In short
An email retention policy is a written rule set that says how long your organisation keeps each category of email, the reason for each period, and how mail is deleted when the period ends. A good policy covers legal holds, leavers, roles and review, and is enforced by archive retention settings rather than by users tidying their inboxes.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What an email retention policy is for
Most organisations keep email by accident. Some people delete everything, some keep everything, and whatever is left when someone leaves goes with their account. That leaves two risks at once: the email you need for a dispute or an audit has gone, while years of mail you no longer need is still sitting in mailboxes, full of personal data.
A retention policy replaces accident with a decision. It answers four questions:
- What do we keep? The categories of email that matter, such as contracts, financial records, HR matters and client advice.
- For how long? A period for each category, with the reason written down: a law, a regulator's rule, a contract, or a business need.
- What happens at the end? Controlled, logged deletion, unless something stops it.
- Who is responsible? Named roles for owning the policy, applying holds, handling requests and reviewing the rules.
UK GDPR makes the reasons part of the job, not an extra. Personal data must be kept no longer than necessary for its purpose, and the organisation must be able to show it complies. Our page on email retention and UK GDPR explains how that applies to email.
Start with record categories, not mailboxes
Email is a container, not a type of record. The same mailbox holds a signed order, a payslip query and a lunch invitation. Policies that work start by listing the categories of record that arrive by email, then set periods for those categories.
A typical first list for a UK business looks like this:
| Category | Examples | What drives the period |
|---|---|---|
| Contracts and customer agreements | Quotes accepted by email, order confirmations, variations | Limitation periods for claims and the contract's own terms |
| Accounting and tax records | Invoices, remittances, expense approvals | Companies Act and HMRC record-keeping rules |
| Payroll and employment | Pay queries, contract changes, absence records | HMRC payroll rules, employment claims, HR policy |
| Regulated communications | Client orders and advice in FCA-regulated activities | Sector rules such as SYSC 10A |
| Anti-money laundering records | Due diligence documents and transaction records | Money Laundering Regulations 2017 |
| Complaints and disputes | Customer complaints, solicitor correspondence | The dispute itself, then limitation periods |
| Everyday correspondence | Scheduling, internal chat-style email, newsletters | Business need only, usually short |
The sourced reference points for these periods (six years for company accounting records under HMRC's rules, six years for simple contract claims, five years for money laundering records, five to seven years for in-scope FCA communications) are set out on how long should a company keep emails?. Regulated firms should also read FCA email retention.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
A template outline for your policy
This outline is a starting structure, not legal advice. Agree the periods with whoever advises you on legal and compliance matters before you adopt it.
- Purpose and scope. Why the policy exists and what it covers: all email accounts, shared mailboxes, archived mail, leavers' mail and, if you choose, Teams chats.
- Definitions. What you mean by a record, the archive, a retention period, a legal hold and deletion.
- Roles. Who owns the policy, who can search the archive, who can apply and lift holds, who handles subject access requests, and who reviews the policy.
- Retention schedule. A table of categories, each with a period, the start point (for example, the end of the financial year or the end of a contract) and the reason.
- How mail is captured. How email gets into the archive (for example, journaling) so retention does not depend on users keeping mail.
- Deletion. What happens at the end of each period, who approves it, and how it is logged.
- Legal hold. When a hold is applied (when litigation or an investigation is reasonably anticipated), who applies it, and that a hold overrides deletion until it is lifted.
- Leavers. What happens to a former employee's mail, who can access it and for how long.
- Access and security. Who can see archived mail, how access is controlled and logged, and how the archive is protected.
- Requests. How subject access, erasure and disclosure requests are searched and answered.
- Review. How often the policy is reviewed (for example, yearly, or when the law or your business changes) and who signs it off.
Setting retention periods by category
For each category, write down three things: the period, the point it starts from, and the reason. That third column is what makes the policy defensible. "Six years from the end of the financial year, because HMRC requires company records to be kept that long" survives scrutiny; "seven years because that's what we've done for years" does not.
Some practical rules of thumb:
- Use the longest period that genuinely applies to a category, not the longest period you can think of.
