When litigation is reasonably anticipated, a legal hold tells you to stop deleting relevant data. In U.S. federal civil cases, Rule 37(e) addresses electronic information lost because a party failed to take reasonable steps to preserve it. Engineers run the systems that delete things, so they need to know how to pause them. This is education, not legal advice.
What Rule 37(e) says
According to the rule text, it applies only when all of these hold: electronically stored information should have been preserved in anticipation or conduct of litigation; a party failed to take reasonable steps to preserve it and it was lost as a result; and it cannot be restored or replaced through additional discovery.
Two tiers of consequences follow. If the court finds prejudice, it may order measures no greater than necessary to cure it. Only on a finding of intent to deprive may it presume the information was unfavorable, instruct the jury accordingly, or dismiss the case or enter default judgment. Committee notes say negligent or even grossly negligent loss does not support those severe measures.
The rule asks for reasonable steps, not perfection. The notes say a court may consider a party's sophistication and the proportionality of preservation cost.
Why this lands on engineering
Retention is usually automated. Log pipelines expire after 30 days, chat tools delete after 90, ticket systems purge. A hold is only real if someone changes those settings for the relevant data. Legal can issue the notice, but cannot toggle your log store.
A readiness checklist
- Know your defaults. Document the retention period for logs, chat, email, tickets, source history and backups.
- Have a switch. For each system, know who can suspend deletion for a scoped set of users, dates or data, and how fast.
- Scope with legal. Ask what is relevant, so you do not preserve everything forever, which is costly and creates its own risk.
- Record what you did. Note the date holds started, which systems, who acted. That record is evidence of reasonable steps.
- Mind departing staff. Wiping a leaver's laptop or mailbox on offboarding can destroy held data.
- Release holds properly. When legal says the matter is over, restore normal deletion and document it.
Incidents are a common trigger
After a breach, litigation or regulatory action is often foreseeable. Pull the hold switch early for the affected systems and the incident response channel. Pair this with advice from counsel on report handling, as in our Capital One note.
Retention also conflicts with privacy rules that push you to delete. When both apply, ask counsel to decide the order of priority and record it.
A caution on scope
Rule 37(e) is a U.S. federal rule. State courts and other countries have their own preservation rules. Treat this as a model for readiness, not a statement of your duties.
Quick check
Does losing logs always lead to sanctions?
No. The rule requires failure to take reasonable steps and lost data that cannot be replaced. The harshest remedies need intent to deprive.
Who starts a legal hold?
Legal counsel typically issues it. Engineering carries it out on the systems that delete data.
Sources
Last reviewed: 19 October 2026.
