eDiscovery is a complex process. Legal Hold, in particular, requires substantial consideration — What data must be preserved? Who initiates the legal hold? Who is subjected to that hold? How should we preserve the relevant data? Is the data supposed to be preserved in place or collected and transferred to an external storage repository? The answers to these questions will depend on specific circumstances. For instance, managing legal holds in Slack has its own challenges.

In 2019, Slack had over 1,500 apps in its directory, 85,000+ paying customers, and 10+ million daily active users. By March 2020, the number of daily active users had increased to 12.5 million. Over two years, there was an 83% increase in the number of paying customers, reaching a whopping 156,000. As of March 2022, the number of paid customers on Slack was 169,000. Trends suggest that the growth of Slack isn’t going to slow down soon.

5-Ways-to-Better-Manage-Legal-Holds-in-Slack_Graphic-1

The data from Slack is complex. If you export the data in JSON format, you won’t be able to read it. However, in case of an investigation, you will have to pull all the conversations, including deletions and edits. So, before you even start analyzing Slack data, you need to work on preserving it.

When it comes to legal holds in Slack, there are a couple of things that you must keep in mind:

  1. To enable the Slack Legal Hold capability, you must be an ‘Enterprise Grid’ customer. With Slack’s other plans, you won’t get this feature, meaning that you will have to preserve Slack data by other means for eDiscovery, audits, and internal investigations.

  2. You must hire a Compliance Administrator who can place the legal hold on the custodians, specific files, and messages. The person in this role will be managing the Slack holds along with the custodians for these holds.

  3. You have to designate specific custodians since Slack’s legal holds are based on users, not channels.

  4. When you implement a Slack legal hold, your other retention policies will be overridden. The data subjected to the legal hold won’t be subjected to the normal deletion timeline. The retention policy will be applicable once you have released the hold.

With Casepoint, you can manage the legal hold process easily. It offers features like tracking logs and customized templates that streamline the data collection process. You can even monitor the progress of your data preservation efforts and generate reports containing information regarding managing legal holds.

In order to create a legal hold in Slack, here are the steps you need to follow:

  • Click the name of your workspace at the top left corner

  • From the menu, select Settings & Administration and then select Organization Settings

  • Click Security in the left sidebar and then select Legal Holds

  • Next, click Create Legal hold

  • Enter a name for the hold and optionally, a a description

  • Select the conversations needed to be included, if you want, you can add the date range

  • Next, you have to select the numbers included in the hold by clicking Add Custodians

  • Once you have done that, click Add

  • When you’re ready, click Save

Please note that in Slack legal hold, you can have up to 1,000 custodians. However, there isn’t any limit on the number of legal holds. In case you want to add more custodians, you can create a new legal hold and add the outstanding members.

As an Enterprise Grid member, you must assign the Compliance Admin system role to someone. This person will have the power to place a legal hold on the members of the organization so that their files and messages are preserved in Slack. While creating the Slack legal hold, here is what you can expect:

  • You may include the file data and messages from all the conversations or only the direct messages that include a particular member

  • Once the legal hold is in place, all the files and messages related to the members will be saved, regardless of the retention policies or if members delete or edit their data

  • You can access the data subject to the hold using an eDiscovery software

  • If a channel subject to legal hold gets deleted, files and messages won’t be saved

  • Files and messages from direct messages or Slack Connect channels are not covered under the Slack legal hold

It is possible to edit a legal hold where you can change the members included as custodians and even the name and description of the legal hold. Here is how to do it:

  • Click the name of the workspace at the top left

  • Click Settings & administration from the menu, then select Organization settings

  • Click Security in the left sidebar, and then select ‘Legal Holds’

  • Next to the legal hold, click the Ellipsis icon

  • Select Edit details

  • Add or remove members from the Custodians section and/or change the name and description as required

  • When you’re ready, click Save

Please note that you can’t edit the date range or the conversations that have been included for the legal hold. In case you need to do this, you will have to create a new legal hold.

The process for changing or releasing a legal hold is similar to the one mentioned above. After you have clicked the Ellipsis icon, you will find the option to edit or release the legal hold.

