How do you apply and later release a legal hold on records containing PII without violating a pending deletion request?

A legal hold (litigation hold) is a directive to preserve records that may be relevant to anticipated or pending litigation, audit, or investigation. A deletion or erasure request asks an organization to dispose of records, often containing personal information, once retention has lapsed or a privacy right is exercised. When both apply to the same records, the duty to preserve generally takes priority, but it must be handled carefully so that preservation does not become an excuse to ignore legitimate privacy obligations.

Why preservation usually wins

Once litigation is reasonably anticipated, the duty to preserve relevant evidence attaches and suspends routine disposition. Most privacy regimes recognize a lawful basis to retain personal data when it is needed to establish, exercise, or defend legal claims, or to comply with a legal obligation. In practice, this means a properly scoped legal hold can pause a pending deletion request for the specific records within the hold’s scope.

Applying the hold

• Define the scope narrowly. Identify only the records, custodians, and data elements relevant to the matter rather than sweeping in unrelated PII.
• Issue a written hold notice and suspend automated disposition for the affected records.
• Document the legal basis and the date the duty to preserve attached.
• Log the conflict. Note that a deletion request was received and explain why it is being deferred, not refused permanently.
• Communicate with the requester where required, acknowledging the request and stating that records are retained for a legal obligation.

Managing the conflict responsibly

Preservation does not erase privacy duties. Keep the held PII secure, limit access to those who need it, and resist using held data for unrelated purposes. Suspend only disposition, not safeguards.

Releasing the hold

• Confirm the matter is fully closed and no related claims remain.
• Lift the hold in writing and document the release date and authority.
• Re-evaluate every affected record against the retention schedule and any pending privacy request.
• Execute the previously deferred deletion promptly once no other retention obligation applies, and document defensible disposition.

Coordinate legal, records, and privacy stakeholders throughout, and capture each decision so the process is defensible. For related guidance, see the privacy and PII topic hub.