Best practices in archiving: Legal holds

 digg it |  reddit |  delicious |  StumbleUpon |  Twitter 

Outside a few regulated industries (e.g., financial services), many customers struggle with defining their email retention policies.  What do they need to keep?  How long does it need to be stored?  When can it be deleted?  How can an email archiving and email discovery system help with this?

Companies rightly wrestle with these challenging questions.  However, there is one area where things are much more clear.  When an organization is going through a lawsuit or reasonably-anticipates an upcoming lawsuit, it is obligated to preserve all information that could be related to that matter, going through a process called a legal hold.  This was further codified for electronic evidence like email in the recent amendments to the US Federal Rules of Civil Procedure.

When you look at the headlines around e-Discovery violations, many of the fines and sanctions, including the recent issues Oracle is facing, are related to a failure to observe a legal hold - not a general violation of records retention.  In other words, when a court, judge or matter tells you to preserve electronic records, make sure you can do it.  

This requirement to keep data is there in a surprising number of circumstances:

• Even if you normally would be deleting the data under you standard policies; if you have it, you need to preserve it.
• Even if the data is not online (e.g., on backup tapes), in many cases, you need to preserve it (hence IT often suspends rotation of backup tapes).
• Even if a formal lawsuit hasn't been filed but you reasonably-anticipate an upcoming matter, you may need to start a legal hold.

Previously, companies would enforce legal holds for email in several ways:

• Ask the people who hold the data (custodians) to retain it.  This might involve an email to employees asking them not to delete messages related to a topic.  Obviously this depends on users actually preserving the data and sometimes creates conflicts of interest.
  
• Ask IT to keep backup tapes of the email servers.  Obviously this is very inefficient, since backup tapes are very redundant (almost the same data every day) and coarse (keep everyone's email even though you only need email from a few people).  In addition, backup tapes don't capture messages received/sent and deleted in between the backup period (e.g., between the daily backup).
  
• Ask IT, legal or an outside consultant to capture the hard drive of the employees involved.  This can get very expensive and time-consuming and only captures a one-time snapshot of the user's data.

Increasingly, companies are looking to email archiving solutions and email archiving SaaS solutions in particular to allow IT and legal to enforce legal holds for email quickly and without end-user intervention while still facilitating a platform for the company's long-term retention policies, as they are defined.

In other words, organizations should continue to deliberate their retention policies but many are looking to make sure they are not exposed around legal holds today.