Legal Hold and Document Preservation in the Philippines: A Compliance Guide

A legal hold is an internal instruction to suspend the deletion or alteration of records that may be relevant to a pending or reasonably anticipated case, investigation, or regulatory inquiry. In the Philippines, there is no single statute that uses the term "legal hold," but the duty to preserve documents arises from several sources: the rules on evidence and discovery, the retention limits of the Data Privacy Act of 2012, and the corporation's own record-keeping obligations. Getting this wrong can expose a company to sanctions for spoliation, weaken its position in litigation, and, in the data privacy context, breach the principle that personal data must not be retained longer than necessary.

What is a legal hold?

A legal hold is a directive, usually issued by in-house counsel or a compliance officer, that tells employees and custodians to stop routine destruction of documents, emails, databases, and other records once litigation or an investigation is anticipated. It overrides ordinary retention schedules. The hold stays in place until the matter is resolved and counsel releases it.

Because Philippine law does not codify the term, the practical definition comes from the duty to preserve evidence and from the Data Privacy Act's requirement that personal data be processed fairly and lawfully. A company that destroys records after a dispute arises risks an adverse inference and possible penalties.

Why document preservation matters under the Data Privacy Act

The Data Privacy Act of 2012 and its Implementing Rules and Regulations set out principles for collecting, processing, and retaining personal data. Under the IRR, one of the principles in collection, processing, and retention is that personal data shall not be retained longer than necessary. This is a retention ceiling, not a license to delete at will.

The same IRR defines "processing" to include storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data. It also defines a "personal data breach" as a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. Deleting records that should have been preserved can therefore be both a litigation problem and a data privacy problem.

The IRR also requires organizations to implement organizational, physical, and technical security measures for personal data protection. A documented legal hold procedure is part of that security framework because it prevents unauthorized or premature destruction of records.

How to implement a legal hold in the Philippines

A defensible legal hold follows a repeatable sequence:

1. Trigger the hold. Issue a written hold notice as soon as litigation, a government investigation, or a regulatory inquiry is reasonably anticipated. Do not wait for a formal complaint.
2. Identify custodians and systems. List the people, departments, email accounts, shared drives, databases, and third-party processors that may hold relevant records.
3. Suspend deletion. Instruct IT and records management to pause auto-deletion, backup rotation, and shredding schedules for the identified data.
4. Notify custodians. Send a clear written instruction that they must not delete, alter, or remove relevant records, and require acknowledgment.
5. Preserve in place where possible. Keep records in their original format and location to maintain integrity and metadata.
6. Document everything. Keep a hold log showing when the hold was issued, who was notified, and what was preserved.
7. Release only when appropriate. Counsel releases the hold in writing once the matter is fully resolved and retention obligations are satisfied.

Retention limits and the "not longer than necessary" rule

The IRR's principle that personal data shall not be retained longer than necessary means a company cannot keep everything forever "just in case." A well-drafted retention schedule sets specific periods for each record category and provides for exceptions, including legal holds. When a hold is active, the retention schedule is suspended for the affected records. When the hold is lifted, normal retention and deletion resume.

This balance is important: over-retention creates data privacy risk, while premature deletion creates litigation risk. The legal hold is the mechanism that reconciles the two.

Working with personal information processors

Many Philippine companies outsource storage, payroll, or IT services to a personal information processor. Under the IRR, a personal information processor is any natural or juridical person to whom a personal information controller may outsource or instruct the processing of personal data. If a processor holds records subject to a legal hold, the controller must instruct the processor in writing to suspend deletion. The outsourcing agreement should include a clause requiring the processor to comply with legal holds and to notify the controller of any deletion request.

Frequently asked questions

When should a legal hold be issued in the Philippines? As soon as litigation, a government investigation, or a regulatory inquiry is reasonably anticipated — not only after a case is filed. Early issuance protects the integrity of the evidence.

Does the Data Privacy Act require deletion of personal data? The IRR provides that personal data shall not be retained longer than necessary, but this is subject to lawful processing and other legal obligations. An active legal hold is a legitimate reason to retain records beyond the normal retention period.

Can a company be penalized for deleting records? Yes. Deleting records subject to a hold can lead to sanctions for spoliation, an adverse inference in litigation, and, where personal data is involved, potential liability under the Data Privacy Act for improper disposal or unauthorized processing.

Practical takeaways

• Issue a written legal hold as soon as litigation or an investigation is reasonably anticipated, and document every step.
• Suspend auto-deletion, backup rotation, and shredding schedules for all identified custodians and systems.
• Remember that the Data Privacy Act's IRR requires personal data not to be retained longer than necessary — a legal hold is the exception that justifies continued retention.
• Include legal hold compliance clauses in contracts with personal information processors.
• Release the hold only in writing, once the matter is resolved and retention obligations are met.

Primary sources

The rules discussed above are drawn from the following primary sources, as published in the Official Gazette and the national statute book.

• NPC IRR OF REPUBLIC ACT NO. 10173, August 24, 2016

• REPUBLIC ACT NO. 11232 - AN ACT PROVIDING FOR THE REVISED CORPORATION CODE OF THE PHILIPPINES

• REPUBLIC ACT NO. 643 - AN ACT TO AMEND SECTION NINETY OF REPUBLIC ACT NUMBERED TWO HUNDRED AND NINETY-SIX, OTHERWISE KNOWN AS THE JUDICIARY ACT OF NINETEEN HUNDRED AND FORTY-EIGHT, AND SECTION ONE OF RULE NINETY-THREE OF THE RULES OF COURT IN THE PHILIPPINES.

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.