How to Use Google Vault to Place Legal Holds on Employee Data

The Importance of Legal Holds

When an organization faces litigation, a regulatory audit, or an internal investigation, IT administrators are legally required to preserve all relevant digital communication. If an employee involved in a lawsuit deletes an incriminating email or purges their Google Drive, the company can face severe penalties for “spoliation of evidence.”

To prevent this, Google Workspace Enterprise includes a powerful eDiscovery tool called Google Vault. By placing a “Legal Hold” on a user or an entire Organizational Unit (OU), you can silently and immutably preserve all their data. Even if the user deletes an email and empties their trash, the data is retained in Vault indefinitely for administrators to export and hand over to legal counsel.

Step 1: Access Google Vault

You must have the appropriate Google Workspace license (Business Plus, Enterprise Standard, or Enterprise Plus) and be assigned the Vault Administrator role.

1. Navigate to vault.google.com and log in with your administrator credentials.
2. In the left-hand navigation pane, click on Matters.
3. Click the Create button to start a new legal matter. Name it something descriptive (e.g., “HR Investigation – J. Doe”) and enter a description if necessary. Click Create.

Step 2: Create the Legal Hold

Once inside the specific Matter workspace, you can define exactly what data needs to be preserved.

1. Click on the Holds tab at the top of the Matter screen.
2. Click the Create button.
3. Give the hold a specific name (e.g., “J. Doe Email and Drive Hold”).
4. Select the service you want to target. You must create separate holds for different Google services. Select Gmail first, then click Continue.

Step 3: Define the Scope of the Hold

You now need to tell Vault exactly whose data to lock down.

• Specific Accounts: If the investigation only involves one or two people, select “Specific accounts” and enter their exact email addresses (e.g., [email protected]).
• Organizational Unit (OU): If you need to preserve data for an entire department, select an OU.
• All Accounts: Only use this for company-wide regulatory compliance, as it preserves everything for everyone.

Step 4: Set the Conditions (Optional)

If you only need to preserve emails related to a specific project, you can use search terms. For example, if you enter “Project Titan” in the Terms field, the hold will only apply to emails containing those words. If you leave the Terms field blank, all emails will be preserved regardless of content.

You can also define a date range (e.g., preserve all emails sent between Jan 1, 2024, and Dec 31, 2024). Click Create to finalize the hold.

Step 5: Verify the Hold

Once you click Create, the hold becomes active immediately. The user will not be notified that a hold has been placed on their account. Their daily workflow remains completely uninterrupted.

However, from this moment forward, any email they attempt to delete will simply be hidden from their view while being securely retained in Google Vault. To complete your legal coverage, repeat the process and create a second hold targeting Google Drive for the same user to ensure their documents and spreadsheets are also preserved.