# How do you create an email retention policy for a small business? URL: https://iblockspam.com/blog/email-retention-policy-small-business Last updated: 2026-10-12 Published: 2026-10-12 Topic: Running email day to day Author: iBlockSpam Team > How to write an email retention policy: the periods US regulators set, a sample schedule, legal holds, and enforcing it in Microsoft 365 and Google Vault. ## Short answer An email retention policy says which email you keep, for how long, where, and when you delete it. Sort email into record categories, match each to the longest period your regulators or contracts require, such as the IRS's 3 to 7 years for tax records, enforce it with retention rules, and have counsel confirm the periods. An email retention policy decides what your business keeps, for how long, and when it deletes the rest. Without one, you either keep everything forever, which raises your breach and discovery exposure, or users delete things you were required to keep. This guide shows how to build a practical policy, using retention periods published by US regulators. **This guide is general information, not legal advice.** Retention duties depend on your industry, state, contracts and any pending disputes. Have an attorney or your accountant confirm the periods before you rely on them. ## What is an email retention policy? An email retention policy is a written rule set that says which categories of email your organization keeps, how long it keeps each one, where it's stored, who can delete it, and how it's destroyed at the end. A good one also says how you suspend deletion when a lawsuit or investigation is expected. It has three parts: - **A schedule.** Categories of email and a retention period for each. - **Enforcement.** Retention rules in your mail platform that keep and delete automatically, so the policy doesn't depend on users. - **Exceptions.** Legal holds, and who approves early deletion. ## Why does a small business need an email retention policy? A small business needs an email retention policy because email holds records the law requires you to keep, and also data you're required, or wise, to get rid of. Both failures cost money. - **Keeping too little.** Tax, payroll, employment and some industry records must be kept for set periods, and email is often where those records live. - **Keeping too much.** Every old mailbox is something an attacker can steal from a [compromised account](https://iblockspam.com/blog/signs-email-account-compromised). The FTC Safeguards Rule tells covered businesses to "securely dispose of customer information no later than two years after your most recent use of it to serve the customer", unless there's a legitimate business need, a legal requirement, or targeted disposal isn't feasible ([FTC](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know)). Our [FTC Safeguards Rule guide](https://iblockspam.com/blog/ftc-safeguards-rule-email-security) explains who is covered. - **Searching too slowly.** When an auditor, customer or court asks for messages, a defined policy tells you where they are. ## How long do US regulators require you to keep records? US regulators set retention periods by type of record, not by "email" as such. An email that documents a transaction, a payroll decision or a hire can carry the same period as the underlying record. These are examples from primary sources at the time of writing (October 2026), not a complete list: | Record type | Minimum period the regulator states | Source | |---|---|---| | Records supporting an income tax return (general rule) | 3 years | [IRS](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records) | | Tax records if income was under-reported by more than 25% | 6 years | IRS | | Tax records for a worthless securities or bad debt deduction claim | 7 years | IRS | | Employment tax records | At least 4 years after the tax is due or paid, whichever is later | IRS | | Payroll records under the Fair Labor Standards Act | At least 3 years | [U.S. Department of Labor](https://www.dol.gov/agencies/whd/fact-sheets/21-flsa-recordkeeping) | | Records on which wage computations are based (time cards, wage rate tables) | 2 years | U.S. Department of Labor | | Personnel or employment records | 1 year; longer if a discrimination charge is filed | [EEOC](https://www.eeoc.gov/employers/recordkeeping-requirements) | | Broker-dealer communications "relating to its business as such" | At least 3 years, the first 2 in an easily accessible place | [SEC Rule 17a-4(b)(4)](https://www.law.cornell.edu/cfr/text/17/240.17a-4) | | Customer information under the FTC Safeguards Rule | Dispose no later than 2 years after last use to serve the customer, with exceptions | [FTC](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) | Two cautions. First, the IRS also says to keep records "indefinitely" if you don't file a return or file a fraudulent one, and the EEOC says records must be kept "until the final disposition of the charge or any lawsuit based on the charge" once a charge is filed. Second, healthcare, financial services, government contractors and others have their own rules; healthcare providers should start with our [HIPAA email guide](https://iblockspam.com/blog/hipaa-email-security-requirements) and counsel. State law and contracts can add more. ## How do I write an email retention policy? Write the policy in this order. Most small businesses can finish a first draft in an afternoon. 