Email retention policy in the workplace

Whether it is to meet operational needs, litigation readiness and eDiscovery, compliance, end-user liability, costs and other issues that come with corporate email communication, an email retention policy is always a great asset to help manage, store and archive corporate email messages. Even more so when research estimates that up to 75% of email content is considered critical to the successful operation of an organization (Osterman).

Does the organization require an email retention policy?

The answer for most organizations may clearly be in the affirmative. Companies which fall under Sarbanes-Oxley, SEC 17a-3/4, NASD 3010 or HIPAA regulations will need to have an email retention policy. Organizations seeking to pass a SAS 70 audit will want to have a policy even if no law or regulation requires it. Companies involved in litigation may find themselves required by court order to retain emails if they do not already have a policy in place. If a particular business does not fall under any of these categories, it may want to implement an email retention policy just the same to position itself ahead of any future need, and also to take advantage of the operational benefits email retention offers.

What should an email retention policy include?

This is another question that does not have a simple, one-size-fits-all answer as it can vary from industry to industry, and smaller companies may have different requirements from larger ones. If the company has a Documents Retention Specialist, it should consult him/her first to check what may be required and what policies are already in place regarding the retention of paper records. The company's corporate counsel is another resource, and should have specifics on any laws or contractual obligations that could affect the email retention policy. The important things to include are clear and easy to understand requirements that are well documented, explained to all users, and that are enforced consistently across the organization. It should also address when email should be deleted, and provide for a way to ensure that this occurs when it should. Of course, the business stakeholders should be included to ensure that the policy supports, rather than hinders, the business.
What about legal holds?

It is likely that an organization will be involved in litigation at some point during its history. Legal holds can come into play and could supersede any email retention policy that addresses destruction of data. Ensure that the technical systems in use have a way to store all email for any or all users covered by any court order or discovery request, and that it can prevent users from inadvertently deleting emails.

When is it time to have an email retention policy?

There are several key points that will mean the answer is "now", these include:

• The company is subject to Sarbanes-Oxley, SEC 17a-3/4, NASD 3010, HIPAA, or other regulations.
• Management wishes to be audited to SAS 70 standards.
• The company conducts any business through email with customers and is subject to PCI regulations.
• Management wants to preemptively establish a policy so that the company is prepared in the event of litigation.
• Email Administration is considering an email archiving solution.
• The company uses email to communicate management decisions, directives, policies, or disciplinary actions to employees.
• The company uses email to communicate financial information to investors, partners, agents, or others that may make decisions based on this information.

Are there any other benefits to having an email retention policy

Among the benefits to having an email retention policies are:

• Ensuring compliance with legal and regulatory requirements.
• Reduced infrastructure costs as a result of lower storage requirements.
• Improved system efficiency.
• When combined with email archiving, messages can be more easily found by end users, there is less chance of data loss due to systems failures, and messages can be easily audited for policy compliance.

With a comprehensive email retention policy in place that has been developed with the cooperative efforts of senior management, technology, legal and other sectors within the organization, together with the technology that can enforce and enhance the policy, such as email archiving software like GFI MailArchiver, email administrators can be well positioned to handle email issues.

GFI MailArchiver: Overview | Features | Download a 30-day trial