---
title: "Pause deletion for records under a legal · Agent Wranglers"
url: https://agentwranglers.se/playbook/data/personal-data/legal-hold
id: DAT-79
level: Recommended
updated: 2026-10-22
build: a2a6bdfed830
tokens: 860
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Pause deletion for records under a legal hold

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Personal data](https://agentwranglers.se/playbook/data/personal-data.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: DAT-79
- Level: Recommended
- Chapter: [Personal data](https://agentwranglers.se/playbook/data/personal-data.md)
- Rule: Let a named role put a hold on an account or a set of records, with a reason and a review date. Every deletion job and erasure request skips held records and logs why.
- Check: Put a hold on a test account on staging, then run the retention job and an erasure request. Its rows stay, and the job log names the hold. Lift the hold, and the next run deletes them.
- How: A dispute, a tax audit or a court case can require you to keep data that your schedule would delete. GDPR Article 17(3) lets you keep data for legal claims or a legal duty, even after an erasure request. Store holds in their own table, and make [Delete old data automatically](https://agentwranglers.se/playbook/data/personal-data/retention-jobs.md) and the erasure code check it. Tell the person which data you kept and why, through the flow in [Let people see and delete their data](https://agentwranglers.se/playbook/website/privacy/data-requests.md). Lift each hold when its matter closes, and the next run deletes the data. Records the law keeps for a set period follow [Keep payment records for the legal period](https://agentwranglers.se/playbook/payments/invoices-and-records/payment-record-retention.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### SQL example

```sql
CREATE TABLE legal_holds (
  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
  account_id bigint NOT NULL REFERENCES accounts (id),
  reason text NOT NULL,
  placed_by text NOT NULL,
  review_on date NOT NULL,
  lifted_at timestamptz
);

DELETE FROM messages m
WHERE m.expires_at < now()
  AND NOT EXISTS (
    SELECT 1 FROM legal_holds h WHERE h.account_id = m.account_id AND h.lifted_at IS NULL
  );
```

## Sources

- [GDPR Article 17 on the right to erasure](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- DAT-31 [Delete old data automatically](https://agentwranglers.se/playbook/data/personal-data/retention-jobs.md) in Data and databases
- WEB-217 [Let people see and delete their data](https://agentwranglers.se/playbook/website/privacy/data-requests.md) in Website
- PAY-56 [Keep payment records for the legal period](https://agentwranglers.se/playbook/payments/invoices-and-records/payment-record-retention.md) in Payments and billing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/data/personal-data/legal-hold">Agent Wranglers data and databases playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Erase retired databases and every copy](https://agentwranglers.se/playbook/data/personal-data/retired-data-stores.md)
- [Personal data](https://agentwranglers.se/playbook/data/personal-data.md)