Litigation Hold and Evidence Preservation for Companies in India 2026: Email, WhatsApp, Devices, Board Records and Legal Risk

Quick answer: A litigation hold is an internal preservation process used when litigation, arbitration, regulatory action or an investigation is reasonably foreseeable. The company identifies relevant custodians and data sources, pauses routine deletion where necessary, preserves emails, messages, devices, cloud records, contracts, board materials and other evidence, and documents the preservation process. Indian law does not depend on one single “litigation hold statute”; preservation obligations arise from the evidentiary, procedural, regulatory and factual context of the dispute.

1. Why Evidence Preservation Matters

Corporate disputes are increasingly decided through digital records. Emails, WhatsApp chats, ERP logs, approval trails, board packs, CCTV, cloud documents, phone records and transaction histories can establish who knew what, when approval was given and whether a later explanation is credible.

If those records disappear after a dispute becomes foreseeable, the company may face adverse evidentiary arguments, regulatory concern, credibility problems and practical difficulty proving its own case. Preservation is therefore both defensive and affirmative: it protects evidence the company may need to succeed.

2. What Is a Litigation Hold?

A litigation hold is a direction to preserve potentially relevant information and suspend ordinary destruction or overwrite processes for that information. It is usually coordinated by legal counsel with IT, HR, compliance, records teams and business custodians.

The hold should be targeted. Freezing every record in the company indefinitely is expensive and unnecessary. The objective is to identify the subject matter, date range, people and systems likely to contain relevant information.

3. When Should a Hold Begin?

The safest trigger is not limited to service of a plaint or arbitration notice. A serious legal notice, threatened termination dispute, whistleblower complaint, regulatory inquiry, investigation, demand letter, contractual breakdown or credible threat of proceedings may make preservation appropriate.

Legal teams should assess foreseeability early. Waiting until formal pleadings arrive may be too late if auto-delete systems or employee exits have already removed relevant material.

4. The First 24 Hours

When a high-risk dispute emerges, counsel should identify immediate preservation risks: departing employees, expiring CCTV, auto-deleting chat systems, laptop reimaging, mailbox deletion, phone replacement, server log rotation and document shredding.

These sources can disappear quickly. A temporary freeze followed by a more refined hold is often better than waiting for a perfect scope.

5. Identify the Legal Matter

The hold notice should describe the matter sufficiently for custodians to understand what must be preserved without circulating unnecessary privileged strategy. It can identify the counterparty, project, contract, transaction, relevant dates and categories of records.

Vague instructions such as “preserve everything related to legal issues” are difficult to follow and difficult to audit.

6. Identify Custodians

Custodians are the people likely to have relevant information. They may include directors, founders, sales staff, procurement, finance, HR, project managers, company secretarial teams, IT administrators and former employees.

The legal team should think beyond job titles. A junior employee may hold the only WhatsApp thread documenting the negotiation.

7. Email Preservation

Email is often the primary evidence source. IT should preserve relevant mailboxes, including deleted items where technically recoverable, and stop automatic deletion for custodians within the hold scope.

Exporting a handful of visible emails is not the same as preserving the mailbox. Metadata, attachments and threaded context can matter.

8. WhatsApp and Personal Messaging

Indian businesses frequently conduct substantive work on WhatsApp. Contract changes, delivery instructions, payment promises, approvals and admissions may appear there. If relevant business communications exist on personal devices, preservation becomes more complicated but no less important.

Companies should establish lawful BYOD and records policies before disputes occur. During a hold, counsel should consider privacy, proportionality and the need to preserve only business-relevant material.

9. Slack, Teams and Collaboration Platforms

Modern collaboration tools may have short retention periods, editable messages and multiple channels. Legal and IT teams should understand the organisation’s retention settings before an incident occurs.

Important decisions made only in chat can disappear if no preservation process exists.

10. Laptops and Desktops

Reimaging an employee laptop after resignation can destroy locally stored evidence. Where a custodian is relevant to a dispute, the device should be preserved or imaged in a controlled manner before reassignment.

