Your automated retention job deletes records after seven years. Legal informs you that litigation is anticipated involving accounts from nine years ago. What now?

What the interviewer is testing

Whether you know that legal hold overrides retention, and whether your architecture can express that.

The immediate position

Preservation obligations attach when litigation is reasonably anticipated, not when it is filed. So the obligation may already have attached, and "our retention job deleted it automatically" is not a defence — the consequences include adverse inference and sanctions.

Immediate action: suspend the retention job for the potentially relevant scope while the position is established. A blunt suspension is the right first move; refinement comes after.

What the architecture needs

A hold flag that suppresses deletion, applied at the level of a matter rather than a record, capable of covering data identified by criteria rather than by enumeration — because at the point a hold is issued, the exact set of relevant records is not known.

Auditability: you must be able to demonstrate what was held, when the hold was applied, and that it was effective.

Coverage across the estate. A hold that only stops the primary database's retention job, while analytics copies, archives, backups and logs continue to expire, has not preserved anything.

Release, so holds are scoped and lifted rather than applied broadly and forgotten.

The key design property: retention decisions must be suppressible per record set, not implemented as an unconditional lifecycle rule the storage platform enforces with no override. Cloud object lifecycle policies and immutable retention settings are convenient and can make a hold impossible to apply, which is a trap worth knowing about before choosing them.

The tension to name

Legal hold conflicts directly with the right to erasure, and it wins — but only for data actually within its scope. An over-broad permanent hold becomes a justification for retaining personal data indefinitely, which no regulator accepts. So scoping and release are compliance requirements, not housekeeping.

What a strong answer adds

Recovering what has already been deleted: check whether any backup within its retention window predates the deletion, and preserve that backup immediately before it rolls. That is frequently the only remaining copy and it has a short window.

Common weak answers

Disabling all retention indefinitely. Assuming backups will cover it without checking the window.