A legal hold arrives as an instruction and lands as four mechanical problems: stop the automated wipe, take the device out of the redeployment pool, store it somewhere controlled, and be able to say afterwards that nothing changed. The hard part is the first one, because it is usually already running.

TL;DR

  • The automated leaver wipe is the thing to stop, and the window is often hours rather than days.
  • Build a pause that works at the point a departure is recorded, not one that runs afterwards.
  • Held devices need a separate list and a separate cupboard, or one gets reissued by somebody who had no idea.
  • Preserving and imaging are different asks with different costs. Know which you were given.
  • Don’t ship a held device internationally. Preserve it where it is, through somebody local.
  • Record who accessed a held machine and when, because that cannot be reconstructed later.

The automated wipe is the real deadline

Most teams have connected offboarding to the HR system, which is the correct design. A leaver event fires, the device is marked for collection, and a wipe is queued automatically.

That efficiency becomes the problem. One departure in a hundred, somebody later needs the contents. The gap between a leaver record and the device becoming unrecoverable can be hours, and a hold arriving through a Monday morning inbox has already missed it. So the pause has to exist at the point the departure is recorded, available to the people who know a dispute might be coming.

And the people who know first are rarely in IT. They’re in HR, having the conversation, which means the pause has to be something an HR lead can trigger without raising a ticket and waiting.

Four things you might be asked for

These get collapsed into one word and they aren’t the same. Knowing which you’ve been asked for changes what you do in the next hour.

Leave it alone. Stop the wipe, stop the collection, change nothing. Any member of your team can do this and it preserves every other option, which is why it is the right first move even when the instruction is unclear.

Remove it from the pool. The device comes back but goes nowhere near redeployment, which means it needs a physical place and a record, not just a flag in the asset system.

Store it powered down. Somewhere controlled, labelled, not switched on. Powering a machine on changes things on it, and somebody will ask you later whether anybody switched it on after the hold arrived.

Image it properly. A copy taken under a defined process, with the original preserved, where somebody can demonstrate afterwards what was copied and that nothing was altered. That’s a professional discipline rather than a careful afternoon, and the useful preparation is knowing in advance who you would call and roughly what they charge.

Build the pause, then test it once

The whole of the preparation is four decisions and one test. It takes a meeting.

What to do:

  • Name the roles who can call a hold, publish the list, and keep it short.
  • Give it a monitored channel rather than an individual’s email address.
  • Define it as stopping the whole offboarding sequence, not an enumerated list of steps.
  • Require an explicit release from the same authority, recorded, or devices sit forever.
  • Test it on one real departure and confirm the device genuinely was not wiped.

Define it broadly on purpose. An enumerated list always misses something, and what it misses is usually the mailbox or the backup rather than the laptop.

Keep held devices away from the spares

This is the failure that actually happens. A held machine goes into general storage, somebody needs a laptop urgently for a new starter, and it gets issued by a person with no reason to know anything was unusual about it.

Keep a separate list. Not a flag in the main asset register. It sounds like duplication and it prevents the common version of this, which is a held device picked up during a routine stocktake and reissued because the system said it was available. A short list with a named owner is harder to blunder into than a field somebody has to notice.

Five columns is enough. What the device is including its identifier, who held it, the date the hold started, who instructed it, and the condition under which it ends. That last column is what separates a temporary measure from a cupboard nobody ever empties.

A team that found out the hard way

A 210-person company had a hold instruction arrive 31 hours after the leaver record was created. The automated wipe had run at the 4-hour mark.

Nothing could be recovered and the honest account of the timeline was the only thing available, which is genuinely better than an improvised recovery attempt but isn’t where anybody wants to be. What they changed afterwards was narrow: a pause button available to three named HR people at the point of recording a departure, and a 48-hour delay before the wipe queue runs on any departure flagged as contentious.

The delay cost them nothing measurable. It applies to perhaps 7 departures a year and it removed the failure mode entirely.

