How do you identify which custodians and data sources to include in a legal hold?

Identifying the right people and systems is the foundation of a defensible legal hold. The goal is to preserve potentially relevant information without sweeping in everything an organization holds. This requires a reasonable, documented, and proportional process rather than guesswork.

Start With the Matter, Not the Data

Begin by understanding the dispute or investigation: the claims and defenses, the relevant time period, the key events, and the subject matter. These facts define relevance and set the boundaries for whom and what you must preserve. In U.S. federal civil litigation, the duty to preserve generally attaches when litigation is reasonably anticipated, and the scope is shaped by proportionality. Rules differ across state courts and other countries, so confirm the standard that applies to your matter.

Identify Custodians

Custodians are the individuals likely to have created, received, or controlled relevant information. To find them:

• Interview the people closest to the matter (business leads, counsel, and managers) to learn who was involved.
• Map roles and reporting lines around the key events and time frame.
• Look beyond obvious actors to assistants, predecessors, and departed employees whose accounts may still exist.

Distinguish “key” custodians from peripheral ones so the hold stays proportional and focused.

Map Data Sources

Custodians point you to data, but many relevant records live in systems no single person “owns.” Inventory both:

• Custodian-associated sources: email, messaging and chat, laptops, mobile devices, and personal drives.
• Shared and structured sources: file shares, collaboration platforms, databases, line-of-business applications, cloud repositories, and backups.

A current data map or records inventory makes this far easier. Note any sources subject to automatic deletion or short retention so you can suspend those processes.

Document and Revisit

Record your decisions: who you identified, what sources you flagged, and the reasoning behind inclusions and exclusions. As discovery progresses and facts emerge, expect to add or release custodians and adjust sources. Treat scoping as iterative, not one-time.

For related concepts and definitions, see our e-discovery topic hub.