Applying Legal Hold

It might become necessary during the course of an investigation to place a mailbox on Legal Hold. In NetGovern, Legal Hold is a way of preserving the data to create an immutable record. Regulations or court proceedings might require you to show chain of custody, that records are intact, and that there has been no spoliation. In that case, you will need to "freeze" certain data sets to ensure they cannot be deleted, either intentionally or accidentally.

Two types of Legal Hold are possible in NetGovern Search:

  • Legal Hold for Archives: This feature places data that has been archived on Legal Hold. This feature is only available if at least one archive location (email archive or file archive) is selected as part of the case setup—see Editing Cases .
  • Legal Hold for Live Content: This feature places live email, file, Teams, SharePoint or Slack content on Legal Hold. This feature is only available if at least one live location is selected as part of case setup—see Editing Cases .

Placing Archives on Legal Hold and the NetGovern Administrator UI

The function of the Legal Hold feature in NetGovern Search is to prevent the data in question from being deleted at the end of the retention period.

For Legal Hold on Archives, it enforces the process of collecting the data, including any new data entering the system that is in the archive Legal Hold scope to match the Legal Hold scope, this includes the collection of data that is beyond the archive policy and new data entering the source system.

A Legal Hold for Archives is achieved by setting up a corresponding Legal Hold job in the NetGovern Administrator UI. A Legal Hold job must be configured for each Archive location you want to place under Legal Hold—see Configuring Legal Hold Jobs.

If this step is not performed first, you will not be able to save the Legal Hold parameters for archives.

Placing a Legal Hold on Live Content

The function of the Legal Hold feature for Live Content in NetGovern Search is to prevent the data in question from being deleted.

For Legal Hold on Live Content, it enforces the process of collecting the data, including any new data entering the system, to match the Legal Hold scope that is set by the Federated Search performed. This includes new data entering the source system.

A Legal Hold for Live Content is achieved by first performing a Federated Search. To apply a Legal Hold for Live Content, you must include at least one live location in the search (i.e., Gmail, MS Teams, SharePoint, or Slack).

The scope of the Legal Hold for Live Content will match the scope of the Federated Search applied in the selected search tab—see Federated Searches.

NOTE
A case manager conducting eDiscovery can enable Legal Hold for cases within NetGovern Search, via the Legal Hold tab—see Legal Hold Tab.

Access and Confidentiality

It is a best practice in NetGovern Search to create a case dedicated specifically to the purpose of Legal Hold. This is a way of controlling any confidential aspects around Legal Holds. Due to the sensitive nature of the legal proceedings that precipitate Legal Holds, you might not want a wide internal audience to know whose mail, files, and messages are being preserved this way.

The Case Manager can grant case access to any Case Manager who needs to know about the Legal Hold and in some cases, participate in it.

Placing data on Legal Hold "freezes" it for all users, meaning that once someone places the content on Legal Hold, it cannot be deleted by anybody, regardless of what case they are working in, and whether or not they know certain data has been placed on Legal Hold.