The discipline of Records Management encounters certain critical events that require Records to be taken out of their normal processing workflow and moved from their existing state into hold state. One of these special cases is called Legal Hold and every Data, Information, Knowledge, and Records Management professional should be familiar with it, regardless of their role in an enterprise.
Defining Legal Hold
Legal Hold (or plural form Legal Holds) is a term used to define a specific state in the life cycle of one or more Records that moves said Records out of the path of their normal life cycle and into a temporary state of limbo, until otherwise specified.
Legal Hold Triggers
A Legal Hold state for one or more Records is triggered by an event that is driven by in-progress or perceived possible future litigation. Such events are often termed Legal Hold Trigger Events or Legal Hold Triggers.
Legal Hold Triggers can originate from external sources (i.e. outside the enterprise) or internal events (i.e. inside the enterprise). Examples of external triggers include but are not limited to notices or communications received from an external legal professionals or firms, courts (e.g. a subpoena), or government/regulatory agencies. Internal Legal Hold triggers might come directly from internal legal counsel for pending or future litigation, from Audit and Compliance organizations (e.g. audit tests or failed internal audits), or from predefined internal operating rules that automatically trigger the movement of Records into Legal Hold. For example, a specific type of customer complaint or manufacturing defect might automatically trigger a Legal Hold for one or more Records.
Understanding and tracking the triggering event for Legal Hold, throughout its life cycle, is just as important as the tracking and the handling of the Records being held. It is, therefore, very important to correlate the triggering event to the Records being held. This brings up a very important point… All Legal Hold Triggers have a life cycle that they should be tracked and managed through, from inception through to completion.
Legal Hold Records Custodian
An enterprise’s Legal Hold solution should include one or more clearly identified Records Custodians who specifically responsible for holding Records that have been placed into a Legal Hold state (or will need to be placed in such a state).
Legal Hold Custodians should be thoroughly educated about their roles, responsibilities, and accountabilities.
When a Legal Hold is triggered, the Records Custodian is given (or collects) the appropriate Records and is made accountable for their safeguarding, while they are in the Legal Hold state.
The Legal Hold Custodian should also be able to assist in the process of tracking Legal Hold Triggers, from beginning to end.
Geographic Variations and Dependencies
It is important to understand that different countries and even regions within those countries have differing regulations for Legal Hold. As a result, if your enterprise spans more than one country, you should set up practices that allow you to proactively collect and continuously manage such regulations, to stay on top of changes.
Physical versus Electronic Legal Hold
Placing Physical Records into a state of Legal Hold usually requires moving original (or verifiable copies) of the physical artifacts (e.g. Paper Documents) into segregated and managed repositories, where the artifacts’ locations are registered and maintained for access, when needed.
Placing Electronic Records (a.k.a. Digital Records) into a state of Legal Hold usually means replicating electronic data and/or documents into different and parallel electronic/digital repositories. Different electronic record types will require different electronic solutions. For example, data records will often require different replication and hold solutions than electronic documents.
Establishing an Isolated Legal Hold Location
It is always a best practice to create a separate and protected Legal Hold repository or holding location so as isolate Records in a Legal Hold state from other Records that are not. These isolated repositories or locations also (usually) make it easier to store, know where to find, access, and track Records that are currently in a Legal Hold state.
Distribution of Records in Legal Hold
Once Records are in a Legal Hold state, it is important to have well-documented solutions for how you will handle:
- Tracking of Requests for Legal Hold Records (e.g. who requested Records, when did they request, how were the Records distributed to them, when they were distributed, where do all Copies or Originals currently exist?
- Legal Hold Records Requests (e.g. Request for Copies, Request for Originals, etc.).
- Legal Hold Records Distribution(s) (e.g. Will you make copies? Will you make electronic Copies? How will you distribute Originals? Will there be Safe Rooms for viewing or Safe Systems for viewing? Etc.).
