An employee admitted to deleting emails relevant to a lawsuit—what do we do now?

An admission that an employee deleted emails connected to active or anticipated litigation is a serious event. Deleting relevant electronically stored information (ESI) after a duty to preserve has attached can constitute spoliation, which may expose your organization to sanctions. The goal now is to stop the bleeding, understand what happened, and document everything.

Act Immediately

• Stop all deletion. Suspend any auto-delete or retention rules that could destroy related data, and reinforce the legal hold in writing.
• Preserve everything connected. This includes the employee’s mailbox, archives, backups, mobile devices, and any system that might hold copies of the deleted messages.
• Loop in counsel right away. Decisions about disclosure, investigation, and remediation should be guided by your legal team, not made unilaterally by IT or records staff.

Investigate and Recover

Work with IT and, where appropriate, a qualified forensic specialist to determine the scope: which emails, what dates, and whether copies still exist. Many “deleted” messages survive in journaling systems, server backups, sender/recipient mailboxes, or audit logs. Recovering ESI from these sources can substantially reduce the harm.

Document the investigation carefully and preserve a defensible chain of custody. Avoid having the involved employee “fix” things on their own, which can compound the problem.

Assess and Disclose

Under the Federal Rules of Civil Procedure, courts weigh factors such as whether the lost information can be restored or replaced, whether the loss prejudiced the other party, and whether there was intent to deprive. The available remedies range from corrective measures to severe sanctions, depending on those facts. Rules and standards differ by jurisdiction, so state courts and non-US matters may treat the same conduct differently.

Counsel will decide what must be disclosed to opposing parties or the court, and when. Candor and prompt remediation are generally viewed more favorably than concealment.

Prevent Recurrence

After the immediate response, review how the hold was communicated, whether retention controls failed, and what training or technical safeguards would prevent a repeat. Strong, documented preservation practices are your best long-term defense.

Learn more about related concepts in e-discovery.