Chain of custody and forensic integrity may matter where authenticity is likely to be challenged.

11. Mobile Phones

Phones can contain messages, call logs, photographs, documents and authentication records. The company should assess whether the device is company-owned or personal and what lawful access rights exist.

For highly sensitive investigations, independent forensic collection may be preferable to informal screenshots.

12. Cloud Drives

Google Drive, OneDrive, Dropbox and enterprise document systems often maintain version history and sharing logs. These can be valuable evidence showing when a contract, policy or spreadsheet changed.

Preservation should include metadata and versions where relevant rather than merely downloading the latest copy.

13. ERP and Accounting Systems

Financial disputes may depend on ledger entries, purchase orders, invoices, approval workflows, credit notes, vendor master changes and payment authorisations. Legal teams should involve finance and IT to preserve system data in usable form.

PDF exports may not capture all audit trails available in the system.

14. CCTV

CCTV is often overwritten within days or weeks. In workplace incidents, theft, physical access disputes, delivery cases or safety events, immediate preservation may be critical.

The hold should identify specific cameras and time ranges to avoid collecting excessive irrelevant footage.

15. Access Logs

Building access, server login, VPN, system and application logs can establish presence, access and sequence of events. Retention may be short.

Cyber and fraud matters should treat log preservation as a first-day priority.

16. Board Materials

Board minutes, agenda packs, resolutions and director communications can be central in shareholder, director-liability and transaction disputes. Preserve final versions and relevant drafts where appropriate.

Do not reconstruct or silently edit old minutes after a dispute arises. See our Board Minutes and Board Resolutions guide.

17. Contracts and Negotiation History

The signed agreement is only part of the record. Drafts, mark-ups, negotiation emails, term sheets and change orders may explain disputed clauses or later variations.

Preserve the execution copy and material negotiation trail together.

18. Employee Exit Risk

When a key custodian resigns, standard offboarding may delete access and wipe devices. HR should have a legal-hold check before final data deletion for employees linked to active disputes or investigations.

Exit interviews can also identify where project records are stored.

19. Former Employees

Relevant former employees may possess knowledge or records not retained centrally. Companies should preserve what remains in company systems and consider lawful outreach where necessary.

Do not instruct former employees to alter or delete personal records relevant to anticipated proceedings.

20. Document Retention Policies

A normal retention policy supports compliance and reduces unnecessary data. A litigation hold temporarily overrides scheduled destruction for relevant information.

The existence of a written policy can help show that routine deletion before a dispute was ordinary practice, while deletion after a hold should be prevented.

21. Auto-Delete Settings

Many systems automatically delete chats, backups, deleted-mail folders or logs. Legal teams should know these settings. A hold that does not actually suspend deletion is only paperwork.

IT confirmation should be documented.

22. Preservation Versus Collection

Preservation keeps information from disappearing. Collection copies information into a review environment. Not every preserved record must immediately be collected.

Large matters can begin with broad preservation and then use narrower collection based on issues and custodians.

23. Chain of Custody

Where authenticity may be challenged, document who collected a device or file, when, from where and how it was stored. Forensic tools can generate hash values and preserve metadata.

Simple matters may not require full forensic imaging, but serious fraud, cyber and criminal-risk cases often justify specialist support.

24. Electronic Evidence and the Bharatiya Sakshya Adhiniyam

The Bharatiya Sakshya Adhiniyam, 2023 recognises electronic and digital records within the modern evidence framework. Companies should therefore preserve digital information in a manner that supports authenticity and admissibility rather than relying on isolated screenshots wherever better records exist.

The official statutory text is available through India Code.

25. Privileged Material

Collection may capture communications with advocates and legal advisers. These should be segregated for privilege review before production.

Our guide on Legal Privilege and In-House Counsel Communications explains the corporate framework.

26. Personal Data and Proportionality

Preservation should be targeted to the dispute. Collecting entire personal devices without legal basis can create privacy and employee-relations issues. Counsel should define business-relevant scope and use proportionate methods.

Access should be limited to the investigation or litigation team.

