Most businesses back-up their email, but many don't have a reliable email archiving system. The main purpose of backing-up email is to restore email to a point in time after loss, but this does not result in a reliable way to retrieve individual emails on demand. The main purpose of archiving, however, is to automatically capture all sent and received email in real-time in an indexed, searchable record for a pre-defined period. Since email archives are required for many legal and compliance reasons, by nature they should be unable to be changed or otherwise tampered with.
The Benefits of Email Archiving
In the real world, email archiving results in many benefits:
- If you or an employee deletes an email from your personal storage, it will still exist in the archive
- Records can not be deleted or encrypted beyond your reach in a security breach
- If a client asks to see what information you hold about them, for example under the Data Protection Act 2018, you will be able to quickly retrieve this from the searchable archive
- You can retain emails in your archive for exactly as long as applicable UK laws require
- You can reduce the storage requirements of primary email storage locations
Who Can Request Access to Archived Emails?
Aside from any organizations with legal or regulatory powers that might wish to access your archived emails, individuals have the right to submit a "Subject Access Request" (SAR) to any company or organization that holds information about them under UK GDPR laws and the Data Protection Act 2018. These must be responded to within one or two months (depending on the case complexity) and must not be charged for unless requests become excessive. If this data is contained within emails, these must be able to be retrieved quickly and securely or failure to do so can attract enforcement action by the Information Commissioner’s Office (ICO).
Public Authorities, certain other publicly funded bodies and private companies delivering services on their behalf are also subject to similar rules under the Freedom of Information Act 2000 (FOIA),except that requests must be responded to within 20 working days or regulatory penalties can apply.
How Long Should Emails Be Archived For?
There is no single period that applies to how long email archives should be kept, but businesses can apply the following considerations to their own policy:
- UK GDPR laws requires that personal data is kept for no longer than is necessary for its purpose (the storage limitation principle)
- The Companies Act 2006 requires that certain business records (such as financial records) be kept for a minimum of 3 years for private companies or 6 years for publicly-listed companies. Anything communicated by email are covered by this.
- The Financial Conduct Authority (FCA) requires that investment firms retain records of all communications relating to client transactions for 5 years.
- Emails relating to employment law should typically be kept for the limitation period of 6 years in case of any employment disputes.
- Legal, health, education and other regulated sectors also have their own specific retention requirements.
- If legal action involves data contained within a mailbox, a Litigations Hold should be enforced, preventing deletion, modification or expiry regardless of other retention policies
How to Develop an Email Archiving Policy Document
When you begin archiving your email, you should have an accompanying policy document which outlines where the data is stored (which should be a UK-based or GDPR-compliant data centre),how long the data is stored for, who has access to the data, and who is the point of contact for when a request is made to access the data (this could be your Data Controller for your GDPR policy).
