Use holds to preserve data indefinitely to meet legal or preservation obligations.
If a user who's subject to a hold deletes data, it's removed from the user's view, but the data is preserved in Vault. As long as the hold is in place, you can search and export that data.
Note: If your G Suite administrator deletes a user's account in the Admin console, the user's data is no longer available in Vault and cannot be restored. If you want to hold or retain a user's data, the user must have both G Suite and Vault licenses. Learn more about Vault licenses.
Place data on hold
- Create or open the matter that will contain the hold.
- Click Create Hold.
- Enter a unique name for the hold.
- Choose the type of hold: Mail, Drive, or Groups.
- Use the drop-down list to apply the hold to either individual accounts or to an entire organizational unit:
- Accounts—enter one or more email addresses for the accounts or Groups that are subject to this hold.
- Organization—Choose an organizational unit from the drop-down list.
- (Drive only.) Check the Include files from associated Team Drives box to include Team Drive content accessible by the chose users, in addition to their own Drive content.
- (Mail and Groups only.) Set the conditions for the hold:
- Sent date—You can use a range of dates to hold messages. If you enter a date only in the first field, all messages on or after that date are held. If you enter a date only in the second field, all messages before or on that date are are held. Leave this field blank to apply the hold to all messages.
- Terms—You can use search terms and operators to specify message contents to be held.
- Exclude drafts—Check the box to exclude draft messages from this hold.
- Click Save to create the hold.
Modify an existing hold
You can change some of the criteria of a hold, however, you can't change the data type.
- Open the matter that contains the hold.
- Click the hold, then click Edit Hold.
- Modify any of the following criteria:
- Accounts—Add or remove accounts or organizational units. You cannot add accounts to a hold that covers an organizational unit, nor can you add organizational units to a hold that covers individual accounts. Additionally, If you remove all users, you're prompted to delete the hold.
- (Drive only.) Modify the Include files from associated Team Drives box as desired to include or exclude files in Team Drives.
- (Mail and Groups only.) Modify any of the following:
- Sent date—Expand or restrict the range of dates subject to hold.
- Terms—Add or remove search terms and operators to change which email messages are subject to this hold.
- Click Save.
- Open the matter that contains the hold.
- Check the box next to the hold.
- Click Delete selected.
- Click OK to confirm the deletion.
See what holds are in place
A convenient way to see all holds is from Reports. To see the holds from there, Vault users must have the Manage Audits privilege. You can also see holds that are in place by looking in the various matters that contain them.
- Click Reports in the left navigation.
- Click Domain Holds or User Holds:
- Domain Holds: These apply to the data of all users with Vault licenses. In the list of domain holds, you see information about the hold, including the matter or matters that contain it, its specific search terms, and the date the hold was put in place.
- User Holds: These apply to the data of specific users with Vault licenses. In the list of user holds, you see the users whose messages are on hold. Click a name to get more details, including the the matter or matters that contain the hold, its specific search terms, and the date the hold was put in place.
- Optionally click Download CSV in the top right corner to download a CSV file with the list of holds.
Note: A name in red with a line through it means that the user's Vault license was removed. Contact your G Suite administrator to reassign this user a Vault license in the Admin console.
Holds FAQWhat is preserved when a hold is in place?
- Email messages and attachments, including content in Sent Mail, Drafts, Trash, and Spam.
- Messages in Google Groups
- On-the-record (history on) chat messages.
- Files in users' Drives and (optionally) associated Team Drives.
Both make messages accessible in Vault. However, there are important differences:
|Holds preserve data indefinitely.||Retention rules retain data up to a specified retention period. After the retention period expires, data is expunged from all Google systems.|
|Holds are typically used for legal or investigation purposes. Only those who can access the matter can see who and what is on hold.||Retention rules are used for data management and to enforce information lifecycle management policies. Only those who have retention rule privileges in Vault can view, create, or modify retention rules.|
A hold overrides any retention rule.
Yes. Learn more about how to license users.
Holds are additive. One hold does not replace another hold.
For example, you create Hold A for a user firstname.lastname@example.org with term "project X." You also create Hold B for the same user, but with term "budget." With these two holds in place, Vault preserves content that contains either "project X" or "budget" for email@example.com. If you remove Hold A, content related only to Hold B is preserved.
See the Understand and grant Vault privileges article for more information.
If the G Suite administrator deletes a user in the Admin console, all of that user's data is deleted even if that user is on hold. As a Vault administrator, you should advise your G Suite administrator to suspend users instead of deleting them.
Files in a Team Drive won't be preserved if:
- A Team Drive member:
- Moves content out of a Team Drive, and the member is not on hold.
- Removes a member that is currently on hold from the Team Drive and there is no other Team Drive member on hold.
- No Team Drive member is on hold.