Distributed teams and the shipping question

Two things change when the device is in another country. The first is that your usual answer, collect it and bring it in, now takes weeks rather than days and passes through hands nobody controls.

Don’t ship it. Moving a held device is a worse idea than it first looks. The machine crosses a border, may be opened for inspection, and arrives having been handled by several people, which is the opposite of what a hold is trying to achieve. Where preservation genuinely matters, the usual answer is to preserve it where it is through somebody local rather than to move it.

So the practical shape is: stop the device moving, confirm who physically has it, and get advice before anything else. The first two steps are available to you immediately and they preserve every option that follows.

Where a lifecycle platform helps, and where it does not

The first question anybody asks when a hold lands is where the device physically is. For a distributed fleet that question is harder than it sounds, and it is the part a platform answers.

RemoAsset is our own product. Its relevance is narrow and specific: because it handles retrieval across 80+ countries and records the device through collection and return, it knows where a departing employee’s machine is and whether anything has already been dispatched. Pricing is published, from $1,499 a year on the Subscription tier for companies with 50 to 5,000+ employees, including a 60 per cent reduction on retrieval charges.

It doesn’t do the preservation. It has no network discovery, so it can’t find a machine that was never in the register. It has no software licence management. And only the Subscription tier publishes a figure, with pay-as-you-go quoted. It performs no imaging, issues no wipe, and nothing in it substitutes for proper advice on what a particular hold actually requires.

Workwize, Firstbase, GroWrk, allwhere and Deel IT operate on broadly similar lines, and not one of the five publishes a rate card. The live Workwize domain is goworkwize.com.

Checklist

Checklist:

  • A pause available at the point a departure is recorded, triggerable by HR.
  • Named roles who can call a hold, published to whoever receives the instruction.
  • A monitored channel for the instruction, not an individual inbox.
  • A separate list and a separate labelled place for held devices.
  • An explicit, recorded release condition for every hold.
  • A contact who can image a device properly, identified before you need one.

Final Thoughts

Stop the wipe, separate the device, record the access. Those three cover most of what IT owns here, and the preparation that makes them possible is a pause button and one test on a real departure.

Everything beyond that’s somebody else’s decision and will arrive faster if the device is already sitting still. Which is the useful way to think about the whole thing: your job is to preserve options, not to resolve the matter.

Frequently asked questions

What does IT actually have to do for a device legal hold?

Four things. Stop the automated wipe and collection, take the device out of the redeployment pool, store it powered down somewhere controlled and labelled, and record who accessed it and when. Anything beyond that, particularly imaging, is a specialist job and the useful preparation is knowing in advance who you would call.

Why is the automated wipe the urgent part?

Because the window can be hours. Where offboarding is triggered by a leaver event in the HR system, the device may be unrecoverable before anybody in IT reads an email about it, which means a hold arriving through a normal queue has already missed the deadline. The pause has to exist at the point the departure is recorded rather than downstream of it.

Should held devices be flagged in the asset register or listed separately?

Separately, with a named owner. A flag inside the main register relies on somebody noticing it, and the common failure is a held machine picked up in a routine stocktake and reissued because the system reported it as available. A short separate list and a different physical location make that mistake require effort rather than being the default.

Can we take a copy and reuse the laptop?

Sometimes. It isn’t a decision to make inside IT without advice. Whether a copy is sufficient depends on what’s being preserved and why, and an informal copy made by a helpful colleague is unlikely to be adequate for the purpose. Being over-cautious with one machine costs very little by comparison.

Should we ship a held device back to head office?

Generally no. The machine crosses a border, may be opened for inspection and arrives having been handled by people nobody controls, which works against the point of holding it. Where preservation genuinely matters the usual answer is to preserve it where it is through somebody local, and in the meantime simply stop it moving.

How long do holds last?

Longer than people expect. Months is normal and multi-year is not unusual. Plan for it as a small number of machines permanently out of circulation rather than as a temporary measure, and make the release condition as explicit as the original instruction. Without a stated release, devices sit in the cupboard indefinitely because nobody is willing to be the person who let one go.