matching a KeyQL query; a date range can limit either. Microsoft recommends limiting query conditions to date, participants and type for encrypted or partially indexed items.
• Timing: a hold can take up to 24 hours to take effect, so anything deleted in that window may still be lost. Act early.
• Teams storage: 1:1 and group chats are stored in each participant's mailbox and shared files in the sharer's OneDrive, so hold the individual users; channel conversations sit in the team mailbox and files on the team SharePoint site, so hold both. Holding a Microsoft 365 group does not hold its members' mailboxes or OneDrive accounts.
• Group expansion: group membership is captured as a point-in-time snapshot when the hold is created, and distribution lists with more than 100 members might fail to expand. New members are not added automatically.
• Release: when a location is removed from a hold or a case is closed, a 30-day delay hold applies before content is purged.
• Licensing: every user whose content is preserved needs an eligible licence (frontline F1 and F3 plans are not eligible), and query-based, time-bound and custodian-scoped holds require E5-level or equivalent add-on licensing. Review sets, advanced indexing and analytics are Premium eDiscovery features.

Slack

• Availability and roles: legal holds are available on Enterprise plans and are created by members with the Legal Holds Admin system role, which Org or Workspace Primary Owners assign.
• What is kept: messages and files in conversations involving the custodians are preserved regardless of retention settings or later edits and deletions; a hold can cover all conversations or only direct messages.
• Gaps: Slack Connect conversations, emoji reactions and snippet version history are excluded, and if a held channel is deleted its message and file data is not saved. Control who can delete channels while a hold is active.
• Limits and access: a hold can have up to 1,000 custodians, and held data is retrieved through a JSON export or the Discovery API. The Discovery API token is a highly privileged credential and should be vaulted and monitored.

See the Collaboration Tool Security Guide for wider controls on chat platforms.

AI assistant prompts, responses and agent logs

Generative AI adds new categories of ESI: prompts users type, responses the assistant generates, content the assistant retrieved, memories it keeps, and logs of actions taken by agents and their non-human identities. Treat these like any other record: identify where they are stored, whether the platform can hold them, and whether retention settings would delete them.

• Microsoft 365 Copilot and connected AI apps: Microsoft documents that Copilot and other AI prompts and responses are stored as items in the user's Exchange Online mailbox. In Purview eDiscovery they can be found with the Item class condition and the Copilot activity option, or with specific item classes such as IPM.SkypeTeams.Message.Copilot.*. Mailbox holds and retention policies prevent their deletion, which means a mailbox hold also preserves these interactions. Microsoft also notes that deleting a conversation does not delete the associated Copilot memory. See the Microsoft 365 Copilot Security Deep Dive.
• Third-party AI services: a provider's own retention and legal obligations can differ from yours. In 2025 OpenAI was ordered, in litigation brought by The New York Times, to preserve consumer ChatGPT and API content that would otherwise have been deleted; OpenAI states that ChatGPT Enterprise, ChatGPT Edu and API use under Zero Data Retention agreements were not covered, that its obligations under the order ended on 26 September 2025, and that a limited set of historical data remained under legal hold. Know which tier your staff use, what the provider retains and whether you can export it. See the ChatGPT Enterprise Security Guide.
• Shadow AI: prompts entered in personal or unsanctioned AI tools are outside your hold capability. Policy, approved alternatives and monitoring reduce this exposure. See the Insider Risk from AI Tools Guide.
• Agents and automations: agent run logs, tool call records and the audit trail of the service accounts, API keys and OAuth grants agents use may show what was done and on whose behalf. Make sure these logs are retained long enough and can be exported with integrity. See the AI Agent Observability and Incident Response Guide.

Logs, backups and machine data

Machine-generated data is often relevant, especially in disputes about a security incident: authentication logs, cloud audit trails, endpoint telemetry, ticket histories and change records. Many of these sources rotate in days or weeks.

The relationship with normal retention matters in both directions: a sound retention schedule reduces the volume you must search, while holds override it. See the Data Retention and Secure Deletion Guide.

