A Legal Hold Is More Than an Email

An incident occurs on site. A contractor submits a claim. A regulator begins an investigation. Legal counsel determines that relevant records must be preserved and sends a notice to the employees believed to be involved. The email is important, but it does not stop routine deletion. Mobile devices may still be replaced, contractor accounts may be closed, messages may disappear, and project systems may continue applying their normal retention rules. Employees may acknowledge the notice without understanding which records they control or where those records are stored.

Months later, the organization discovers that critical information no longer exists. The notice was sent, but the evidence was not preserved. A legal hold is not a communication event. It is an operational process for protecting evidence.

Understand When Preservation Becomes Necessary

The obligation to preserve information can arise before a formal claim is filed or litigation begins. Depending on the jurisdiction and circumstances, it may begin when litigation, arbitration, an investigation, or another dispute is reasonably anticipated. Identifying that point requires legal judgment.

Acting on it requires operational coordination. Legal counsel may define the matter, relevant issues, potential custodians, and categories of information to be preserved. Project, operations, information technology, records, document control, human resources, and contractor management teams must then translate that direction into practical action. This can be difficult in mining, energy, and infrastructure organizations. Relevant information may be distributed across:

• Offices
• Project Sites
• Contractor Systems
• Operational Platforms
• Mobile Devices
• Shared Drives
• Engineering Applications
• Physical Records
• and more

The organization must know where its evidence lives before it can protect it.

Treat the Hold as a Controlled Process

A defensible legal-hold process should identify what triggered the hold, who authorized it, which people and organizations are affected, what information must be preserved, and which routine practices must be suspended.

The process should also establish accountability. Someone must maintain the custodian list, issue notices, track acknowledgments, coordinate technical preservation, follow up with contractors, monitor personnel changes, and document the actions taken. Counsel should remain involved as the scope of the matter develops.

A generic notice sent to a broad distribution list is unlikely to address all relevant sources of information. Different custodians may use different systems and hold different types of records. A project manager may control contract correspondence. A field supervisor may possess photographs and text messages. An engineer may maintain models and calculations. A contractor may hold inspection records in a separate platform. The process should reflect those differences rather than assuming that every recipient can follow the same instructions.

Map the Evidence Environment

Preservation begins with understanding the information that may be relevant to the matter. For a construction claim, that information might include contracts, change orders, schedules, cost records, drawings, requests for information, approvals, meeting minutes, progress reports, photographs, and communications. For an environmental incident, the evidence may extend to monitoring results, field notebooks, equipment logs, sampling data, laboratory records, mobile photographs, weather information, operating procedures, and communications with contractors or regulators.

The map should identify both formal repositories and the less visible locations where people actually work. This may include email folders, messaging platforms, local drives, removable media, mobile devices, paper notebooks, collaboration sites, and specialized engineering or operational systems. The organization should also identify system owners, retention settings, backup processes, access restrictions, export capabilities, and third parties with control over relevant information.

This map does not need to catalog every document individually. It needs to show where relevant evidence could exist and what action is required to protect it.

Preserve Mobile and Informal Records

Important project decisions do not always occur through formal correspondence. Supervisors may send instructions by text message. Engineers may photograph field conditions using mobile devices. Contractors may discuss changes in messaging platforms. Employees may record observations in handwritten notebooks or markup printed contracts and drawings.

These records can become critical when an incident or dispute must be reconstructed. Public litigation arising from the Gold King Mine release demonstrated the potential significance of mobile device data. The proceedings examined lost text messages, photographs, and data from devices that had been reset or were otherwise unavailable. The lesson extends beyond that matter. Phones and tablets are not peripheral to modern project delivery. They may contain evidence that does not exist anywhere else.

Legal-hold procedures should address company-owned and, where legally appropriate, personally owned devices used for project work. The process should also consider messaging applications, photographs, voice recordings, offline files, notes, and other forms of informal communication. Employees need clear instructions about what must be preserved and how to preserve it without altering or losing the information.

Protect Underlying Data, Not Only Final Reports

A final report may summarize an analysis without preserving the information needed to verify it. Engineering models, spreadsheets, databases, source files, formulas, assumptions, field inputs, and intermediate calculations may all be relevant. Exporting a final PDF does not necessarily preserve the structure, metadata, or functionality of the underlying information.

Litigation involving Mingo Logan and the Spruce Mine examined the loss of mine-model data and related electronically stored information. The matter illustrates why final spreadsheets or reports may be insufficient when underlying files are needed to understand or test an analysis. Organizations should identify which native files and datasets require preservation. They should also consider the software, licenses, passwords, linked files, and technical knowledge needed to open and interpret them later.

A file that cannot be accessed or understood may provide little practical value even if it has technically been retained. Preservation planning should maintain the usability and context of complex project information, not merely its visible output.

Include Contractors and Third Parties

A legal hold issued only within the owner organization may leave a significant portion of the evidence unprotected.

Contractors, consultants, laboratories, vendors, and service providers often possess project records that the owner does not hold. Their routine processes may delete email, recycle devices, close accounts, overwrite backups, or dispose of paper records after a contract ends.

Preservation obligations and cooperation requirements should be addressed in contracts before a dispute arises. Agreements should establish the owner’s authority to issue preservation instructions, obtain relevant records, confirm compliance, and, where necessary, prevent routine destruction.