1. **List who sends and receives business email.** Every mailbox, shared mailbox and alias, plus any personal or messaging apps staff use for work. 2. **Define record categories.** Keep it to five or six, such as finance and tax, HR and payroll, contracts and customers, operations, and routine or transient mail. 3. **Assign a period to each category.** Use the longest period that applies from your regulators, contracts and insurer. Ask your accountant and attorney to confirm. 4. **Set a default for everything else.** Uncategorized mail needs a period too, often one to three years. 5. **Decide where retained mail lives.** In the mailbox under a retention rule, in an archive, or both. Our [email archiving vs backup guide](https://iblockspam.com/blog/email-archiving-vs-backup) explains the difference. 6. **Write the legal hold procedure.** Who can order a hold, how it's applied, and who releases it. 7. **Define disposal.** Deletion in the platform at the end of the period, plus secure destruction of any exports or old devices. 8. **Assign an owner** and a review date, at least once a year. 9. **Tell staff.** Explain what they may delete, and that they must not delete anything under a hold. 10. **Configure the platform** so the schedule runs automatically, then test it. ## What should the policy document say? The policy document should be short enough that people read it. Here is an example structure you can adapt; the periods are placeholders for your counsel to confirm: ``` Example email retention schedule (placeholder periods) Category Retention Then Finance, tax and invoices 7 years Delete HR, payroll and hiring 4 years Delete Contracts and customer accounts Term + 6 years Delete Routine operational email 3 years Delete Newsletters, notifications 90 days Delete Anything under legal hold Until released Review Owner: Operations manager. Reviewed annually and when laws change. Staff must not delete, export or forward email to personal accounts to avoid this schedule. Questions go to the policy owner. ``` ## How do I enforce retention in Microsoft 365 and Google Workspace? You enforce retention with retention policies in Microsoft Purview or retention rules in Google Vault, so mail is kept and deleted automatically. Check that your licenses include these features before you plan around them; at the time of writing (October 2026), availability varies by plan. ### Microsoft 365 [Microsoft Purview retention](https://learn.microsoft.com/en-us/purview/retention) supports retain-only, delete-only, and retain-then-delete settings, applied with retention policies or retention labels. When settings conflict, Microsoft's principles apply: "retention always takes precedence over permanent deletion, and the longest retention period wins." Deleted mail under retention moves to the hidden **Recoverable Items** folder, where admins can still find it with eDiscovery. Without a retention policy, Microsoft says deleted items stay recoverable for 14 days by default, adjustable up to 30 days, and are then removed ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/recoverable-items-folder/recoverable-items-folder)). For leavers, our [offboarding guide](https://iblockspam.com/blog/employee-offboarding-email-security) covers inactive mailboxes. ### Google Workspace [Google Vault](https://knowledge.workspace.google.com/vault/retention/how-retention-works) uses default rules for all of a service's data and custom rules for specific organizational units, dates or search terms. Google says "by default, Google Workspace data stays in user accounts until the user or admin deletes it", that holds "take precedence over retention rules", and that when a retention period expires the data is "purged from all Google systems". Read the warnings before saving a Gmail rule: Google says "Vault allows Gmail to immediately purge data that exceeds the retention period when you submit a new rule" ([Google Vault Help](https://knowledge.workspace.google.com/vault/retention/retain-gmail-messages-with-vault)). ### Test before you rely on it Apply each new rule to a test group first. Then check that a message older than the period is gone and that a held message survives deletion by the user. ## What is a legal hold and when do I need one? A legal hold is an order to preserve records that may be relevant to litigation, an investigation or an audit, overriding your normal deletion schedule. You need one as soon as a dispute is reasonably expected, not when papers are served. Your attorney decides that point. Both platforms support holds. Microsoft says content under an eDiscovery hold can't be permanently deleted by any retention policy or label. Google