Legal Hold and Data Freeze

1) What is Legal Hold and why is it needed

Legal Hold is a managed "freeze" of specific data potentially relevant to an investigation, audit, claim, litigation or regulatory process. The goal is to preserve evidentiary integrity: prevent destruction, modification or automatic cleaning according to retention schedules, as long as there is a legal risk.

• Timeliness: hold is introduced without delay after a "reasonable expectation" of dispute/review.
• Precision-Only the relevant sets (data minimization) are frozen.
• Observability and auditability: all actions are logged and available for verification.
• Reversibility: there is an understandable procedure for removing hold and returning to normal deletion schedules.

2) When Legal Hold is introduced: typical triggers

Notification of a claim, a complaint from the regulator, supervision orders.
Internal investigation (compliance/security/finance/AML).
eDiscovery/external consultant requests.
Security incidents (leak, fraud).
Signals from protection lines: Legal, DPO, CISO, Internal Audit.

3) Freeze volume: data sources

Operational storages: transaction database, payment logs, KYC/KYB, AML signals.
Corporate communications: mail, chats, call records, tickets.
File repositories and DWH/datalayers: raw and derived layers.
Backups and archives: snapshots, WORM storages, S3 Object Lock/immutability.
Third-party processors: KYC providers, PSP, marketing platforms, clouds.

Important: freezing applies to copies and derivatives (ETL/vitorki/caches).

4) Roles and Responsibilities (RACI)

(R — Responsible; A — Accountable; C — Consulted; I — Informed)

5) End-to-end process (SOP)

1. Initiation: Legal registers a case, forms a "scope": topics, dates, subjects, systems.
2. Evaluation and mapping: Data Owners + Legal Ops create a list of sources/tables/backups.

• Include hold tags/rules in DLP/EDRM/archiving.
• Override auto-delete/anonymization in affected schemas.
• For backups - apply immutability/WORM; commit retention override.
• 4. Legal Hold Notice - custodians - who are required to save and not delete.
• 5. Follow-up: confirmations, reminders, training, monitoring of violations.
• 6. Periodic review: minimum monthly - whether hold is relevant, whether there is excessive coverage.
• 7. Hold withdrawal: written decision by Legal; regular policies recovery checklist.
• 8. Defensible disposition: resumption of planned deletions and anonymization, recording in logs.

6) Retention policies and "freezing": how they combine

Rule: Hold suspends the corresponding retention periods only for affected objects.
Conflict with Privacy by Design: expand scope minimally; do not block "non-involved" sets.
Granularity: object (ID/subject), table/part, space/bucket, document type.

7) Technical controls

Immutable storages: WORM/S3 Object Lock, Write-Once volumes, journaled file systems.
Integrity control: hashes, chains of evidence, audit trail (append-only).
Database freeze: policy flags and triggers that prohibit UPDATE/DELETE for the specified keys.
Archiving of communications: auto-logging of mail/chats with Legal Hold API (journaling, AIP/EDRM).
DLP/EDRM integration: labels "LegalHold = true," prohibition of deletion, export by case.
Backups: separate hold-backups, with extended shelf life, recovery test.
Observability: hold case dashboard, SLA, application errors, policy drift.

8) Integration points (reference architecture)

Case Management (Legal): case system ↔ data catalog ↔ policy orchestrator.
IAM/Secrets - Delegate the minimum required export/browse access.
Data Catalog/Lineage: automatic "coloring" of dependent datasets.
CI/CD of retention configurations: hold-rules - as code (policy-as-code), review/versions.
SIEM/SOAR: alerts about attempts to delete/modify under hold.

9) Conflicts and how to resolve them

DSAR/right to delete vs Legal Hold: the subject's request may be lawfully delayed if the data is subject to retention to meet legal obligations; we fix the rationale and notify the subject of the delay.
Minimization and proportionality: revise scope; separate unrelated personal data.
Cross-border transfers: if we keep copies in other jurisdictions, we check the legal basis and transfer mechanisms (SCC/BCR/local registries).
Encryption and keys: you cannot "bypass hold" by destroying keys; KMS rotations are documented.