- Be careful with 'keep everything forever'. It is simple to configure, but it keeps personal data with no stated purpose and makes every search, request and dispute larger.
- Short periods for everyday mail are fine, provided business records are kept under their own categories.
- Where you cannot separate categories by mailbox, set periods by department or role, since a finance team's mail is mostly finance records.
- Write down the exceptions: a legal hold overrides deletion, and some records may need keeping for longer when an investigation or claim is under way.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Retention in Microsoft 365 and Google Workspace
Both platforms have their own retention tools, and your policy should say whether you rely on them, on an archive, or on both.
| Microsoft 365 | Google Workspace | |
|---|---|---|
| Built-in retention | Microsoft Purview retention policies and retention labels, set to retain, or retain and then delete | Google Vault retention rules and holds; Google notes that Vault retains nothing until you set up retention rules |
| Leavers | A removed account's mailbox is kept for 30 days, then permanently removed unless a hold or retention policy was applied first (it then becomes an inactive mailbox) | Deleting a user or a required licence can irreversibly purge their data, so it is no longer available to Vault |
| What the vendor says it is | Retention and eDiscovery inside your tenant | Google says "Vault isn't a data archive" |
Built-in retention works inside the same tenant as the live mail, under the same administrators. A separate archive gives you an independent, immutable copy with one set of retention policies, holds and searches, whichever platform the mail came from. That matters if you run both platforms, have moved from one to the other, or want leavers' mail kept searchable after their accounts are removed. See Office 365 email archiving and Google Vault alternatives for each platform in more depth.
How an archive enforces the policy
A policy that relies on people filing and deleting email by hand will drift within weeks. An archive enforces it centrally, and that is where NinjaOne Archiver earns its place.
| Policy requirement | How NinjaOne Archiver handles it |
|---|---|
| Capture every message | Real-time journaling copies inbound and outbound mail, with attachments and metadata, at server level, including mail a user later deletes. NinjaOne sets the journal rule up for Microsoft 365; Google Workspace needs a Gmail routing rule |
| A default period for everything | A standard retention policy applies across the organisation, including email, OneDrive, calendars and tasks |
| Different periods for different groups | Custom retention policies by department or individual email account (NinjaOne also describes policies by domain), with a separate policy for SharePoint sites |
| Keep some records indefinitely | Retention from 30 days to over a decade, or Set to Unlimited |
| Departments that are easy to maintain | Department Sync lets you group-assign users to departments instead of adding each one by hand |
| Records cannot be changed | Immutable WORM storage with full audit trails |
| Holds override deletion | Legal hold freezes retention for held data until the hold is removed |
| Controlled access | Compliance and Review Officer, Data Protection Officer, Reviewer and Limited Reviewer roles; the IT Admin role cannot open compliance features |
| Evidence the policy is working | Audit log of activity in the archive |
NinjaOne describes its retention as supporting "defensible deletion practices without manual intervention". The archive does the mechanics; your policy decides the periods. See how NinjaOne Archiver is set up for where retention fits in the set-up order.
Legal hold and leavers: the two places policies break
Two situations catch most organisations out.
Legal hold. When a dispute, claim or investigation is reasonably anticipated, normal deletion must stop for the relevant mail. If your policy deletes mail after three years and a claim arrives about something from two and a half years ago, you need to stop the clock for those people and dates. In NinjaOne Archiver, a legal hold is created in the End-User Portal under Compliance, and it freezes retention for the held data until it is removed. Our page on legal hold explains when to apply one.
Leavers. Both platforms can lose a leaver's mail quickly. Microsoft says a removed Microsoft 365 account's mailbox data is kept for 30 days and then permanently removed, unless a hold or Microsoft 365 retention policy was applied first. Google says that if you delete a user or a required licence, their data might be irreversibly purged and no longer available to Vault. Your policy should say what happens to a leaver's mail, who may read it, and for how long. An archive keeps that mail searchable after the account has gone. See what to do with a former employee's mailbox and, for how NinjaOne treats deactivated mailboxes and seats, deactivated and inactive mailboxes.