Collection, review and the incident response overlap

• Defensible collection: collect with tools that preserve native format and metadata, record hashes at collection and export, and keep a chain of custody record. Where deleted or fragmentary data matters, use forensic imaging rather than an eDiscovery export. See the Digital Forensics (DFIR) Guide and the Digital Forensics Tools Buyer's Guide.
• Access control for eDiscovery roles: eDiscovery manager and administrator roles can search almost all content in a tenant. Grant them to named individuals, require phishing-resistant MFA, use privileged access workflows, and review membership regularly. In Microsoft Purview, review the eDiscovery Manager and eDiscovery Administrator role groups.
• Audit the auditors: log every search, export and hold change, and alert on exports outside an open case. A content search role is a powerful data exfiltration path if misused. See the Insider Threat Programme Guide.
• Security incidents: after a breach, the incident response team collects evidence for containment while counsel may need the same data preserved for regulators and litigation. Coordinate early so that response actions such as wiping hosts or resetting tenants do not destroy material that should be held. See the Incident Response Guide.
• Cross-border data: collecting from other jurisdictions may involve data transfer restrictions and blocking statutes. See the Data Sovereignty and Residency Guide.

Detection and measurement

Monitor hold integrity continuously rather than assuming a hold applied once remains effective.

• Hold coverage: percentage of custodians on hold with every in-scope system preserved, reconciled weekly against the hold register.
• Time to preserve: hours from counsel's trigger to technical holds in place across all systems.
• Acknowledgement rate: percentage of custodians who acknowledged the hold notice within the set period.
• Leaver exceptions: number of custodians offboarded without a preservation check (target zero).
• Retention conflicts: deletion jobs, chat retention or log rotation still active on held sources.
• Stale holds: holds open with no matter activity beyond an agreed review period, which add cost and privacy exposure.

Alert on deletion of held channels or sites, removal of locations from a hold, changes to eDiscovery role membership, and bulk exports.

Framework mapping

Common failure patterns

• Notice without technical preservation: custodians are told to keep data while automated retention, chat deletion and mailbox clean-up continue to run.
• Offboarding destroys held data: a custodian leaves, the licence is removed and the mailbox and cloud storage are purged, or the laptop is reimaged for a new starter.
• Forgotten sources: holds cover email and files but miss chat, private channels, AI assistant interactions, ticketing systems, source code repositories or logs.
• Assuming platform defaults are enough: group holds that do not cover members' personal storage, membership snapshots that miss new custodians, licence tiers without hold features, and channels deleted while on hold.
• Uncontrolled eDiscovery privileges: broad search and export roles granted widely or left in place after a matter, creating an insider and account takeover risk.
• Holds never released: data kept for years after matters close, raising storage cost, privacy exposure and the volume searchable in the next dispute.

Practitioner checklist

• Maintain a data map of systems, owners, retention settings and hold capability, including chat, AI assistants and logs.
• Agree a written hold procedure with counsel covering trigger, scope, notice, technical preservation, register, reminders and release.
• Confirm licences and plan tiers support holds for every in-scope platform before a matter arises.
• Add a hold check to leaver processing and device reissue.
• Test a hold end to end each year, including Teams chats, private channels and Copilot interactions or equivalents.
• Restrict eDiscovery roles to named people with phishing-resistant MFA, and log and alert on searches, exports and hold changes.
• Protect discovery API tokens and service accounts as privileged non-human identities.
• Coordinate incident response actions with counsel so evidence needed for litigation is preserved.
• Review open holds quarterly and release those counsel confirms are no longer needed.

Standards and references

• Cornell LII: Federal Rules of Civil Procedure Rule 37
• Cornell LII: Federal Rules of Civil Procedure Rule 26
• Cornell LII: Federal Rules of Civil Procedure Rule 34
• Cornell LII: Federal Rules of Evidence Rule 502
• EDRM: Electronic Discovery Reference Model
• Microsoft Learn: Place content locations on hold in eDiscovery
• Microsoft Learn: Search for and delete Copilot and AI application data
• Slack: Create and manage legal holds

Related NHI Mgmt Group resources: Data Retention and Secure Deletion Guide · Incident Response Guide · Collaboration Tool Security Guide · Digital Forensics (DFIR) Guide · Enterprise AI Copilot Security Guide. This guide summarises eDiscovery and legal hold practice and is not legal advice.