Applying Legal Hold

It might become necessary during the course of an investigation to place a mailbox on Legal Hold. In IPRO, Legal Hold is a way of preserving the data to create an immutable record. Regulations or court proceedings might require you to show chain of custody, that records are intact, and that there has been no spoliation. In that case, you will need to "freeze" certain data sets to ensure they cannot be deleted, either intentionally or accidentally.

Two types of Legal Hold are possible in IPRO Search:

  • Legal Hold for Archives: This feature places data that has been archived on Legal Hold. This feature is only available if at least one archive location (email archive or file archive) is selected as part of the case setup—see Editing Cases .
  • Legal Hold for Live Content: This feature places live email, file, Teams, SharePoint or Slack content on Legal Hold. This feature is only available if at least one live location is selected as part of case setup—see Editing Cases .

Placing Archives on Legal Hold and the IPRO Admin UI

The function of the Legal Hold feature in IPRO Search is to prevent the data in question from being deleted at the end of the retention period.

For Legal Hold on Archives, it enforces the process of collecting the data to match the Legal Hold scope, this includes the collection of data that is beyond the archive policy and new data entering the source system.

A Legal Hold for Archives is achieved by setting up a corresponding Legal Hold job in the IPRO Admin UI. A Legal Hold job must be configured for each Archive location you want to place under Legal Hold—see Configuring Legal Hold Jobs.

If this step is not performed first, you will not be able to save the Legal Hold parameters for archives.

Placing a Legal Hold on Live Content

The function of the Legal Hold feature for Live Content in IPRO Search is to prevent the data in question from being deleted.

For Legal Hold on Live Content, it enforces the process of collecting the data to match the Legal Hold scope that is set by the Federated Search performed. This includes new data entering the source system.

A Legal Hold for Live Content is achieved by first performing a Federated Search. To apply a Legal Hold for Live Content, you must include at least one live location in the search (i.e., Gmail, MS Teams, SharePoint, or Slack).

The scope of the Legal Hold for Live Content will match the scope of the Federated Search applied in the selected search tab—see Federated Searches.

Access and Confidentiality

It is a best practice in IPRO Search to create a case dedicated specifically to the purpose of Legal Hold. This is a way of controlling any confidential aspects around Legal Holds. Due to the sensitive nature of the legal proceedings that precipitate Legal Holds, you might not want a wide internal audience to know whose mail, files, and messages are being preserved this way.

The Case Manager can grant case access to any Case Manager who needs to know about the Legal Hold and in some cases, participate in it.

Placing data on Legal Hold "freezes" it for all users, meaning that once someone places the content on Legal Hold, it cannot be deleted by anybody, regardless of what case they are working in, and whether or not they know certain data has been placed on Legal Hold.