By now, every business knows that they need to archive their emails, for convenience, as well as for compliance, e-discovery, and disaster recovery purposes. But once archived, how long do you need to keep them?

There’s really no fixed answer, as is often the case when lawyers are involved. But what’s most important is that there is a written policy about data retention, and that it is followed to the letter, documented, and has an audit trail. The reason for this is clear. Suppose for example, that you are subject to a lawsuit, and opposing counsel has demanded records pertaining to a certain subject. You provide records going back two years. But you have no written policy on data retention. Guess what? Even if the records you provide show no evidence of your guilt, you still lose by default. That is of course, assuming that your opponent has a competent lawyer. The logic behind this is that since you have no retention policy, you may have deleted older emails that showed your liability. 

Now suppose that you do have a written retention policy that says you archive all emails for two years. But, there’s no formal audit trail that shows when those archives are accessed. Again, you lose. Opposing counsel will argue that without an audit trail, there is no reason to believe that you haven’t gone in and erased the evidence! Oh, those tricky lawyers.

Now suppose that you have a long-standing, written retention policy that says you archive all emails for two years, and you do have an audit trail. There is an email that shows you’re guilty, but it’s three years old and long gone. Guess what? You win! Tricky you!

When you’re creating that retention policy, make sure to get input from every stakeholder. It’s not always necessary to archive every email for the same period of time. Your policy may state for example, that emails in the Legal department be archived for three years; Accounting for two years; and Marketing for one year.

Your retention policy should also include a paragraph for putting a “legal hold” on any email that may be near the end of the retention period, if you have any reason to believe that it may be needed in the future.

Lastly, is it necessary to archive everything? In general, yes, but keep in mind that spam and advertisements will only clog up your archives, and do not need to be included. Take every effort to eradicate your spam email before the archiving process.

And above all, remain consistent! Those tricky lawyers will look for evidence that you may have deleted an email ahead of schedule–even if it was spam–and will use that to try to prove that you don’t follow policy.