What to do if…
you receive a legal hold or preservation notice to keep records for a case

What to do now

1. Freeze deletion now.

   • Stop deleting anything that may be connected to the people, dates, events, places, accounts, devices, or documents mentioned in the notice.
   • Include messages, photos, videos, emails, DMs, call logs, notes, cloud files, shared drives, downloads, backups, and work-system records.

2. Stop automatic loss.

   • Turn off disappearing messages, auto-delete, bulk clean-up apps, and automatic “free up space” tools where they may affect relevant material.
   • Make a short note of what setting you changed and when.
   • If changing a setting could itself delete or sync changes across devices, stop and ask the named contact, your organisation’s legal/compliance team, or a solicitor before changing it.

3. Do not reset, upgrade, migrate, or reorganise devices yet.

   • Do not wipe a phone, factory-reset a laptop, replace a device, clear a cloud account, or run a large file clean-up.
   • Do not move everything into new folders or export only selected items.
   • Keep the device and account in ordinary use as far as you safely can, but avoid actions that delete or overwrite relevant material.

4. Read only enough of the notice to identify the preservation scope.

   • Look for the date range, names, organisations, case reference, subject matter, and types of records mentioned.
   • If the scope is unclear, preserve anything that may reasonably fall within it until you have clarification.
   • Do not spend hours searching, sorting, or deciding what is “good” or “bad” evidence.

5. Make a short preservation note.

   • Write down the date and time you received the notice.
   • Write down the steps you took to stop deletion.
   • List the devices and accounts that may contain relevant material, such as your phone, email, WhatsApp, Signal, Telegram, Instagram, Facebook Messenger, cloud photos, work email, Teams, Slack, shared drives, or backups.
   • Keep this factual. Do not add arguments, guesses, or explanations beyond what happened.

6. Send the notice to the right person.

   • If this came through work or an organisation, send it to the named contact or the legal, compliance, HR, data protection, or records team and ask what to do about work systems and retention settings.
   • If this is personal, contact a solicitor or use a legal-advice route for your part of the UK and ask what must be preserved and how.
   • If the notice names a sender or reference number, keep that information with your preservation note.

7. If police or criminal proceedings are involved, keep your response preservation-only.

   • Ask for the named officer or contact route, the case or reference number, and any written preservation instructions.
   • Tell them you have stopped deletion.
   • Do not investigate, curate, edit, or try to explain the material yourself before getting advice.

8. Warn other people who could accidentally delete material.

   • If you share a phone, tablet, computer, family account, work account, cloud storage, or login, send a short neutral message such as: “I have received a notice to preserve records for a case. Please do not delete, edit, or clean up anything that may be related.”
   • Do not discuss the facts of the case in that message unless you have been told to.

9. If something may already have been deleted, do not try to cover the gap.

   • Do not recreate, backdate, alter, or hide anything.
   • Write down what you think happened, when it happened, and whether it may have been automatic deletion, a sync change, a device change, or a manual deletion.
   • Ask the named contact, your organisation’s legal/compliance team, or a solicitor what to do next.