---
title: "Object Lock"
description: "How Governance Lock and Legal Hold differ, and why Object Lock can only be turned on when you create a bucket."
content_type: "concept"
product: "object-storage"
platform: "MyAccount"
url: "/myaccount/object-storage/concepts/object-lock/"
---

# Object Lock

Object Lock stops an object from being overwritten or deleted for as long as the lock is on,
the write-once-read-many protection you would reach for to meet a retention requirement or guard
against accidental or malicious deletion. It comes in two modes, Governance Lock and Legal
Hold, and they behave differently once they are on.

## Governance Lock versus Legal Hold

Governance Lock sets a retention period, from 1 to 36,500 days (up to 100 years), on an object
version when you upload it. As the bucket's owner, you keep the final say: you can still shorten
that period, clear the lock, or delete the version outright before it expires. Governance Lock
protects the object from everyone else.

Legal Hold is a plain on/off switch: it stays on until you turn it off yourself. Use it for a hold you want to
control by hand rather than by a countdown, such as while a dispute or an investigation is
open.

Both apply per object version, from the same **Lock Settings** panel on that version's entry in
the **Objects** tab.

## Turning on Object Lock

You turn Object Lock on when you create the bucket, alongside every other choice on that form.
It also turns on [Object Versioning](/myaccount/object-storage/how-to/turn-on-object-versioning/)
for that bucket automatically, since a lock only means something with a version underneath it
to protect, and versioning stays on for as long as the lock does. Decide at creation time,
since it is the one setting on that form you cannot revisit afterward. See
[Lock objects with Object Lock](/myaccount/object-storage/how-to/lock-objects-with-object-lock/)
for the exact steps, from bucket creation to locking an individual version.

## What Object Lock protects

A locked version stays exactly as it is until its Governance Lock expires or you clear it
yourself, or until its Legal Hold is turned off; only then can it be overwritten or deleted. A
version that already inherited a retention period keeps that protection even after you remove
the bucket's default lock policy, since the policy only governs new uploads from that point on.
Removing the default lock policy is what frees a bucket to be deleted: check the
[Object Storage troubleshooting page](/myaccount/object-storage/troubleshooting/object-storage/)
for the full picture if a delete is blocked.