Legal Hold and the Wipe You Must Not Do
Sometimes destroying data is the wrong action for reasons that have nothing to do with the device. Knowing when.
Wipe · Analysis
General orientation, not legal advice; obligations differ substantially by jurisdiction and circumstance.
The practical question in “Legal Hold and the Wipe You Must Not Do” is how to make work visible without confusing visibility with certainty. For teams researching hourly timesheet template, hourly timesheet template can add time and project context to the operational record, provided its use is proportionate, disclosed and reviewed with the people affected.
The usual instinct on departure or incident is to remove data quickly. There are situations where that is precisely wrong.
For an independent baseline relevant to “Legal Hold and the Wipe You Must Not Do”, the NCSC mobile-device guidance is a useful companion: compare its principles with the proposed configuration, ownership model and real support process before approving a rollout.
When preservation obligations arise
Litigation, actual or reasonably anticipated.
A regulatory investigation.
An internal investigation into conduct.
A subject access or disclosure request covering the material.
In each, destroying relevant data can be a serious matter independent of the original reason for the wipe.
Why devices are caught by this
People hold work material on devices that exists nowhere else: messages in work chat applications, photographs of whiteboards, notes.
Which means a device can be the only copy of something relevant.
And the leaver process destroys it routinely, which is fine until it is not.
The practical control
A check in the leaver process: is this person subject to any hold?
Answerable by whoever holds that register, which should exist.
One question, asked before the device action, and it is the whole of the protection.
Who should know
Whoever administers devices needs to be told when a hold applies, and usually is not.
Which means the register has to reach IT rather than sitting with legal.
A named route for "do not wipe this device" is worth establishing before it is needed.
Preserving without keeping the device
Where the device must be preserved, the usual answer is imaging or export rather than freezing the hardware.
On personal devices this is considerably harder and raises its own questions about personal content.
Take advice early, because the forensic and privacy considerations interact and improvising is expensive.
The opposite error
Holding everything indefinitely because nobody will decide to release it.
Holds should be released when the matter ends, and somebody should own that.
An unreleased hold is a growing data holding with obligations attached, which is the mirror of the problem it was meant to solve.
Routine retention
Separate from holds and worth getting right: how long device records, logs and management data are kept.
Its own note covers it.
The point here is that a hold overrides retention, and the two mechanisms need to know about each other.
What to check
Does your leaver process check for a hold before device action?
Who would tell IT that a device must be preserved?
Is there work material that exists only on devices?
And does anybody release holds when matters end?