If you back up client data in the United States, one rule sets the floor for what happens when that data goes missing during litigation. It is Federal Rule of Civil Procedure 37(e), amended in 2015, and it is short enough to read in a minute.
This is not legal advice, and nothing here substitutes for counsel. It is a plain reading of the rule text, quoted directly, with the operational consequences for anyone running backup as a service.
What the rule says
The opening clause sets three conditions, all of which must hold before the rule bites:
"If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court:"
Read that carefully. The information must have been subject to preservation. It must have been lost through a failure to take **reasonable steps**. And it must be **unrecoverable through additional discovery**. Miss any one and the rule does not apply.
The third condition is the one MSPs can most directly influence, and it is the reason a working backup matters more than a policy document. If the data can be produced from a backup, it was not lost within the meaning of the rule.
The two branches, and why the split matters
Once those conditions are met, the rule splits.
Under **(e)(1)**, on "finding prejudice to another party from loss of the information", the court "may order measures no greater than necessary to cure the prejudice". Proportionate, remedial, bounded.
Under **(e)(2)**, "only upon finding that the party acted with the intent to deprive another party of the information's use in the litigation" may the court "(A) presume that the lost information was unfavorable to the party; (B) instruct the jury that it may or must presume the information was unfavorable to the party; or (C) dismiss the action or enter a default judgment."
Those are case-ending remedies, and the rule gates them behind a finding of **intent**, not negligence. The practical distance between "we had a gap" and "we destroyed it deliberately" is the distance between a curative order and a default judgment.
Two things reduce exposure. First, actually being able to produce the data, which defeats the third condition entirely. Second, being able to show what your system did and when — because the difference between negligence and intent is a question of evidence about your own conduct, and an auditable record is the evidence.
What "reasonable steps" implies for a backup platform
The rule does not define reasonable steps, deliberately. But the shape of what helps is not mysterious.
**Retention that outlives the dispute.** A 30-day window does not survive litigation that surfaces in month four. Retention has to be set against the client's realistic exposure, not against a storage bill.
**Holds that actually stop disposition.** A retention engine that deletes on schedule will cheerfully delete data under hold unless the hold is enforced in the deletion path itself. Ask any vendor to show you where the hold is checked.
**A record of what was preserved and when.** If disposition is challenged, you want to show the object, the policy that governed it, the date it was due, and the fact that a hold suspended it.
**Tamper-evidence.** An audit log a party can quietly edit proves very little about that party's conduct. A hash chain, where each record commits to the one before it, means a later alteration is detectable rather than invisible.
How VaultFuzion is built against this
Retention is configurable to seven years, with disposition enforced automatically and every purge written to the audit trail rather than performed silently.
Legal holds suspend disposition in the deletion path itself, so a held object cannot be aged out by a policy that would otherwise remove it.
Every snapshot is SHA-256 hash-chained to its predecessor. Each record commits to the previous hash, so the chain can be walked and verified, and a retrospective edit breaks it visibly.
Restores are approval-gated and audited: a request is raised, an administrator approves it, and the request, the approval and the outcome are all recorded.
None of this makes a preservation problem go away. It changes what you can demonstrate about your own conduct when one arrives — which, under (e)(2), is the difference that matters most.
Sources
Federal Rule of Civil Procedure 37(e), quoted from the Legal Information Institute, law.cornell.edu/rules/frcp/rule_37, retrieved 14 August 2026.
This article is a plain reading of published rule text and is not legal advice. Preservation obligations depend on jurisdiction, posture and facts. Consult counsel.