10) Regulatory context (for reference)

eDiscovery/civil process standards (e.g. FRCP 37 (e)) - sanctions for loss of ESI.
GDPR/local data laws: legality of storage, notices, limitation of purposes.
Financial/AML: prescribed retention periods (transactions, KYC) that may be longer than normal.

(Current regulations are being refined by Legal for your jurisdiction/markets.)

11) Metrics and SLAs

Time-to-Hold: From trigger to application on all target systems (target: ≤24 h).
Coverage:% confirmed custodians/systems under hold (target: 100%).
Drift/Violations: policy-blocked delete/edit attempts.
Scope Creep: reduce the share of irrelevant objects by monthly review.
Time-to-Release: from Legal solution to complete removal (target: ≤48 -72 h).

12) Legal Hold Launch Checklist

• Register the case and legal grounds.
• Generate scope (subjects, dates, systems, data types).
• Update data map and lineage.
• Enable hold rules in DLP/archives/DB/files/backups.
• Send Legal Hold Notice and instructions.
• Enable monitoring and alerts.
• Fix fault-tolerant backups (immutability) and test recovery.
• Regular review plan and next revision date.

13) Legal Hold Notice Template (Short)

Topic: Legal Hold: Data Retention Commitment

Addressees: [Custodians/Data Owners List]

Reason: [Case No ./Process Type]

What to save: [systems/folders/tables/mailboxes/date range]

Prohibited: delete, modify, purge, overwrite, encrypt without approval

Instructions: where and how to store, tags/tags, contact Legal Ops

Deadline: until separate withdrawal notice

Acknowledgement: reference/form for acknowledgement of reading and performance

14) Legal Hold Removal Procedure (Release)

1. Legal decision + description of reasons.
2. Final export/consolidation of evidence (if necessary).
3. Recall notifications, logging time.
4. Restore normal retention and anonymization policies.
5. Closing report: what was under hold, who was notified, what deletions were resumed.

15) Frequent mistakes and how to avoid them

Fuzzy scope → excess storage, privacy risks and costs.
Ignoring backups and caches → incomplete freezing, vulnerability of the case.
No immunity → risk of unauthorized modification.
Poor communication with custodians → human factors and violations.
Lack of regular review → "eternal" holds needlessly.

16) Mini playbook "on the ground" (operating)

DBA: apply 'legal _ hold = true' attributes on affected parties/keys; Enable audit triggers Block schema DDL changes.
Storage: switch the corresponding buckets/folders to WORM/Retention Lock mode; create snapshots.
Mail/Chat: enable logging and export for the case; prohibition of purge.
DWH/ETL: mark tables as read-only; freeze planned purges of historical parties.
Backups: dedicated, extended-term replicas; weekly recovery check.
Monitoring: notifications in Slack/Email about any DELETE/TTL event by scope.

17) Policy (sample wording)

The organization will enter Legal Hold immediately upon a reasonable dispute/review expectation.
The hold volume is determined by the principles of necessity and proportionality.
All employees are required to comply with notifications and confirm compliance.
Technical invariance is provided by immunity and audit-logging.
Hold is reviewed at least 1 times every 30 days.
Hold removal shall be executed in writing and accompanied by restoration of standard policies.

18) Related wiki sections

Privacy by Design and Data Minimization

Data Retention and Deletion Schedules

Delete and anonymize data

Legal/Regulatory Requests & eDiscovery

Incident management and forensics

DLP/EDRM and Communications Archiving

Total

Legal Hold is a manageable, measurable and auditable "freeze" of strictly defined data. A strong program relies on: (1) fast trigger and accurate scope, (2) technical immutability (WORM, object lock, audit), (3) transparent roles and SLA, (4) regular review and safe hold removal with return to normal retention.