How does a litigation hold override privacy law requirements to delete personal data?

A litigation hold does not truly “override” privacy law. Instead, most privacy regimes are written to accommodate a competing legal obligation to preserve evidence. When the two appear to conflict, the preservation duty generally pauses a deletion requirement for the specific data at issue — it does not erase the underlying privacy obligation.

Why the conflict arises

Privacy laws often require that personal data be deleted once it is no longer needed, or when an individual requests erasure. At the same time, when litigation, an investigation, or an audit is reasonably anticipated, an organization has a legal duty to preserve relevant information. A routine deletion that destroys evidence can expose the organization to spoliation sanctions.

So you can face two lawful-sounding commands at once: “delete this” and “keep this.”

How the two are reconciled

Privacy frameworks typically resolve this by recognizing exceptions rather than forcing deletion:

• Legal obligation / legal claims exception. Many privacy laws allow continued retention where data is needed to establish, exercise, or defend a legal claim, or to comply with another legal duty.
• Narrow scope. The hold should cover only data reasonably relevant to the matter — not an entire dataset. Other personal data remains subject to normal deletion rules.
• Suspend, don’t expand. A hold suspends routine disposition; it is not authority to collect or keep more than necessary.
• Continued protection. Held data still must be secured, access-controlled, and handled under the organization’s privacy and security safeguards.
• Release on schedule. When the matter closes, the hold is lifted and the deferred deletion is carried out.

Practical guidance

Treat preservation and privacy as compatible duties to be documented, not a winner-take-all override. Identify the specific records subject to the hold, record the legal basis for keeping them, limit access, and track the hold so disposition resumes promptly once the obligation ends. A defensible, well-documented process is the key to satisfying both obligations.

Strong privacy programs build these exceptions and tracking steps into their controls in advance. For related concepts, see the privacy and PII topic hub.

Because requirements vary by jurisdiction and matter, organizations should confirm specific obligations with qualified legal counsel.