A legal hold suspends routine destruction of information that may be relevant to litigation or investigation, and when systems are decommissioned it can override the plan to sanitize the media under NIST SP 800-88 and dispose of the hardware. Decommissioning assumes the organization is free to destroy the data. Under a hold, it is not.
A hold overrides retention schedules, it overrides disposal projects, and it attaches to data regardless of which system holds it or whether that system is being retired. Destroying held data — even through a well-documented, certified process, even accidentally — is a serious matter under rules such as Federal Rule of Civil Procedure 37(e), and the certificate of destruction does not resolve it.
Two Obligations Pointing Opposite Directions
Retention schedules say how long records must be kept, sometimes by regulation as SEC Rule 17a-4 does for broker-dealers, and, frequently, that they should be disposed of afterward. Keeping data past its schedule creates its own exposure: cost, breach surface, and discoverability in future matters.
Legal hold says specific data must be preserved indefinitely, regardless of what the schedule says, until the hold is released.
A decommissioning project sits between these. The default assumption — that equipment reaching end of life carries data that has reached end of life — is the assumption that causes problems, because holds are placed on matters, not on hardware, and nobody notifies the infrastructure team when a system falls within scope.
When Should You Check for a Legal Hold?
The check belongs in the project as a gate, before any irreversible step.
Request a hold status determination from legal or records management for every system in scope, by name, in writing. Not a general question about whether holds exist — a specific inquiry about these systems, producing a specific answer you can retain.
The inquiry has to reach the systems that are not obvious. Holds are typically described in terms of custodians, matters, and data types. Translating that into which physical systems are implicated is work, and the systems most often missed are the indirect ones: tape and disk copies containing held data, archive and replication targets, log and monitoring systems, and development or test environments seeded from production copies.
Where a determination cannot be obtained before the disposal deadline, preserve rather than destroy. Storage is inexpensive and reversible. Destruction is neither.
Can You Preserve Held Data Without Keeping the Hardware?
Usually, yes. Holds attach to data, not to equipment, and the practical resolution is usually to preserve the data in a form that satisfies the obligation while the hardware proceeds to disposal.
That means a forensically sound copy, made and documented in a manner that supports the data's admissibility and completeness — chain of custody from the source system, verification that the copy is complete, and hashing to demonstrate integrity.
It also means the copy has to remain accessible in a usable form. Preserved data that cannot be read because the application that produced it no longer exists satisfies the letter of preservation and not its purpose. Where the data format is proprietary or the application is being retired alongside the system, the preservation plan needs to address readability — exporting to a neutral format, retaining a functional instance, or documenting the means of access.
Involve counsel in the method, not just the decision. What constitutes adequate preservation is a legal judgment, and the infrastructure team's role is to execute a method that legal has approved.
What Should the Decommissioning Record Show?
Whether data is preserved or destroyed, the reasoning gets recorded.
For systems destroyed, the record should show that hold status was checked, who provided the determination, when, and what it said — alongside the destruction certificate. The certificate alone establishes that data was destroyed. It does not establish that destroying it was permissible, and that second question is the one that gets asked afterward.
For systems preserved, record what was preserved, by what method, where it now resides, and which matter drove the decision. Preserved data with no record of why becomes indefinitely retained data that nobody is willing to delete, which is its own accumulating problem.
Retain these records to your own schedule. A destruction record that has itself been destroyed cannot demonstrate anything.
Releasing Holds and Closing the Loop
Holds get released when matters conclude, and the release is frequently where the process breaks down. Data preserved for a matter that closed years ago often stays preserved, because no one owns the step of checking.
Assign that ownership. Periodically reconcile preserved data against active matters, obtain written release for those that have concluded, and dispose of the released data under the normal schedule with the normal documentation.
The failure to close this loop is how organizations accumulate large volumes of data they are no longer required to keep, cannot justify keeping, and remain fully discoverable on. That is the mirror image of the risk this whole process exists to manage, and it is the more common one.