Challenges of Preserving Slack Data in Slack

Casepoint is among the most advanced platforms available in the market for eDiscovery and litigation. It can help your organization develop an evidence-based story that can defend you in court. With its AI and advanced analytics tools, you can make every single facet of eDiscovery accurate, efficient, and faster.

  • Hundreds of Slack Messages Are Sent Every Day

    Large and medium-scale companies have many active Slack users, meaning that every month, there are over 100,000 messages sent on Slack. Moreover, for each channel, a new file is generated every day. When you have to examine such a large volume of data, the process can be expensive and slow. However, if you can identify specific channels that must be preserved, you can reduce production time and costs.

  • Slack is One of the Platforms Used for Decentralized Communications

    Today, companies use a multitude of platforms to have a single conversation. For instance, an employee asks their manager a question through email, and the manager discusses the answer in a Zoom meeting. Once the Zoom meeting ends, the employee might have some follow-up questions which they ask on Slack. The whole conversation is spread out on multiple platforms. This means that the snippet preserved on Slack won’t provide the full context.

  • It's Not Easy to Decipher Slack Exports

    You can export the Slack messages in JSON file format. This format is hard to read. Moreover, it won’t display media like GIFs and emojis. You might have to use an alternative production method.

  • The Legal Hold Features Are Not Available For Everyone

    The Slack legal hold feature is available only for the ‘Enterprise Grid’ members. So, if you have any other plan, you will have to find another way to preserve Slack data.

  • There Are Spoliation Risks and Gaps

    Even with Slack holds, there are some data preservation issues on the platform. Legal holds don’t include file data and messages from DMs and Slack Connect Channels. Also, they can’t control the data available in shared channels. Spoliation is another issue that you must take care of. Even if a Slack hold has been implemented, a member can delete an entire channel. Slack won’t save file data or messages of the deleted channel.

  • No Option for Early Case Assessment

    You can’t analyze or even search data in Slack. Early case assessment is invaluable during litigation, and in order to conduct it, you will have to export data.

  • Slack Only Offers a Partial Process

    Enabling the Slack legal hold feature is just one step. You will still need a separate tool for notifying data custodians, sending reminders, and overseeing and tracking holds.

You can address these challenges by using an eDiscovery platform like Casepoint that collects data directly from your Slack environment for processing and review. You will not need a middle-man for data collection, which means no export and import steps.

Why do Companies Need a Slack Policy?

It is crucial to have a Slack policy for your organization, regardless of which solution or method you are using for preservation. With a robust policy in place, you can limit the volume of data that must be pulled during litigation, an internal investigation, or a regulatory audit. Every single employee must know about the Slack policy. Here is what this policy should address:

  • When an employee should use Slack or other messaging platforms

  • When to use public channels vs. when to use direct messages or private groups

  • Other communication tools used by the team members

  • Expected response times

  • Onboarding employees on Slack

  • Person responsible for creating new channels

  • Structuring and formatting conversations

  • Appropriate and inappropriate work conversations

  • Ongoing monitoring

  • Company’s access to the conversations

  • Deletion schedules and retention policies

  • Harassment and bullying on the platform

5-Ways-to-Better-Manage-Legal-Holds-in-Slack_Graphic-2-1

In order to ensure that your employees follow the Slack policy, you will have to provide training and facilitate monitoring. There are some monitoring technologies that can notify the management of any potential issues while making sure that your employees aren’t under constant surveillance.

Through a Slack policy, you will also be able to create a healthy culture. Not every conversation needs to happen on the app. This will also have an impact on your future eDiscovery efforts.

If you use Slack appropriately and have a proper deletion and retention schedule, you can save yourself a lot of resources. Also, if the conversations are properly formatted and well-structured, recreating them after export will be a lot easier.

Conclusion

When it comes to preserving Slack data for eDiscovery, there is no one clear winner. Depending on your circumstances, you might have to try out different approaches. This includes using an eDiscovery legal hold software like Casepoint. It allows you to collect data from some of the most popular platforms used by businesses, including Slack, Google Drive, Gmail, Dropbox, Office365, and more.