How Long Should You Keep Email

How long you should keep email is decided by three clocks that rarely agree. Mail accumulates unless somebody stops it. That means having no retention policy is itself a policy. The policy is keep everything forever. Most organisations are running that one without ever having agreed to it.

Which would be fine if keeping things carried no cost. It carries several. None of them is the one people expect.

Three Clocks That Decide How Long to Keep Email

Any given message sits under at least three periods at once and they rarely agree.

The conflict is the reason nothing gets decided. One set of obligations says keep and another says remove, so the safest looking move is to do neither and leave everything where it is. That is a decision with consequences rather than a way of avoiding one.

What Keeping Every Email Forever Actually Costs

Storage is cheap and storage is not the cost.

Only the last two are technical. The first three are the reasons organisations with lawyers involved tend to keep less rather than more.

A mailbox is mostly other people. Their addresses, what they said, what somebody said about them, attachments they sent. That is what turns retention from a housekeeping preference into a question somebody may have the right to ask about.

The Layers an Email Retention Policy Has to Reach

A retention rule that covers only the mail server describes something narrower than what exists.

A personal store on a laptop is the classic gap. Somebody exported a PST in 2018 to get under a quota. The file sat in a documents folder, outside every policy anybody has written. Nothing is wrong with the file. Nobody knows it exists.

The One Rule That Overrides Every Retention Policy

Where litigation or an investigation is anticipated, ordinary retention stops applying.

A legal hold is an instruction to preserve. It overrides deletion including the automatic kind nobody thinks about. That last part catches people, because an automatic rule quietly removing mail on a schedule is still deletion.

Deleting during a hold is a separate matter from whatever was deleted. It is treated as its own problem and a serious one. Where one might apply, suspend the schedule and ask somebody qualified rather than reasoning it out.

The Case Everybody Actually Faces

Retention stops being abstract the week somebody leaves. Their mailbox is still there and nobody has decided what happens to it.

The usual outcome is that it stays, forever, because deleting it feels risky and keeping it feels free. Four years later the organisation holds forty mailboxes belonging to people it no longer employs.

contracts and quotes
project correspondence
decisions and approvals
anything a client
  might ask about

internal chat
newsletters
lunch arrangements
their personal mail
  that arrived at work

Redirecting the address is a different decision. Forwarding a leaver's mail to a colleague means somebody is reading correspondence addressed to a person who has gone, including anything personal that still arrives. Common practice. It deserves a written rule and a time limit. It rarely gets either.

Building an Email Retention Policy You Can Defend

1. Write it down. An unwritten policy cannot be shown to anybody and cannot be followed consistently. This step alone puts an organisation ahead of most.
2. Use few categories. Three or four. Contracts and finance. Project correspondence. General mail. Anything under a hold. Twenty categories is a policy nobody will apply.
3. Have somebody senior agree the periods. Not the mail administrator. The decision weighs legal exposure against operational need, which is not a technical judgement.
4. Include the forgotten layers. Backups, exports, leavers, laptops. A policy that names only the server is describing a fraction of what exists.
5. Apply it to what you already hold. A policy that starts from today leaves the accumulation untouched, which is the part that carries the risk.
6. Keep evidence that it runs. Defensible means a reasonable rule, followed, that somebody can explain afterwards. The explaining is most of it.

None of this is advice about your obligations. Retention periods differ by country, by industry and by contract. A rule that fits one organisation is wrong for the next. What is general is the shape of the question. What the answer is belongs to somebody who knows your situation.

Where a policy finally exists and the old accumulation has to be dealt with, the first job is finding out what is in it. Our file viewers open an old store in a browser tab so a forgotten export can be assessed before anybody decides what happens to it.