Holds FAQ

What is preserved when a hold is in place?
  • Email messages and attachments, including content in Sent Mail, Drafts, Trash, and Spam.
  • Messages in Google Groups
  • On-the-record (history on) chat messages.
  • Files in users' Drives and (optionally) associated Team Drives.
What's the difference between a hold and a retention rule?

Both make messages accessible in Vault. However, there are important differences:

Holds Retention rules
Holds preserve data indefinitely. Retention rules retain data up to a specified retention period. After the retention period expires, data is expunged from all Google systems.
Holds are typically used for legal or investigation purposes. Only those who can access the matter can see who and what is on hold. Retention rules are used for data management and to enforce information lifecycle management policies. Only those who have retention rule privileges in Vault can view, create, or modify retention rules.
If a data is subject to hold and a retention rule, what takes precedence?

A hold overrides any retention rule.

Does a user whose content is on hold need a Vault license?

Yes. Learn more about how to license users.

What happens when more than one hold applies to the same user?

Holds are additive. One hold does not replace another hold.

For example, you create Hold A for a user jwong@example.com with term "project X." You also create Hold B for the same user, but with term "budget." With these two holds in place, Vault preserves content that contains either "project X" or "budget" for jwong@example.com. If you remove Hold A, content related only to Hold B is preserved.

What privileges does someone need to view, create, or modify holds?

See the Understand and grant Vault privileges article for more information.

What happens if my G Suite administrator deletes a user who is on hold?

If the G Suite administrator deletes a user in the Admin console, all of that user's data is deleted even if that user is on hold. As a Vault administrator, you should advise your G Suite administrator to suspend users instead of deleting them.

How do I see what holds are in place?

A convenient way to see all holds is from Reports. To see the holds from there, Vault users must have the Manage Audits privilege. You can also see holds that are in place by looking in the various matters that contain them.

  1. Click Reports in the left navigation.
  2. Click Domain Holds or User Holds:
    • Domain Holds: These apply to the data of all users with Vault licenses. In the list of domain holds, you see information about the hold, including the matter or matters that contain it, its specific search terms, and the date the hold was put in place.
    • User Holds: These apply to the data of specific users with Vault licenses. In the list of user holds, you see the users whose messages are on hold. Click a name to get more details, including the the matter or matters that contain the hold, its specific search terms, and the date the hold was put in place.
  3. Optionally click Download CSV in the top right corner to download a CSV file with the list of holds.

Note: A name in red with a line through it means that the user's Vault license was removed. Contact your G Suite administrator to reassign this user a Vault license in the Admin console.



Was this article helpful?
How can we improve it?