eDiscovery for paralegals: the practical manual
Hold tracking, collection logs, load file QC, production QC and privilege log maintenance. These are the five jobs that land on a paralegal in practice, and each one has a failure mode worth knowing before you meet it.
Updated October 6, 2026
Five tasks land on a paralegal on most eDiscovery matters: tracking a hold, keeping a collection log, checking a load file, checking a production, and maintaining a privilege log. Each is ordinary work with a specific failure mode, and knowing the failure mode before you meet it is most of the job. This is a practical manual for those five, not a certification course.
What does a paralegal actually do on an eDiscovery matter?
The work divides into keeping records that have to survive being questioned, and checking artifacts before they leave the firm.
The record-keeping is the half that cannot be reconstructed later. A litigation hold that was issued but not tracked looks identical, months afterwards, to one that was never issued. A collection with no log looks like an assertion rather than a record.
The checking is the half that is visible when it fails. A load file that will not import, a production missing a page, a privilege log that does not match the volume: each of those is discovered by the other side if it is not discovered by you.
How do you track a litigation hold after it goes out?
Issuing the hold is the easy part. The tracking is what evidences reasonable steps if preservation is ever challenged.
Three things need recording and keeping current: who received the notice and when, who acknowledged it, and who has since joined or left the matter. A hold is not a single event; it is a state that has to be maintained for as long as the duty lasts, with reminders reissued and departures handled before IT reclaims a mailbox.
The failure mode is silence. Nobody notices an unacknowledged notice until spoliation is raised, and by then the question is what steps were taken, answerable only from the tracking record.
What the notice itself must say is a separate subject, covered in the litigation hold letter guide.
What belongs in a collection log?
Enough that someone who was not there can say what was taken, from whom, when and by what method.
In practice that means the custodian, the source and its identifier, the date and time, who performed the collection, the method or tool, the volume collected, and the hash values recorded at acquisition. The collection entry shows the shape of a log; the reason each field is there is that it answers a question someone may ask under oath.
The failure mode is the log written afterwards. A log assembled from memory a month later is worth very little, and the chain of custody it is meant to evidence is precisely the thing that cannot be reconstructed.
How do you QC a load file before a volume ships?
By reading the file rather than trusting the export.
Open the DAT in a text editor first, confirm the delimiters and encoding, check the field order against what the protocol specifies, then reconcile: rows against document count, OPT rows against the images actually present, document-break flags against the document count you expect. Spot-check a loose document, an email with attachments, and a natively produced item with its placeholder.
That is a compressed version of the seven checks in the load files guide, which also covers the five reasons imports fail. Use that page as the working reference; this section is here so you know the task exists and sits with you.
The failure mode worth singling out is a field order that does not match the agreed list, because the import succeeds and the data is silently wrong.
How do you keep a privilege log current through a review?
By building it from the coding as review proceeds, rather than assembling it at the end.
A privilege log is generated from the same coding decisions reviewers are already making, so a log that is current is a by-product of a review that is coded consistently. A log left to the end is a reconstruction exercise, done under deadline, against documents nobody has looked at for weeks.
Two checks matter. Every document coded privileged appears on the log. Every log entry corresponds to a document that is not in the production volume. Both directions, because a document withheld but unlogged and a document logged but produced are different failures with different consequences.
The log format itself, whether individual, categorical or metadata-based, is settled in the protocol and covered in the privilege logs guide.
What does each task cost when it goes wrong?
| Task | Failure mode | Billing consequence |
|---|---|---|
| Hold tracking | Unacknowledged notice, data lost | No vendor fee; forensic and motion costs if challenged |
| Collection log | Log written after the fact | Re-collection, billed per custodian or hourly |
| Load file QC | Import fails or data lands wrong | Re-production, charged again where exports are per GB |
| Production QC | Missing pages or wrong Bates range | Re-production, plus the cost of the correction round |
| Privilege log | Log does not match the volume | Attorney time, and a clawback if something was produced |
Billing bases are the categories in the Fee Field Guide. The pattern is that four of the five failures are paid for twice: once for the original work and once for doing it again.
Do you need a certification to do this work?
No, and it is worth being straight about that.
ACEDS runs the best known certification in eDiscovery, and firms do value it, particularly for roles advertised as litigation support rather than as paralegal work. If you want a structured syllabus and a credential, that is where to look.
This page is not that and does not claim to be. It covers five recurring tasks and the ways each one fails. The tools on this site cover the arithmetic: the cost calculator for what a matter costs under per-gigabyte billing, the volume translator for what a collection means in pages and review hours, and the format risk planner for which file types survive imaging.
How this works on a flat rate
Kavarn, the flat-rate eDiscovery service Konvergence Inc operates, includes processing, hosting and productions in the instance rate. For the five tasks above, the thing that changes is the cost of correcting a mistake: a re-production after a failed import is time rather than a second export fee.
That does not make the checks less necessary. A production that fails to load fails whoever is paying for it, and the professional consequence of a privilege log that does not match the volume has nothing to do with billing. What changes is that checking again is free. The pricing page publishes the rate. See what the platform includes, or book a walkthrough.
Sources
- EDRM for production and load-file guidance, which the glossary entries cited above also draw on.
- Fed. R. Civ. P. 26(b)(5)(A) on describing withheld privileged material, and Fed. R. Civ. P. 37(e) on failure to preserve.
- ACEDS for the certification named above.
- Fee categories behind the billing column: the Fee Field Guide dataset.
eDiscovery at one flat monthly rate
$3,250 a month on a 12-month agreement. No per-user fees and no per-GB hosting charges.
Common questions
Do paralegals need ACEDS certification?
No. Nothing in the five tasks below requires a credential to perform them. Whether to pursue one is a separate question worth its own section, which is where ACEDS is discussed.
What should a paralegal learn first?
The vocabulary a protocol uses, because every later conversation assumes it. The glossary defines each term, and the eDiscovery process guide shows where each one sits in a matter. After that, load files, because that is where productions fail.
Who signs off before a production leaves the firm?
An attorney, on the substance, but the checks that make sign-off meaningful are usually run by a paralegal. Working through the production checklist and recording what was verified is what turns sign-off into something more than a signature.
What happens when a new custodian appears mid-matter?
The hold is extended to them, they are added to the tracking log, and their data is collected and processed as a new tranche. That last part has a cost consequence: processing is charged per gigabyte each time, so a matter that adds custodians in four batches is billed for four processing runs.
How do you check a privilege log against what was actually withheld?
By reconciling the log against the production. Every document coded privileged should appear on the log, and every log entry should correspond to a document not in the volume. A mismatch in either direction is the defect, and it is easier to find before the volume ships than after opposing counsel does.