Records Retention and Legal Hold

Legal hold is the mechanism that overrides every other retention rule, and it is the one most often missing from data architectures because it is invisible until it is urgent.

When litigation or investigation is reasonably anticipated, an organisation must preserve everything potentially relevant, including material that automated retention policy would otherwise delete tomorrow. Failure to preserve carries serious consequences — adverse inference, sanctions, and in some jurisdictions criminal exposure — and "our retention job deleted it automatically" is not a defence, because the obligation attached before the deletion ran.

The architectural requirement is therefore a hold flag that suppresses deletion, applied at the level of a matter rather than a record, capable of covering data identified by criteria rather than by enumeration, and auditable — you must be able to demonstrate what was held, when the hold was applied, and that it was effective.

The direct conflict with erasure rights is real and is resolved in favour of the hold, but only for the data actually within its scope. That means holds must be scoped and released rather than applied broadly and forgotten, since a permanent over-broad hold is itself a compliance problem: it becomes a justification for retaining personal data indefinitely, which no regulator accepts.

The system property to build early: retention decisions must be suppressible per record set, not implemented as an unconditional lifecycle rule the platform enforces with no override.