A healthcare SaaS provider hosts patient records classified as sensitive. A hospital customer's legal team issues a preservation request for one tenant's data ahead of litigation. The provider operates a shared multi-tenant database. Which action BEST satisfies the forensic preservation obligation without breaching other tenants' data?
- AExport a full snapshot of the shared database and hand it to the requesting customer's legal team
- BPlace a scoped legal hold that preserves only the requesting tenant's records and associated logs in an immutable store Correct
- CSuspend routine data-retention purges across the entire platform until the litigation concludes
- DEncrypt the requesting tenant's records with a customer-held key so they cannot be modified
Why A is wrong: A full snapshot would preserve the data, but it commingles every tenant's records, so disclosing it breaches confidentiality obligations to the other tenants and exceeds the scope of the request.
Why B is correct: Correct: a tenant-scoped legal hold isolates the relevant custodian data, preserves it against alteration or routine deletion, and avoids exposing or collecting other tenants' records in a shared platform.
Why C is wrong: Halting all purges does prevent spoliation, but applying it platform-wide is disproportionate, inflates storage and privacy risk for unrelated tenants, and is not the scoped response the situation requires.
Why D is wrong: Encryption protects confidentiality but does not prevent deletion or overwriting, so it fails the preservation goal, which requires immutability and a hold against routine purges rather than key control.