Legal Hold and Disposal

Legal hold suspends the retention schedule for records that must not be destroyed, however overdue they are.

Where to find it

These features have no dedicated Architect Panel section of their own. They are configured through their datastores, opened from All Datastores, and most of what a caseworker sees appears on the record itself rather than on an admin screen.

Why hold overrides the schedule

Destroying records relevant to litigation, an investigation or an information request is a serious matter regardless of the fact that a schedule said they were due. Hold takes precedence, and the ordering is not configurable for good reason.

Applying a hold

Apply it as soon as you are on notice, not when proceedings begin. The obligation usually starts at the point litigation is reasonably anticipated, which is earlier than most people assume. Record why the hold exists and who applied it — a hold nobody can explain will eventually be lifted by somebody tidying up.

Lifting a hold

Lifting is a deliberate act, and once lifted the record returns to its schedule and may become immediately due for disposal. Confirm the matter is genuinely concluded before lifting; a hold lifted while an appeal window is open is a hold lifted too early.

Genuine disposal

Disposal means the record is gone, not flagged as deleted. That distinction matters because a soft-deleted record still exists, is still discoverable, and is still personal data you are holding — so a retention policy implemented as a flag has not been implemented at all.

Keep the disposal record

What is destroyed should leave evidence that it was destroyed: what, when, under which schedule, authorised by whom. That record is what demonstrates the policy operates, and it is what an information request or an audit will ask for. Keeping it is not in tension with disposal — it holds the fact of destruction, not the content.