says holds "take precedence over retention rules". Write down who can request a hold, and apply it to the right mailboxes the same day. ## How do I securely dispose of email at the end of the period? You dispose of email by letting platform retention rules delete it, then destroying any copies outside the platform. Exports, PST files, old laptops and backup media often outlive the mailbox. For physical and offline media, [NIST SP 800-88 Rev. 2](https://csrc.nist.gov/pubs/sp/800/88/r2/final) describes media sanitization as making access to the data infeasible "for a given level of effort", and helps you choose methods by data sensitivity. Keep a short disposal log: what was destroyed, when and by whom. ## What mistakes should I avoid? - **Keep everything forever.** It's simple, but it multiplies what a breach exposes and what you must search in a dispute. - **Relying on users.** Manual cleanup is inconsistent. Automate it. - **Forgetting other copies.** Backups, archives, exports and forwarding to personal accounts all hold copies your policy must cover. - **Confusing filtering logs with retention.** Spam filter logs are not a records system. iBlockSpam's message history, for example, covers 30 days for troubleshooting; your mailbox platform holds the records. - **No hold procedure.** Deletion during a dispute can be far more costly than storage. ## Next steps - Draft your record categories and periods this week, then book 30 minutes with your accountant and attorney to confirm them. - Check which retention features your Microsoft 365 or Google Workspace plan includes. - Decide how you'll handle backups and archives, using [email archiving vs backup](https://iblockspam.com/blog/email-archiving-vs-backup). - Add the policy to your [email security checklist](https://iblockspam.com/blog/email-security-checklist-small-business) and review it every year. ## Frequently asked questions ### How long should a small business keep emails? There's no single legal period for all email. Keep each message as long as the record it contains must be kept: for example, the IRS says employment tax records for at least 4 years, and the Department of Labor says payroll records for at least 3 years. Routine mail with no record value can usually have a much shorter period. Confirm the periods with counsel. ### Is it legal to delete old business emails automatically? Generally, deleting email under a consistent, documented policy is a normal records practice, and the FTC Safeguards Rule actually requires covered businesses to dispose of customer information they no longer need. Automatic deletion must stop for anything under a legal hold, and periods must meet your regulators' rules. Ask counsel before turning deletion on. ### What is a legal hold on email? A legal hold, or litigation hold, is an instruction to preserve email and other records that may be relevant to a lawsuit, investigation or audit, overriding normal deletion. Microsoft 365 and Google Vault both support holds that keep mail even if users delete it. Your lawyer decides when a hold starts and ends. ### Does Microsoft 365 or Google Workspace keep my email forever by default? No. Mail stays until someone deletes it, then is recoverable only for a short window. Microsoft says deleted items are kept 14 days by default (up to 30), and Google says deleted Gmail can be restored by an admin for 25 days after the 30-day Trash period. Longer retention needs retention policies or Vault rules. ### Should an email retention policy cover personal devices and messaging apps? Yes, if staff do business there. A text or chat that approves a payment can document the same decision as an email. Your policy should say which channels may be used for business, and that business records sent elsewhere must be copied into a system the company retains. ## Sources - [IRS: How long should I keep records?](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records) - [FTC: FTC Safeguards Rule: What Your Business Needs to Know](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) - [17 CFR 240.17a-4: Records to be preserved by certain exchange members, brokers and dealers (LII)](https://www.law.cornell.edu/cfr/text/17/240.17a-4) - [U.S. Department of Labor: Fact Sheet #21, Recordkeeping Requirements under the FLSA](https://www.dol.gov/agencies/whd/fact-sheets/21-flsa-recordkeeping) - [EEOC: Recordkeeping Requirements](https://www.eeoc.gov/employers/recordkeeping-requirements) - [NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization (September 2025)](https://csrc.nist.gov/pubs/sp/800/88/r2/final) - [Microsoft Learn: Learn about retention policies and retention labels](https://learn.microsoft.com/en-us/purview/retention) - [Google Vault Help: How retention works](https://knowledge.workspace.google.com/vault/retention/how-retention-works) ## Free tools for this guide - [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan. --- Source: iBlockSpam, https://iblockspam.com/blog/email-retention-policy-small-business (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt