Who owns the cost and the end date of a legal hold that counsel will not release?

## Why this becomes a leadership problem After a few intrusions that turned into disputes, an organisation accumulates holds. Each one is easy to issue and nobody is rewarded for ending one. Meanwhile the archive that was going to expire at ninety days is now three years deep, the mailboxes of people who left are still preserved, and the platform administrator who was told to suspend a lifecycle rule during an incident is asking three reasonable questions: who is paying for this, when does it end, and what happens if I miss one. Those questions do not have technical answers, which is why this sits above the incident lead. ## The split that causes it The preservation duty is legal's. The cost, the operational risk and the data-minimisation exposure land on engineering and security. Legal has every incentive to preserve broadly because the downside of under-preserving is a sanction against the company, while the downside of over-preserving is somebody else's storage line. Left alone this asymmetry produces permanent, unbounded holds that nobody can attest to. ## Instruments that actually work **A hold register.** One row per matter: matter reference, the responsible lawyer by name, the systems and date ranges covered, each destructive mechanism suspended with the owner who confirmed it, the volume and cost being carried, the date issued and the next review date. If you cannot produce this document, you cannot honestly claim in a deposition that the hold was implemented, and you also cannot make a cost argument, because you do not know the number. **Scope written as systems and dates, not people.** Custodian lists preserve mailboxes but leave machine-generated telemetry outside the hold entirely, because a lifecycle rule has no custodian to notify. Naming the system, the window and the job also makes narrowing possible later: once the disputed period is fixed at a few weeks, there is rarely a reason to keep freezing everything on either side of it. **Segregation into a hold store.** Copy the preserved material once into a separate, immutable location and restore normal retention on the live estate. This is the single highest-value move available: it converts an indefinite freeze on a production system, which will eventually be re-enabled by someone who does not know why it was off, into a bounded archive with an explicit owner. It costs a defensible collection exercise up front and buys back both the operational risk and most of the cost. **A review conversation with a specific question.** Asking counsel "can we release this hold" invites a no, because the matter is still open and no lawyer will trade a small saving for any sanction risk. Asking "the disputed traffic is a nine-day window in November; can we narrow the preservation on the mail platform to the four custodians and that quarter" invites a real answer, because it is a scoping decision rather than a release decision. **A named escalation.** If counsel will neither narrow nor release, the position is legitimate and the cost is real, so an accountable executive should accept it explicitly, in writing, with the number attached. That is not a bureaucratic flourish: it is what stops the security or platform team from carrying an unfunded permanent obligation that they will eventually solve informally by turning a job back on. ## The argument against freezing everything Over-preservation is not the safe option it looks like. Preserved personal data sits in tension with the minimisation commitments the organisation has made elsewhere; a mailbox held for six years is also six years of material an opposing party can demand; storage and its egress become a real line item; and the biggest risk of all is credibility, since a hold nobody can describe accurately is worse in a deposition than a narrow hold that was implemented and evidenced. The honest posture is narrow, precise and provable, with a bias towards preserving where you are genuinely unsure. ## What to say in the interview Make three moves. Name the split (legal owns the duty, engineering carries the cost, so neither can fix it alone). Offer the instruments (register with a named lawyer per matter, scope by system and date, segregate into an immutable hold store so the live estate returns to normal, review with a narrowing question). Then own the residual: where counsel will not move, escalate for an explicit funded decision rather than letting the obligation decay quietly on a platform team's backlog.