Removing a Legal Hold
The removal of a Legal Hold is usually triggered by a formal written (paper or electronic) letter or message that allows the Records being legally held to be moved back into their normal Records Life Cycle or destroyed (as per formally defined and documented processes).
Once a Legal Hold is removed, you should have clearly documented solutions for things like:
- How you will collect and distributed Records.
- How you will either re-integrate Records back into their normal processes and locations or how you will destroy them.
- How you will track the events or notifications that triggered the removal of Legal Hold state.
- How you will keep a recoverable history of all notifications that trigger the removal of Legal Hold state.
- How the enterprise communicates Legal Hold removal.
- How you will track and report the completion of all Legal Hold removals/terminations, to the end of their life cycle(s)… including any re-integration or destruction of Records.
Defensibility for Legal Hold
An enterprise that deals with Legal Holds must also be able to provide adequately defensible proof that they are performing Legal Hold in good faith. As a result, an enterprise Records Management program should have defensible documentation for topics such as but not limited to:
- Policies for Legal Hold.
- Processes and Procedures for Legal Hold.
- Roles and Responsibilities for Legal Hold.
- Education and Training Practices for Legal Hold.
- Proof of Documentation and Publication of Legal Hold documentation.
- Proof of broadly acceptable access to Legal Hold related documentation, organizations, people, tools, technologies, etc.
- End-to-end auditable Touch-Points for Legal Hold processes.
Integrating Legal Hold into Audit and Compliance to Help Solidify Defensibility
If your enterprise has a formal Audit and Compliance program, it is highly recommended that you establish random internal compliance audits so as to test Legal Hold defensibility.
Because there are many different Record Types that can be placed into Legal Hold, it is required that your random audits test the Legal Hold process as it applies to different Record Types. Such random audits help develop defensible confidence across a credible sampling of Record Types.
All random audit results should be collected and maintained, throughout history, to help establish proof of internal Legal Hold testing, which will be important for defending your Legal Hold practices with external entities (e.g. law firms, courts, government agencies, companies, etc.).
Establishing and Maintaining a Legal Hold Education Program
It is always recommended that your enterprise establish and maintain a proactive Legal Hold education program that teaches, both, employees and consultants things like the relevant standards, processes, procedures, best practices, tools, roles and responsibilities, and their own obligations for Records Management Legal Hold situations.
The materials used for such education should be made openly and readily available to employees and consultants, along with all other RM documentation, and they should be published in an open and well known area, such as the enterprise Intranet or Digital Enterprise Library.
Establishing a Legal Hold Communications Program
It is highly recommended that the enterprise design, document, and establish a repeatable Legal Hold Communications Program. This program should, at a minimum, address communications for:
- New and Ongoing Legal Hold Trigger Events
- Record Types currently under Legal Hold
- Record Types that can be released from Legal Hold
- Legal Hold Incident Handling
- Education Programs for understanding and participating in Legal Hold situations
- Where to find all Legal Hold related documentation
- Any significant or relevant changes to existing Legal Hold Trigger Events
- Any significant or relevant changes to existing Legal Hold documentation
- Where to find tools and technologies that facilitate Legal Hold
- Who the internal Legal Hold subject matter experts (SMEs) are that can help with Legal Hold
Summary and Conclusions
- Records Management is more than just about knowing how to create, process, store, access and dispose of Records as part of their normal processing life cycle.
- RM also includes special Hold states. The most critical is what is known as a Legal Hold state.
- There are numerous Legal Hold Triggering Events.
- There should be clearly documented solutions (e.g. processes, procedures, tools, technologies, roles, responsibilities, etc.) for how your organization responds to and deals with such events.
- Your enterprise should strive to make Legal Hold processes as defensible as possible.
- Your enterprise should strive to establish a strong Legal Hold Communications Program
- Your enterprise should strive to establish a strong Legal Hold Education Program
- Beware that different countries, regions, localities, etc., have different Legal Hold requirements. If you’re an enterprise that operates in different geographic areas, this will be very important to your enterprise.
- Refer to the constantly growing Records Management Repository for more publications on Records Management.