Draft

Draft a defensible litigation hold notice

Produces a hold notice a custodian can actually follow: named people, every data source including personal phones, a date range with reasons, plus the IT preservation memo and the tracking log that prove you sent it.

About 15 minintermediateIn-house, Litigation

Your prompt4,936 characters

Still to fill in: Matter, Trigger and date, Custodians and data sources, Preservation date range

RoleYou are an in-house counsel who has issued dozens of litigation holds and had two of them read back to you in a spoliation motion. You write for the custodian rather than for the record (short sentences a sales director can follow without calling you) and because you assume every line will be quoted by opposing counsel, you never write "relevant documents" where you could name a system.What I needDraft the hold notice for Matter, plus the IT preservation memo and the tracking log, from the trigger and scope below.InputsMatter: Matter Trigger and date: Trigger and date Custodians and sources: Custodians and data sources Preservation date range: Preservation date range Forum and preservation standard: Forum and preservation standardHow to work this1. Open with the trigger and the date the duty attached. Calibrate the IT memo to Forum and preservation standard; where you do not know that forum's spoliation standard, say so rather than assuming the federal rule. 2. List every custodian from Custodians and data sources by name and role. "The sales team" preserves nothing. Where I gave you a group instead of names, write [NAME REQUIRED] rather than inventing people. 3. Turn the sources into a checklist a custodian can walk unaided: mail with deleted items and archives, chat including private channels, file storage, business systems, recordings, voicemail, messaging apps, personal devices, paper. 4. State Preservation date range and give a reason for each bookend. Unbounded ranges get ignored; unexplained ones get attacked. 5. Write prohibited actions as concrete behaviors: no emptying trash, no archive tools, no device wipe or trade-in, no forwarding to personal accounts, no tidying a channel, never as principles. 6. Close with an acknowledgment deadline, one phone number, an instruction to preserve when in doubt, and a departure clause: anyone planning to leave calls legal before offboarding.Close with these four sections, every time, without being askedAssumptions I made. Every assumption about when the duty attached, who belongs on the list, which systems exist, retention defaults, and the standard governing in Forum and preservation standard. Mark each [verify] or [safe]. If you assumed the trigger date, say so; that one is load-bearing. Where this is weakest. The two or three places this hold gets attacked: the custodian nobody named, the system nobody thought of, the departed employee whose laptop is already in the reimaging queue. Point at the line. What only you can decide. The calls I left to you, as options with tradeoffs. At minimum: cast the custodian list wide now: more defensible, and it multiplies collection cost while telling people who did not need to know that the company is in trouble, or start narrow and expand as facts develop, cheaper and quieter but handing opposing counsel a date-stamped gap for every later addition. What would make this materially better. The input that would most improve the next pass: the systems inventory, the approval trail for the events at issue, current retention settings, or who is already scheduled to depart. Rank by impact.Output formatThree artifacts. (1) The hold notice, ready to send: banner, subject line naming the matter, the duty and its trigger date, scope and date range with reasons, sources checklist, prohibited actions, personal devices, departure clause, acknowledgment deadline, one contact. (2) An IT preservation memo: numbered actions, confirmation date. (3) A tracking log. Then the four closing sections.Never do this- If this notice would work for any matter at any company, it is too generic. It should name this matter, these systems, this date range. - No hedging filler and no legalese. Cut "arguably," "it should be noted," and "preserve all potentially relevant materials." A custodian who has to interpret the notice will interpret it in their own favor. Do not tell me to consult an attorney. - Every rule, retention default, or system name must come from my inputs or carry [UNVERIFIED - confirm before issuing]. Never invent a system, a backup window, or a sanctions standard; where you do not know whether a source is in scope or how long its backups survive, say you do not know and put it in the IT memo as a question. - Do not pad. A five-custodian hold is a short notice. Length is not value. Every extra paragraph is one a custodian skips.Before you answer- Is every custodian named, or did a group slip back in? - Does the notice state the trigger and the date the duty attached? - Are personal devices, messaging apps, and paper all covered? - Is there exactly one deadline and one phone number? - Could a sales director follow this without calling me? If not, rewrite it.

Adds driver's-seat tunes: options instead of answers, questions before work, every citation flagged. Your values come with it.

Pressure-test it

Makes the AI switch hats and attack its own answer.

A spoliation motion attaches this notice as Exhibit A, with the IT memo and the tracking log behind it and a deposition transcript in which a custodian says she never understood that Teams messages counted. Working as the lawyer drafting that motion, name the three attacks you would make on scope, distribution, or timing; identify the one sentence you would read aloud to the judge; then rewrite each weak point so the attack fails.

Go deeper

Pushes the work further once the basics are right.

A hold that is never refreshed is the one that gets attacked. Build the refresh schedule: what to revisit at 30, 90, and 180 days: custodian departures, new hires who touched the subject matter, system migrations, retention policies that quietly resumed, expansions in the claims, plus a short re-issuance note that a custodian who has already acknowledged will still read.

Before you run it

What to gather first

The trigger (complaint, demand letter, agency inquiry, or internal report) and the date it arrived
Subject matter and the period the dispute actually covers
Custodian names and roles, including anyone who has already left
The systems these people actually use, including anything shadow-IT
Your IT and security contacts, and whether BYOD devices are enrolled in MDM

Watch for

Departing custodians are the number one source of spoliation. Pause offboarding and image devices before the laptop is reimaged and the phone is traded in.
Backup and chat retention defaults commonly delete data in 30 to 90 days. Whatever the notice says, nothing is preserved until IT actually suspends those policies and confirms it in writing.
The model only knows the systems you list. It will not surface the shadow-IT tool, the personal Gmail thread, or the departed employee's WhatsApp group. Walk the org chart yourself.
The hold notice is usually privileged, but its existence, timing, and distribution list are routinely discoverable. Keep the distribution defensible and the tracking log current from day one.
Preservation obligations and sanctions standards differ between federal and state court and among states. Confirm the rule in your actual forum before relying on any framing here.

What comes back

Three artifacts. (1) A ready-to-send hold notice: privilege banner, subject line naming the matter, plain-English statement of the duty and its trigger date, subject and date range with reasons, a sources checklist, prohibited actions as behaviors, a personal-device section, a departure clause, acknowledgment with a deadline, and one contact. (2) A separate IT preservation memo with numbered technical actions and a confirmation date. (3) A tracking log table: custodian, role, sent, acknowledged, sources confirmed, notes. Then assumptions, weak points, the calls left to you, and what would improve the next pass.

See an example of what you’ll get

(1) HOLD NOTICE *PRIVILEGED & CONFIDENTIAL - ATTORNEY-CLIENT COMMUNICATION* Subject: ACTION REQUIRED by Friday, May 2: Preserve documents, Patel matter Fanstop received a legal demand on March 14, 2025 concerning Maya Patel's February 2025 termination. From that date, the company has a legal duty to preserve documents and electronic information that could relate to it. This notice tells you what to keep and what not to do. It takes about five minutes. Reply by Friday, May 2. What this covers. Anything relating to Ms. Patel's employment, performance, complaints, team, or termination, created or received between January 1, 2024, when she joined the platform team, and today. The range runs to the present because the dispute is live and ongoing communications about it are in scope too. What to preserve, wherever it lives: - Outlook mail: inbox, sent, drafts, deleted items, archive folders, and any .pst files - Teams: one-to-one chats, group chats, channel posts, and private channels - SharePoint and OneDrive files, including drafts and older versions - Workday and Greenhouse records - Zoom recordings, transcripts, and in-meeting chat - The platform team's Notion workspace - Text messages, iMessage, WhatsApp, Signal, including on your personal phone if you used it for work on this - Voicemail, handwritten notes, calendars, and printed material Do not: - Delete or edit anything related to this matter, including drafts - Empty deleted items, trash, or the recycle bin - Move messages out of your mailbox or run any archive or cleanup tool - Wipe, factory reset, trade in, or upgrade a device without talking to me first - Forward documents about this matter to a personal account - Tidy up a Teams channel or Notion page "for clarity" Personal devices. If you used a personal phone, tablet, or computer for anything touching Ms. Patel or her team, those messages and files are covered. Do not delete them. Call me and we will handle preservation in the least intrusive way that works. Leaving Fanstop? Contact me before any offboarding step begins. We need to image your materials first. Acknowledge. Reply to this email by Friday, May 2 with: "I have read the hold notice and will preserve." If you are unsure whether something is covered, keep it and call me at +1-555-0142. J. Lin, General Counsel --- (2) IT PRESERVATION MEMO, to A. Ortiz, CISO; copy E. Banks, IT Ops For the Patel matter, please complete and confirm in writing by Friday, May 2: 1. Place all six named custodians on Microsoft 365 Litigation Hold, including M. Patel, whose accounts are preserved system-side only, with no notice sent and no contact made. Confirm coverage across mail, Teams chat, SharePoint, and OneDrive, and add the third HRBP the day she is identified. 2. Suspend all retention and auto-delete policies for those custodians, including the 90-day Teams chat policy. 3. Extend backup retention so nothing dated January 1, 2024 or later ages out. From today that is roughly 480 days, not the 365-day default. 4. S. Park departed January 2025: confirm her mailbox is intact, her laptop has not been reimaged, and her BYOD iPhone was not remotely wiped at offboarding. If the laptop is in the reimaging queue, pull it today. 5. Image any device already collected from a departed custodian. Do not reissue. 6. Produce a list of every system these seven custodians could access between January 2024 and now, and flag anything not on my list, particularly anything provisioned outside IT. 7. Confirm BYOD MDM coverage and identify unenrolled devices. --- (3) HOLD TRACKING LOG | Custodian | Role | Sent | Acknowledged | Sources confirmed | Notes | |---|---|---|---|---|---| | M. Patel | Former VP Engineering | Not sent | n/a | n/a | Claimant, represented by Ruiz & Baptiste. No notice goes to her and nobody contacts her directly. Her Fanstop mailbox, Teams, SharePoint and OneDrive are preserved system-side under IT memo item 1 | | D. Chen | CEO | 4/25 | 4/25 | | | | L. Rivera | CHRO | 4/25 | 4/26 | M365, Workday | | | S. Park | Former Eng Manager | 4/25 | not yet | | Departed Jan 2025; laptop status unconfirmed; see IT memo item 4 | | J. Okafor | HRBP | 4/25 | | | | | T. Brandt | HRBP | 4/25 | | | | | [NAME REQUIRED] | Third HRBP | not sent | n/a | n/a | Name not provided; identify before the log is defensible | Distribution note. Five notices went out on 4/25, and a sixth goes the day the third HRBP is named. M. Patel is a custodian of data, not a recipient: she is the represented claimant, and a hold notice sent to her is a communication with a represented person and becomes an exhibit in her counsel's hands. Preserve her accounts through IT. Anything involving her personal devices goes to Ruiz & Baptiste in writing, not to her. --- Assumptions I made. That the duty attached on March 14, 2025 when the demand letter arrived, not earlier. If anyone at Fanstop anticipated litigation before that (an internal complaint, an exit interview, an escalation), the trigger date moves back and this notice is late [verify]. That January 1, 2024 is the right start because it is when she joined the team [verify]. That S. Park's January 2025 departure predates the demand letter, so nothing was collected from her at the time [verify - and if her exit was connected to the same events, the trigger date moves back with it]. That the three HR business partners are the right ones and that no recruiter or skip-level manager touched the termination decision [verify]. Where this is weakest. The custodian list. Only seven people are on it, and terminations are usually decided by more people than the org chart suggests: whoever approved the severance, whoever drafted the PIP, whoever was on the calibration call. Second: item 4 in the IT memo. If Park's laptop was already reimaged, that is a spoliation problem you have today, and the notice does not fix it. What only you can decide. Cast the custodian list wide now: far more defensible, and it multiplies collection cost while telling people who did not need to know that the company is in trouble, or start with these seven and expand as discovery develops, which is cheaper and quieter but gives opposing counsel a date-stamped gap for every later addition. Separately: image departing custodians' devices on the spot, which preserves everything and costs real money and signals to the employee that they matter to the case, or rely on the hold plus MDM, which is cheaper and risks a wiped phone on someone's last Friday. What would make this materially better. (1) The status of S. Park's laptop and phone: that is a live risk, not a paperwork question. (2) The org chart and approval trail for the termination decision, which is what tells you whether seven custodians is right. (3) Your current retention policy settings for Teams and Zoom, so the IT memo names the exact policies to suspend rather than describing them.

Why this prompt is built the way it is

## Framework 1. **Name the trigger and the date.** The duty attaches when litigation is reasonably anticipated. A hold that never says when preservation began is the first exhibit against you. 2. **Custodians by name and role.** "The sales team" preserves nothing. Names, with room to add and remove as facts develop. 3. **Every source, listed.** Mail with deleted items and archives, chat including private channels, file storage, line-of-business systems, recordings, voicemail, messaging apps, personal devices used for work, and paper. 4. **Date range with bookends explained.** Not "all dates." Say why preservation starts where it starts. 5. **Suspend deletion, then say you did.** Retention policies paused, backups extended, offboarding wipes stopped, stated in the IT memo so it can be proven later. 6. **Acknowledgment with a deadline and one number.** Written confirmation in five business days, one contact, and an instruction to preserve whenever in doubt. 7. **Plain English throughout.** If a custodian has to interpret the notice, they will interpret it in their own favor.