Stop deletion while a legal matter is open

A legal hold is a recorded decision that data in a defined scope must not be destroyed until it is released. It names what it covers, why, and who placed it. Every path that deletes or scrubs data asks one question before acting: is any of this under an active hold?

The problem it solves

Once data is deleted on a schedule, a firm facing litigation, a regulator’s investigation or a client dispute must be able to stop that deletion for exactly the data concerned, and show that it did. Pausing every deletion job is too blunt; relying on someone to remember is not a control.

What it does

Three scopes. A hold covers a whole organization, a list of records of one kind (or every record of that kind), or everything the application attributes to one person. A list is explicit, so which records were held can be answered from the hold itself.

A stated ground. Legal claims, a regulatory investigation or a legal obligation. The ground travels into every refusal and erasure report, because it is what a person is owed when their erasure is not completed.

Every deletion path inside the application respects it. The scheduled retention deletion skips held records and counts them. A person’s erasure leaves held records untouched and reports them. An organization under hold is not purged. A direct deletion or a cascade into held records is refused. A held record’s stored files are not removed. Scrubbing personal details counts as destruction and is suspended too.

Two tiers, each releasing only its own. An organization’s owner can hold its own data; an application super-administrator can place a hold on a tenant through a declared, audited crossing. Only the tier that placed a hold may release it, and both can see every hold on the tenant.

Fails closed. If the holds cannot be read, nothing is treated as unheld: interactive deletions are refused and scheduled jobs skip and report.

It preserves; it does not freeze. Records under hold can still be read and corrected. Only their destruction is suspended.

What you decide

Nothing to enable: the engine provides the hold records and their operations, and every deletion path consults them. Decide who in your organization places and releases holds.

Selected from legal-holds.shared.schemas.ts; the documentation comments on the two vocabularies are omitted.

export enum LegalHoldScopeKind {
  ORGANIZATION = 'organization',
  RESOURCE_ROWS = 'resource_rows',
  DATA_SUBJECT = 'data_subject',
}
// …
export enum LegalHoldGround {
  /** Litigation, a dispute or a claim that is reasonably anticipated — Art. 17(3)(e). */
  LEGAL_CLAIMS = 'legal_claims',
  /** A regulator's or authority's investigation that requires the data to be preserved. */
  REGULATORY_INVESTIGATION = 'regulatory_investigation',
  /** A legal obligation to keep the data, other than a statutory retention period of a class — Art. 17(3)(b). */
  LEGAL_OBLIGATION = 'legal_obligation',
}

Every hold names one of the three scopes and one of the three grounds, together with a required justification in the placer’s words. An organization’s owner places one through POST /organizations/{organizationId}/legal-holds/place, and a placement without a fresh step-up authentication is refused.

Limits

The hold governs the application’s own data. When a held person’s erasure is requested, the effects that erasure has at outside vendors, such as anonymising the customer at the billing provider, are not yet suspended with it.