Email retention: agree the rules before setting a timer
Plan email retention around the records your business holds. Check responsibilities, licences, legal requirements and recovery before changing mailbox settings.
An email retention policy explains which records your business keeps, why it keeps them, who is responsible and when they can be deleted. Start with the information in the message, rather than giving every mailbox one expiry date.
This is a practical IT planning guide. Your accountant, legal adviser or data protection adviser should confirm the obligations and retention periods that apply to your business before automated deletion is configured.
There is no single period for every email
Tax records, contracts, staff information and routine correspondence serve different purposes. Six years is a familiar requirement for some Irish business records, but it is not a universal instruction to keep or delete every email at that age. Confirm the record category, applicable rule, starting event and any exception before setting a timer.
The Data Protection Commission advises assessing retention against business need and minimising unnecessary personal data. Statutory obligations and active legal holds must also be considered. Deleting a message from an inbox does not necessarily remove every retained or backed-up copy.
Write a usable retention schedule
- Identify the information: for example invoices, employment records, contracts or customer correspondence.
- Record the reason for keeping it and the confirmed retention period or review criteria.
- Specify when the period starts, where the authoritative record is stored and who owns it.
- Document exceptions, legal holds and who can authorise their release.
- Set a review date and explain how staff should handle uncertain cases.
Where a Record of Processing Activities (RoPA) is required, keep its retention information consistent with the actual processing and schedule. A RoPA is a record of processing activities, not a substitute for implementation or proof that the whole business complies. The DPC’s Article 30 guidance explains the obligations and the limited small-organisation exemption.
Check the controls and licences before configuring them
Microsoft Purview retention policies apply settings across supported locations such as mailboxes. Retention labels can apply settings to individual items. Available features and licensing differ: do not assume every Microsoft 365 business subscription includes every label, automatic classification, hold or records-management feature. Check the retention documentation and feature-level licensing guidance for the intended design.
Archive storage, retention and backup solve different problems. A larger archive does not by itself implement a retention schedule. Backups need their own scope, access, expiry and recovery checks. A hold or overlapping retention rule may change when an item can actually be deleted.
Pilot the agreed rules and verify the outcome
Review existing settings and protected content before changing anything. Use an authorised pilot with agreed test material, check which items are retained or removed and document the result. Explain the behaviour to staff. Do not begin with a blanket deletion policy across production mailboxes.
Review access, exceptions, departed-user mailboxes and policy changes regularly. Route access or erasure requests through your established data protection process; do not treat them as routine mailbox housekeeping.
Keep required records usable
Revenue’s electronic-record guidance sets requirements for integrity, accessibility, reproduction and procedures for records within its scope. Keeping a backup file alone does not prove those requirements are met. Establish how the relevant records can be retrieved and reproduced throughout the required period, including after a system migration.
Get help with the technical setup
hostme.ie can discuss your business email setup, existing controls and backup and recovery needs. The work starts with an agreed scope based on your systems and the policy your business has approved. Legal or tax interpretation, compliance certification and a guaranteed audit outcome are not implied.
Message me about your email setup. We agree the scope, price and terms before work starts; ongoing support and separately scoped projects have different arrangements.
