Legal Hold Versus Privacy Minimization in SaaS
Helio Analytics is a 600-person SaaS company with a four-tier data classification policy: Public, Internal, Confidential, and Restricted. A discovery exercise across sanctioned and unsanctioned SaaS found 4,300 files in collaboration workspaces. Of those, 1,200 contain customer PII, 30 contain source code, and 400 are HR records from 2019–2022 that fall under a legal hold for a pending discrimination lawsuit. The retention schedule says HR records should be deleted after three years, but the hold notice predates the schedule. The CASB is in monitor-only mode, DLP is not deployed, and users can create public share links. The General Counsel wants assurance that nothing is deleted, while the privacy officer wants PII minimized immediately. The company has 90 days before a customer audit, and the audit will sample access logs and retention records.
1. What should the security team do in the first 30 days, and in what order?
Read the worked answer
Start with preservation, not deletion. Issue a written legal-hold reminder, suspend automated deletion in the HR repositories identified by counsel, and have counsel define custodians, date range, and matter scope. In parallel, contain external exposure: use CASB APIs to revoke public links and block new external sharing for workspaces containing Restricted data. Then inventory the 4,300 files by owner, data type, sharing state, and repository, using sampling to validate the PII estimate. Label high-risk workspaces and move customer PII into controlled repositories where possible. DLP should follow data mapping, because deploying DLP first produces either misses or alert fatigue. Training is useful but is not a 30-day containment control. The security team should report weekly on revoked links, preserved holds, and unresolved ownerless files.
2. How should the team resolve the conflict between the legal hold and the retention schedule?
Read the worked answer
The hold and the retention schedule are not equal obligations. Retention says delete after three years; the hold says preserve potentially relevant records. Counsel must define the hold narrowly by custodian, date range, and subject matter, then the team should preserve only in-scope HR records and suspend deletion for those records. For out-of-scope PII, the privacy officer can minimize after counsel confirms it is not relevant to the matter. Implement hold tags or repository-level preservation rather than relying on users to avoid deletion. Log access to preserved data, segregate it from general collaboration spaces, and release the hold only through written counsel approval. Document the conflict resolution so the customer auditor can see that preservation and minimization were both handled deliberately.
3. Which control should be enforced first: DLP, CASB external-sharing restrictions, or security awareness training?
Read the worked answer
Enforce CASB external-sharing restrictions first. The immediate exposure is public links and external sharing of Restricted data, and CASB APIs can revoke existing links and block new ones quickly. DLP is valuable, but it depends on classification and tuning and will take longer than 30 days to be reliable. Training is necessary but does not remove links that are already public. A sensible sequence is: revoke and block external sharing for Restricted workspaces, alert on Confidential sharing, then run DLP in monitor mode, then enforce DLP after baselining. The team should preserve audit logs of all revocations because the customer audit will sample access records. This ordering reduces the most likely breach path while building toward durable controls.