Litigation Hold and Internal Investigations: Preserving Evidence Before a Lawsuit Is Filed

A common assumption is that a litigation hold starts when the company is sued and served with a complaint. That instinct feels sensible, because a lawsuit is concrete, dated, and delivered by someone outside the company. 

The law, however, has never tied the duty to preserve evidence to the day a complaint is filed. That duty begins when litigation is reasonably anticipated, and investigations often create that anticipation long before any filing.

Picture this, on Monday, an employee reports her manager to HR for retaliation, and HR opens an investigation that same day. She is leaving the company, so on Tuesday, IT wipes her laptop and the messages that support her claim. 

Eight months later, a lawsuit arrives, and opposing counsel is not interested in the date you were served. Their question is simpler and far more dangerous: what did you know that Monday, and what did you do?

This blog explains why an investigation calls for a legal hold before lawsuit papers arrive, and what the law expects. It also shows how to act early without placing every workplace complaint under a blanket legal hold.

The Lawsuit Is the Last Signal, Not the First

A filed lawsuit is the latest possible trigger for a litigation hold, and it is rarely the earliest one. The duty to preserve comes from common law, which means no procedural rule has to switch it on. When Rule 37(e) was rewritten in 2015, its Committee Note confirmed the rule creates no new preservation duty. In other words, litigation hold requirements come from the common-law duty that exists once litigation is reasonably anticipated.

Courts apply that standard literally, and Apple Inc. v. Samsung Electronics Co. (N.D. Cal. 2012) shows how early it attaches. There, Samsung's duty arose on informal notice of Apple's patent claims, roughly eight months before Apple actually filed.

The real shift is this, your trigger date is not the day someone else takes action against you. Rather, it is the day your organization first had good reason to expect they eventually would.

So what gives an organization that reason to expect a lawsuit before anyone has threatened one? In practice, the answer is very often the organization's own internal investigation into the complaint.

Why an Internal Investigation Signals Anticipation of Litigation

An internal investigation is an organized concern, opened because something may have gone wrong inside the business. Wrongdoing carries consequences, so the same facts that justify an investigation often justify expecting a legal claim.

Zubulake v. UBS Warburg, 220 F.R.D. 212 (S.D.N.Y. 2003), remains the clearest example of that principle in practice. The court found the duty attached once key employees expected a lawsuit, months before any EEOC charge was filed.

None of this means that every investigation automatically triggers a legal hold across the organization. Many investigations close as simple policy matters, so counsel must apply the fact-specific test to each one.

Certain signals, however, move an investigation steadily toward reasonable anticipation of litigation, and counsel should watch for them. The table below lists the signals worth catching at intake, before any interviews are scheduled.

Under FRCP 26(b)(3), work product protection covers materials that counsel prepares in anticipation of litigation. Investigation notes, interview memos, and summaries often carry that label from the very first interview onward.

Some courts have treated a work product claim as evidence that the preservation duty had already begun. Others have held the two standards differ, so the label is not automatically a trigger date.

The practical risk remains either way, because the calendar places both claims side by side. An organization claiming protection from March and preservation from September is effectively arguing against its own documents.

The rule that follows is simple enough to adopt at the next intake meeting your team holds. Whenever counsel labels investigation material as work product, revisit the preservation decision on that same day.

If the duty can start inside the investigation, the next question becomes uncomfortable for most legal teams. What actually happened to the relevant data while the investigation was still running its course?

What Waiting Costs While the Investigation Runs

Investigations take longer than most teams expect, and the timelines are stretching rather than shrinking. NAVEX's 2026 benchmark found median case closure time rose from 21 to 28 days in a single year.

Retention policies, offboarding scripts, and device refresh cycles keep running through every one of those days. None of these automated processes knows that an investigation exists, so none of them will pause.

Go back to that Monday complaint, and follow the data forward to the day HR reaches its findings. By then, the laptop has been reimaged and the chat channel has passed a scheduled purge.

Nobody in that sequence decided to destroy anything, yet the loss can still matter a great deal later. Under Rule 37(e), a court may order curative measures when reasonable preservation steps were not taken.

Harsher remedies, such as an adverse inference, dismissal, or default, require a separate finding of intent to deprive. Notice which date that analysis starts from, because it is the trigger date and not the filing date.

Every week spent waiting inside the investigation sits inside the window a court will later examine. That window opened on Monday, whether or not anyone at the organization recognized it at the time.

The answer is not to freeze every system whenever a complaint arrives at HR or compliance. Instead, the answer is a deliberate preservation decision made at intake and recorded while the facts are fresh.

Preserve Early Without Holding Everything

The Rule 37(e) Committee Note asks for reasonable steps, and it openly acknowledges that perfect preservation is often impossible. That language gives legal teams clear permission to be proportionate rather than preserving everything by default.