Common mistakes in email retention policies
- Copying another organisation's periods. Their sector, contracts and risks are not yours.
- Setting periods without reasons. Without the reason, you cannot defend the period to a regulator, a court or a data subject.
- Relying on users. Asking staff to 'delete what you don't need' produces neither compliance nor a reliable record.
- Forgetting where else mail lives. PST files, old archives, shared mailboxes and leavers' accounts all hold email your policy should cover. See migrating a legacy email archive.
- No review date. Laws, regulators' rules and your own business change; a policy nobody revisits quietly goes out of date.
How Forever Systems helps
We do not write your legal retention schedule; that belongs with your legal or compliance adviser. What we can do is turn the schedule into working archive settings and show your team how to run it.
We help you map your categories to retention policies by department or account, set up journaling so capture does not depend on users, assign compliance and reviewer roles, plan how leavers and legacy mail are handled, and show your reviewers how to apply legal holds and search. We confirm the bundle, seat count, storage allowance and where your archive will be held when we quote.
Ask us for a quote for NinjaOne SaaS Backup with Archiver, or contact us to talk through your policy and how an archive would enforce it.
Email retention guides
How Forever Systems helps with email archiving
We are an independent UK IT and cyber security provider. We supply NinjaOne SaaS Backup with Archiver for organisations on Microsoft 365 or Google Workspace, and help you get the archive set up, the policies right and the people who need it confident using it.
- Scoping: we look at your mailboxes, leavers, legacy archives and record-keeping obligations, and what your Microsoft 365 or Google Workspace plan already includes, before suggesting anything new
- Set-up: we can configure journaling for Exchange Online or Google Workspace, connect the archive and check that mail is arriving
- Retention and legal hold: we help you turn your email retention policy into archive rules, and show your compliance or HR lead how to search, hold and export
- Leavers and legacy archives: we can help you plan how former employees' mail and older archives are brought across, with the approach confirmed at quote
- Backup alongside the archive: the same NinjaOne per-user licence also covers backup of your Microsoft 365 or Google Workspace data, so recovery and record-keeping are planned together
We work with businesses, schools, charities and public sector organisations. If you also need wider protection, see our independent cloud security guides.
Frequently asked questions
What is an email retention policy?
A written policy that sets how long each category of email is kept, the reason for each period, and how mail is deleted when the period ends. It also covers legal holds, leavers, access and review.
What is a recommended email retention policy?
There is no single recommended period for all email. Set periods by category of record, such as contracts, accounting, HR and regulated communications, each with a reason. Our guide to how long a company should keep emails gives the UK reference points.
Is there an email retention policy template for the UK?
Our template outline above covers purpose, roles, a retention schedule, capture, deletion, legal hold, leavers, access, requests and review. Use it as a structure and agree the periods with your legal or compliance adviser; it is not legal advice.
Can different departments have different email retention periods?
Yes. In NinjaOne Archiver you set a standard policy for everyone and add custom policies by department or individual account, with a separate policy for SharePoint sites.
Does a legal hold override an email retention policy?
Yes. A legal hold stops deletion of the held mail, whatever the retention policy says, until the hold is lifted. In NinjaOne Archiver, a legal hold freezes retention for the held data until it is removed.
Do we need an email archive to have a retention policy?
Not strictly, but without one the policy depends on mailbox settings and on users. A journaling archive captures every message and applies retention centrally, which makes the policy far easier to enforce and to prove.
How do email retention policies work in Google Workspace?
Google Workspace retention is set in Google Vault, with retention rules and holds. Google notes that Vault retains nothing until you set up retention rules, that it "isn't a data archive", and that deleting a user or a required licence can irreversibly purge their data. NinjaOne Archiver can journal Gmail through a routing rule and apply its own retention policies on top.
How do email retention policies work in Microsoft 365?
Microsoft 365 uses Microsoft Purview retention policies and retention labels. For leavers, Microsoft keeps a removed account's mailbox for 30 days and then permanently removes it, unless a hold or retention policy was applied first. An archive such as NinjaOne Archiver keeps an independent copy with its own retention policies.
Still have a question about email retention?
Ask us and a member of our team will reply by email.