27. Regulatory Investigations

When a regulator requests documents, the company should preserve the responsive universe and maintain a production log. Legal review should address scope, confidentiality and privilege.

Deleting material after receiving a regulatory request can substantially increase risk.

28. Arbitration

Commercial arbitration increasingly involves extensive document evidence. Early preservation can prevent a party from losing critical correspondence that proves notice, delay, variation, payment or termination.

Contracting teams should involve legal counsel as soon as a major project dispute appears likely.

29. Employment Litigation

Termination and misconduct disputes may require emails, performance records, attendance, policies, investigation notes and approval trails. HR should not delete a former employee’s mailbox automatically if litigation is foreseeable.

Preservation should include the policy version applicable at the relevant time.

30. Vendor and Customer Disputes

Commercial recovery cases often turn on purchase orders, delivery confirmations, quality complaints, invoices, acknowledgments and payment promises. Sales and operations teams may hold these records in informal channels.

See our Vendor Default and Commercial Recovery guide.

31. Fraud Investigations

Fraud matters require rapid preservation because suspects may delete records once they know of the investigation. Legal, IT and forensic teams may need to preserve mailboxes, devices, financial logs and access records before interviews begin.

Investigation sequencing should avoid alerting key custodians prematurely where lawful and appropriate.

32. Cyber Incidents

Cyber incidents can destroy or alter evidence through malware, attacker activity or emergency remediation. Incident response should balance system restoration with forensic preservation.

Legal counsel should coordinate with technical responders so evidence needed for law enforcement, insurance, regulatory reporting or litigation is not lost.

33. Hold Notices

A hold notice should be clear, understandable and practical. It should tell recipients what matter is involved, what categories to preserve, which deletion practices to stop and whom to contact with questions.

Recipients should acknowledge the notice. Legal should track acknowledgments and follow up.

34. Periodic Reminders

Long disputes require periodic reminders. New custodians may join the matter, employees may change roles and new data sources may emerge.

A hold is a continuing process, not a one-time email.

35. Releasing a Hold

When the matter and reasonable risk have ended, legal should formally release the hold and allow normal retention policies to resume. Keeping holds open forever creates unnecessary storage and compliance burden.

The release decision should be documented.

36. A Practical First-Day Checklist

• Identify the dispute or investigation.
• Identify immediate deletion risks.
• List key custodians.
• Pause mailbox and collaboration-tool deletion where needed.
• Preserve devices of departing or high-risk custodians.
• Preserve board, finance and contract records.
• Identify relevant CCTV and logs.
• Issue a written hold notice.
• Coordinate IT, HR and legal.
• Document each preservation step.

37. Common Mistakes

Common failures include waiting for formal litigation, relying on screenshots instead of preserving source records, wiping departing employees’ devices, failing to suspend auto-delete settings, forgetting WhatsApp, editing historical documents, collecting far too much irrelevant personal data and failing to segregate privileged material.

38. Frequently Asked Questions

Is there one Indian statute called the Litigation Hold Act?

No. Preservation duties arise from the procedural, evidentiary, regulatory and factual context of the dispute.

When should a company issue a hold?

When litigation, arbitration, investigation or regulatory action becomes reasonably foreseeable and relevant records are at risk of deletion.

Does a hold mean saving everything forever?

No. It should be proportionate and matter-specific.

Should WhatsApp be preserved?

If relevant business communications are on WhatsApp, they should be considered within the preservation scope.

Can IT simply back up the server?

A server backup may not capture all relevant cloud, device, chat, personal-business and metadata sources. Legal should define the information universe.

39. Conclusion

Evidence preservation is one of the cheapest forms of litigation risk management and one of the most expensive things to get wrong. A company that acts early can protect the record, maintain credibility and give counsel the evidence needed to assess exposure. A company that waits may discover that the decisive mailbox was deleted, the phone was reset and the CCTV overwritten.

The right system combines legal judgment with IT execution. Counsel identifies what matters. IT knows where it lives. HR knows who is leaving. Business teams understand what must not be deleted. Together, they create a defensible preservation process before the dispute becomes a courtroom problem.