The safety net has to be in place before you fall
Retention just stops deletion. Legal hold stops disposal. Neither proves a record is unaltered - or that it'll still open when someone needs it.Â
There's a plan in the background at many organizations, never written down as policy: while retention rules keep things long enough, and legal hold locks down anything under dispute, that's regarded as the whole answer to whether the record would hold up, if it were ever challenged.Â
It sounds reasonable, but it's also based on two assumptions that retention and legal hold were never designed to meet:Â
- That the file will still open in twenty years
- That you can prove, from the moment it was captured, that it hasn't changed since.
Neither gap shows up on a compliance dashboard. A green checkmark means "nobody deleted it"; it says nothing about whether the format will still be readable once the software that created it is gone, or whether anyone could demonstrate the record is unaltered from day one. That distinction stays invisible for as long as nobody's had reason to look – that is until a board member, a regulator, or opposing counsel asks the one question retention and hold were never built to answer: how do you actually know?
Here's why prepared beats reactive, and doing nothing is never neutral.
A hold is real, it just isn't proof. Legal hold does exactly what it claims: it stops deletion, and that's a genuine, necessary capability, not a hollow promise. What it doesn't do is establish, at the moment a record is captured, a fingerprint showing it hasn't changed since. That proof either exists from day one or it doesn't exist at all. No amount of skill, urgency, or budget applied later can retroactively prove a file wasn't altered ten years ago - you can show it wasn't deleted, but that’s not the same.
You can't know in advance which file will matter.Â
The "retention and hold have this covered" plan assumes someone can spot the record that will eventually be challenged and give it special attention. In practice, the record that matters is whichever one a regulator or plaintiff happens to ask for - and that's unpredictable, years in advance. The only position that holds up is treating every record as if its authenticity might be tested, not assuming the policy layer that stops deletion is also handling that harder question.
A lock on the door doesn't tell you what happened before it was fitted.Â
Retention and legal hold sit on top of content that's still, underneath, living in its original mutable format - a policy layer, not a change to the file itself. That's a perfectly good tool for what it's built to do. It was never built to answer whether the file will still open in eleven years, or to survive the record being exported when the system it lived in gets decommissioned. And if it turns out there's a genuine gap after the fact, firms like Kroll and KLDiscovery do excellent forensic recovery and chain-of-custody work - but they do arrive after the event, and a fire department, however good, can't rebuild a house that already burned down.
The cost curve is inverted, not smaller.Â
Ongoing preservation is a flat, budgeted, unglamorous line item. Discovering, mid-dispute, that a hold didn't guarantee what everyone assumed it did, turns into an emergency-priced, deadline-driven cost, incurred at the exact moment you have the least leverage to negotiate and the least time to be careful. Assuming the retention system already covers this, is not the cheaper option. It's the same cost, moved to the worst possible moment, with legal exposure riding on the outcome.
Real-time records outweigh reconstructed, in front of anyone whose job is to doubt you.Â
A regulator or opposing counsel treats "here's the unbroken record, verified the whole way through" very differently from "here's the file, the hold log shows nobody deleted it, and here's our best reconstruction of the rest." The second one doesn't just look weaker, it can read as evidence the organization assumed a policy control was doing more than it actually does, this being a harder position to defend than simply not having found the record at all.
None of this is an argument against retention and legal hold.Â
It's an argument about what they're for, and the gap they expose. They're the layer that stops obvious mistakes - the accidental deletion, the untracked disposal - and they do that job well. They were never designed to answer the question that actually decides how the story ends: was the record provably trustworthy before anyone needed it to be?
That question tends to stay theoretical right up until a hold gets tested and shows its limits. It's only then that anyone starts tracing the decisions behind the setup - who assumed the policy layer was doing more than it was, and when. Preparedness is what keeps that conversation short and unremarkable instead of long, careful, and increasingly personal.
Find out more about Digital Preservation for construction.