When a hold is required, the organization should promptly identify affected third parties. Notices should be directed to accountable contacts, and receipt should be confirmed. The owner should understand what systems the contractor uses, what information may be relevant, and what technical actions are being taken. The process should also reach subcontractors and other downstream parties where they possess material information. Sending a notice to the primary contractor does not guarantee that every relevant record in the delivery chain will be preserved.

Suspend Routine Deletion

Most organizations have legitimate processes for deleting information. Email systems may remove content after a defined period. Devices may be wiped when employees leave. Backup media may be overwritten. Applications may purge older data. Paper files may be destroyed according to retention schedules. A legal hold must interrupt those processes for relevant information.

This requires coordination between legal direction and system administration. Information technology and records teams need to know which users, repositories, devices, record classes, and date ranges are affected. They must understand which automated rules should be suspended and how long the suspension applies. The organization should verify that the change has taken effect. A policy statement or system setting should not be accepted without confirmation that the relevant data is actually protected.

The hold should be focused. Preserving all organizational information indefinitely can create its own cost, privacy, cybersecurity, and compliance risks. The scope should be proportionate to the matter and reviewed as circumstances change. Effective preservation protects what is relevant without abandoning responsible information governance.

Reach the Right Custodians

The initial custodian list is rarely complete. Early information may identify project leadership and the people directly involved in an incident or claim. Interviews and document reviews may later reveal additional employees, former employees, contractors, technical specialists, or administrative personnel with relevant records. The organization should have a process for updating the list as new facts emerge.

Custodians need more than a standard notice. They should understand the nature of the matter, the categories of information covered, the systems and devices included, and the actions they must avoid. They should know whom to contact if they are uncertain. Acknowledgment tracking provides evidence that notices were received, but acknowledgment alone does not demonstrate compliance. Follow-up discussions may be required for key custodians, unusual data sources, or individuals with extensive project responsibility.

The organization should also monitor role changes, extended absences, departures, and device replacements. These events can pose an immediate risk of losing preserved information. A hold must follow the custodian and the evidence through organizational change.

Distinguish Preservation From Collection

Preservation and collection are related but different activities. Preservation protects information from deletion or alteration. Collection gathers copies for review, investigation, disclosure, or production. Not every preserved record must be collected immediately, but the organization should be confident that it remains protected and retrievable.

In some circumstances, relying solely on a custodian to retain information in place may pose a risk. The person may misunderstand the instructions, accidentally delete information, replace a device, or leave the organization.

Technical preservation may therefore be required for critical sources. This might involve creating forensic copies, exporting data, securing physical records, preserving system backups, or restricting access to certain repositories.

The appropriate approach depends on the matter, the information involved, and counsel’s direction. The organization should document why a preservation method was selected and what it protects. The objective is to avoid discovering later that the information believed to be preserved was still vulnerable.

Monitor Compliance With the Hold

A legal hold may remain active for months or years. During that time, the organization, project, and technology environment will continue to change. New custodians may become involved. Additional claims may emerge. Systems may be migrated. Contractors may demobilize. Devices may be upgraded. The scope of relevant information may expand or narrow.

The hold should be reviewed periodically. Reminder notices can reinforce obligations and provide an opportunity for custodians to identify new information. System owners should confirm that preservation controls remain active. Project and human resources teams should notify the legal hold coordinator before affected personnel leave or change roles. The organization should maintain a clear record of notices, acknowledgments, interviews, technical actions, reminders, scope changes, exceptions, and releases. This documentation helps demonstrate that preservation was treated as a continuing process rather than a one-time administrative task.

Learn From Informal Evidence Failures

Public litigation across the mining and energy sectors has repeatedly shown that evidence is not limited to formal reports and approved project documents. The Orion Drilling and EQT Production litigation considered the loss of handwritten notes and marked-up contract documents associated with key personnel. The dispute demonstrated that paper notes and working documents can be legally significant when they relate to contractual events or anticipated litigation.

Other matters have examined missing mobile-device data, employee computers, emails, photographs, models, and underlying technical files. The common lesson is that relevance is determined by the information’s connection to the matter, not by whether the organization classified it as an official record. A preservation process focused only on formal repositories can therefore miss some of the most important evidence. Organizations should design legal-hold  procedures around how their people and contractors actually communicate, decide, calculate, and document work.

Release the Hold Deliberately

Preservation should not continue automatically after the legal need has ended. When counsel determines that a matter is resolved or certain information is no longer subject to the hold, the organization should issue a controlled release. Custodians, system owners, contractors, and records personnel should understand which restrictions have been removed.

The release should not result in immediate, uncontrolled destruction. Information should return to the organization’s approved retention and disposition process. Other holds, contractual requirements, regulatory obligations, or operational needs may still apply. Documenting the release creates a clear endpoint and prevents systems from accumulating information indefinitely without a valid purpose. A disciplined release is part of a defensible legal-hold program.

Preserve Evidence Before It Disappears

Legal holds are often discussed as legal notices, but their success depends on operational execution. A defensible process identifies the evidence environment, reaches the right custodians, includes contractors, suspends routine deletion, protects mobile and informal records, preserves underlying data, and adapts as the matter develops.

The strongest organizations prepare these capabilities before an incident or claim occurs. They understand their systems, establish contractual rights, define responsibilities, and test whether important information can be protected quickly. Once a device has been reset, an account has been closed, or a contractor’s records have disappeared, the organization may not be able to recreate the evidence. A legal hold must do more than tell people not to delete information. It must make preservation happen.