Email Archiving and Retention Policies Your Organization Should Implement Now

Email archiving and retention policies reduce risks caused by holding large amounts of protected information.

Email archiving is the process of moving emails from your inbox to a separate mailbox, and retention policies determine how long emails are kept before being automatically archived or deleted.

Think about the sensitive data that is sent via email every day. On top of that, think about how often the average person cleans out their email folders. Probably not that often, if ever.

That means there is personal information, financial information and private company information sitting in inboxes, sent folders and trash folders waiting to be stolen.

Before you panic, that doesn’t mean you and your employees need to permanently erase every email, but you should be more selective about the emails you keep.

Because data breaches are so prevalent, organizations (and especially those in high-compliance industries) should shift their line of thinking to “If an email is valuable, keep it, otherwise delete” rather than “If it might be valuable, keep it.”

What Policies Should We Implement?

Here are a few examples of archiving and email retention policies we recommend implementing. Note: We use Microsoft Outlook to create these policies.

1. Archiving Policy Example: Create a retention policy that automatically moves emails from the primary mailbox to the archive mailbox based on time criteria (e.g., after two years).

Why?

• Avoid storage limits: While the average user probably won’t reach their primary mailbox storage limit, archived storage generally is significantly larger.
• Clean up your inbox: Allows you to save emails and remove them from your inbox while still making them accessible.

2. Archiving Deletion Example: Create a retention policy that permanently deletes emails in the archive as soon as possible, considering things like personal preference and regulatory compliance (e.g., after seven years).

Why?

• Unlimited risk: An unlimited archive is an unlimited risk. At some point, sensitive emails need to be deleted.
• Ensure you remain business compliant: All organizations must adhere to compliance regulations, and certain industries (financial, health care, government, etc.) have specific rules for storing data and documents.

3. Permanent Deletion Example: Set a retention policy to permanently delete items in the trash folder (e.g., after 30 days) and in the sent folder (e.g., after one year).

Why?

• Free up storage space: Any emails in your trash or sent folders still count toward your overall storage until you permanently delete them.
• Use online archive mailbox: Avoid using your trash folder as an archive folder. Anything you want to save can be archived rather than “stored” in your trash folder.

Why Does It Matter How Many Emails I Keep?

When your organization is shopping for cybersecurity insurance, you’ll find organizations that keep a higher number of protected records generally are offered higher premiums.

Obviously, some of those records need to be held for compliance reasons, but the less you can hold, the lower your premiums can be.

On the other hand, some people are skeptical of archiving emails, as there are claims that using the search function is much quicker when it only searches the primary mailbox, rather than both the primary and online archive folders.

However, it’s not a great argument, as the difference is negligible; we’re talking about milliseconds faster to search one folder than two.

Because emails will be automatically archived or deleted depending on what folder they are in, you’ll need to educate your employees on those cutoff dates, probably multiple times.

If you use the above retention policies, these are the timeline dates your employees will need to know:

• After 30 days, emails in the trash will be permanently deleted
• After one year, emails in the sent folder will be permanently deleted
• After two years, emails will be moved from the primary mailbox to the online archive mailbox
• After seven years, archived emails will be permanently deleted

Want to Learn More About Archiving and Retention Policies?

If you have any questions about email archiving and retention policies, contact us here so we can help implement the best policies for your organization.

Did you like this blog? You can subscribe to our newsletter to receive a weekly email with our latest blog posts.