A proportionate intake decision settles four practical questions before investigators conduct the first interview in the matter. Together, those four decisions define the litigation hold requirements for the matter, whatever counsel ultimately concludes.

1. Pick a Decision Owner: Choose one person from legal to decide what to preserve, plus a backup for evenings and weekends.
2. List What Could Disappear: List any data that could be deleted soon, like auto-deleting chats, laptops due for wiping, or accounts about to close.
3. Confirm Each Step Is Done: Give each step one owner, and mark it done only when that person confirms it happened.
4. Decide When to Review Again: Note which events should send the decision back to legal, such as new people involved or a lawyer's letter.

When notice could tip off the subject, preservation can run silently at the system level instead. Our guide to running internal investigations without blowing the matter open explains how that sequencing works.

If counsel decides no hold is needed yet, write that decision down with the reasoning and a review date. A documented decision not to preserve is defensible, while an undocumented one looks like no decision at all.

Now replay that Monday with this intake decision in place, starting from the moment the complaint arrives. Counsel spots a retaliation claim and a departing custodian, so the laptop and chat channel are preserved within hours.

The investigation then proceeds exactly as HR planned, except that the evidence it depends on still exists. Nothing about the interviews, the timeline, or the confidentiality of the matter had to change.

Prove It Happened Before Anyone Asks

A sent hold notice proves that instructions went out, but it does not prove that anything was preserved. Courts expect counsel to monitor compliance actively, rather than assuming custodians and systems followed the notice.

So test your process now, before opposing counsel tests it for you in a hearing. Pick a recently closed investigation, and ask someone who never touched it to rebuild the preservation timeline.

From your records alone, they should find the allegation date, counsel's assessment, and each action's confirmed completion. Every scope change should also appear, along with the date and the reason it was made.

If the reviewer needs to ask the original administrator what happened, your defensibility lives in one person. When that person leaves, the defensibility leaves too, which is usually when spreadsheets stop being enough.

Image: Show a defensible preservation record containing allegation date, counsel’s assessment, preservation actions, completion proof, scope changes, and decision history. 

Where Venio Fits in Pre-Litigation Preservation

Venio Legal Hold is built for holds that begin before a lawsuit does, starting with the triggering event. It records the reasoning behind each decision and timestamps every notice, reminder, and escalation as it happens.

For investigations, silent holds preserve a custodian's data without sending any notice to the person involved. Custodian questionnaires map where relevant data lives, while departure alerts flag offboarding risk during an active hold.

Where the source system supports it, Venio preserves data in place instead of copying it elsewhere. If the matter becomes litigation, preserved data moves into early case assessment and review without any export.

Venio also runs in the cloud, on-premises, or hybrid, which matters for sensitive investigation data. Executive mailboxes and whistleblower identities often cannot sit in shared infrastructure for regulatory or security reasons.

The strongest preservation record starts on the day a complaint arrives, not the day a lawsuit does. Book a Demo, bring a recent investigation scenario, and see how Venio helps you build that record from intake. 

‍

Frequently Asked Questions

Do you need a legal hold before a lawsuit is filed?

Often, yes, because the duty to preserve evidence begins when litigation is reasonably anticipated, usually well before filing. A legal hold before lawsuit papers arrive is usually expected, because filing is the latest possible trigger, not the default. 

Does an internal investigation trigger the duty to preserve?

It can, although an investigation does not automatically create the duty to preserve on its own. Allegations that describe a legal claim often create reasonable anticipation, so counsel should assess each matter at intake.

What does reasonable anticipation of litigation mean?

It means litigation is a credible probability rather than a remote possibility, judged by what the organization knew. Courts assess it in hindsight, so specific allegations, counsel involvement, and outside references all carry weight.

Can labeling documents as work products trigger the duty to preserve?

Some courts have treated a work product claim as evidence that litigation was anticipated for preservation purposes too. Other courts say the two standards differ, so revisit preservation whenever that label is first applied.

What happens if data is lost before the hold is issued?

If the duty had already attached, FRCP 37(e) may apply, and a court can order measures to cure prejudice. Severe sanctions, such as an adverse inference or dismissal, require a separate finding of intent to deprive.

Do you have to tell an employee under investigation about a hold?

Not always, because a silent hold can preserve data at the system level without notifying the custodian involved. Whether and when to notify is a decision for counsel, recorded with a date and a clear reason.

Is a legal hold the same as a litigation hold?

Yes, both terms describe the same obligation to preserve relevant information once litigation is reasonably anticipated. A preservation order is different, because a court imposes it during a proceeding rather than the organization itself.