When You Can’t Destroy Data Even Though You Want To
Most of the data destruction conversation focuses on when and how to destroy data. But there are situations where you’re legally prohibited from destroying data, even on equipment you want to dispose of. A legal hold (also called a litigation hold or preservation order) overrides your normal data retention and destruction policies and requires you to preserve specific data until the hold is lifted.
Disposing of a device that’s subject to a legal hold can result in charges of spoliation of evidence, adverse inferences in court proceedings, sanctions from the court, and separate penalties depending on the jurisdiction. Understanding how legal holds interact with device disposal is essential for any organisation with a structured IT disposal process.
What Is a Legal Hold?
A legal hold is a directive to preserve all data and documents that may be relevant to a current or reasonably anticipated legal matter. It can be triggered by actual litigation (you’ve been sued or are suing someone), a reasonable anticipation of litigation (you’ve received a demand letter or a dispute is escalating), a regulatory investigation or inquiry, a government audit, or an internal investigation.
The hold applies to all forms of data, including electronic data stored on IT equipment. This means laptops, desktops, servers, phones, tablets, backup tapes, external drives, and any other device that might contain data relevant to the matter.
A legal hold doesn’t just apply to the data itself. It applies to the devices containing the data if the data hasn’t been adequately preserved elsewhere. You can’t destroy a laptop and claim the data was preserved because “it should be in the backup.” You need to verify that the data exists in an accessible, authenticated form before disposing of the hardware.
How Legal Holds Affect IT Disposal
When a legal hold is in place, any device potentially containing relevant data must be excluded from your normal disposal process until the hold is lifted. This has several practical implications.
Disposal queues must be checked: Before any batch of equipment goes through your destruction process, someone needs to verify that none of the devices are subject to an active legal hold. This requires communication between your legal team and your IT disposal team.
Decommissioned equipment may need to be stored: If a device is at end of life but subject to a hold, you can’t destroy it. You need secure storage for held devices until the hold is released, which might be months or years.
Data preservation may be required before disposal: In some cases, you can dispose of the hardware if you first create a forensically sound copy of the data. This requires proper forensic imaging techniques that maintain the integrity and authenticity of the data for potential court use.
- Devices under hold cannot be destroyed without authorisation
- Disposal queues must be checked against active holds before processing
- Held devices need secure storage until the hold is released
- Forensic imaging may allow hardware disposal while preserving data
- The legal team must be involved in the disposal approval process
- Hold release triggers should be defined to avoid indefinite storage
The Consequences of Getting It Wrong
Destroying data subject to a legal hold, whether intentionally or through a process failure, is taken extremely seriously by courts.
Spoliation of evidence: Destroying relevant data during active or anticipated litigation can be treated as spoliation. Courts may draw adverse inferences (assuming the destroyed data would have been unfavourable to the destroying party), impose costs orders, strike out claims or defences, or in extreme cases, enter default judgment.
Contempt of court: If a specific preservation order has been issued by a court and data is destroyed in violation of that order, the organisation and potentially individual officers can be held in contempt.
Regulatory consequences: In regulatory investigations, destroying data that should have been preserved can result in additional penalties, escalated enforcement action, and reputational damage with the regulator.
Criminal liability: In some circumstances, destroying evidence can constitute a criminal offence. Section 39 of the Crimes Act 1914 (Cth) makes it an offence to destroy evidence that a person knows is relevant to a judicial proceeding.
Importantly, “we didn’t know about the hold” or “it was destroyed as part of our normal process” are not defences if the organisation should reasonably have known about the obligation to preserve. This is why integrating legal hold checks into your disposal workflow is critical.
Building Legal Hold Into Your Disposal Process
The intersection of legal holds and IT disposal requires coordination between legal, IT, and asset management functions. Here’s how to build it in:
Maintain a legal hold register: Your legal team should maintain a register of all active legal holds, including the matter they relate to, the types of data and custodians covered, the date the hold was implemented, and the criteria for releasing the hold.
Cross-reference before disposal: Before any device enters the destruction queue, its user (custodian) and the data it contains should be checked against the legal hold register. This can be manual for small volumes or automated through asset management systems for larger organisations.
Tag held devices: Devices subject to legal holds should be physically and electronically tagged to prevent accidental processing. Remove them from the normal disposal workflow and store them securely in a designated area.
Define a forensic imaging process: Where the hardware needs to be disposed of but the data needs to be preserved, establish a forensic imaging process. This should produce bit-for-bit copies that maintain metadata, hash values for integrity verification, and documentation that would be admissible in court.
Establish hold release procedures: When a legal matter concludes, the hold should be formally released by the legal team, and held devices should be returned to the normal disposal queue. Without a release process, devices accumulate indefinitely.
Practical Challenges
Several practical challenges arise when managing legal holds alongside device disposal:
Identifying relevant devices: Legal holds are typically framed around custodians (people) and subject matter, not specific devices. Translating “preserve all documents relating to the Project Alpha dispute held by the finance team” into specific device serial numbers requires input from both legal and IT.
Multi-user devices: Shared workstations, servers, and network storage may contain data from multiple custodians. A legal hold affecting one user’s data can effectively lock an entire shared device from disposal.
Backup complexity: If data from a held device exists in backup systems, the backup must also be preserved. You can’t rely on live device preservation alone if your backup rotation would overwrite the relevant data.
Duration uncertainty: Legal matters can take years to resolve. Devices that were current when the hold was placed may be severely outdated by the time it’s released. Budget and plan for extended secure storage.
Scale management: Organisations involved in large litigation or class actions may have hundreds or thousands of devices subject to holds. Managing this at scale requires system support rather than manual tracking.
Best Practices
- Include legal hold checks as a mandatory step in the disposal workflow
- Maintain a current register of all active legal holds
- Establish clear communication channels between legal and IT disposal teams
- Physically and electronically tag devices subject to holds
- Store held devices securely with access controls and logging
- Define forensic imaging procedures for preserving data while disposing of hardware
- Review and release holds promptly when legal matters conclude
- Train IT disposal staff on legal hold obligations and the consequences of non-compliance
- Document all hold-related decisions and actions
Legal holds are a critical exception to normal disposal processes, and managing them well requires proactive coordination rather than reactive scrambling. Building hold awareness into your disposal workflow from the start is far easier than trying to recall already-destroyed devices.
For the broader context of building a compliant disposal process, see our guide to building an IT asset disposal policy and our complete guide to data destruction.
EWV helps Victorian businesses manage e-waste and IT asset disposal compliantly and sustainably — including collection, certified data destruction, and recycling. Contact us for a free quote.