Email retention policy

[Simcfc73]

Hi,

 

We are looking at tightening up our retention policy for staff emails. Have you all got it as part of the school retention policy? Ours is set a bit long and especially with SAR stuff I want to shrink it down.. some staff have lots of folders setup to file email communications (bursar, DPO, etc)

 

The GDPR course I went on suggested 3 months.

[rom1984]

The way the ICO did it when they implemented it was to have a 12 month retention period. Then every month for 6 months they reduced it by a month to eventually get to 6 months.

[enjay]

Surely your email retention policy should be the same as for your SIMS and paper records.

[Banjo]

Surely your email retention policy should be the same as for your SIMS and paper records.

 

The information in emails is vastly different to whats stored in SIMS/MIS. Better to keep a short shelf life on emails.

[enjay]

The information in emails is vastly different to whats stored in SIMS/MIS. Better to keep a short shelf life on emails.

 

Perhaps so (although I can think of all sorts of reasons not to delete after 3 months), but you're going off the scent by linking this with GDPR. There's nothing in GDPR which says email should be deleted after 3 months.

[Simcfc73]

Suppose I'm looking at it from SAR. If we archive emails that data is still held in school so is still accessible via a SAR request??

[enjay]

Suppose I'm looking at it from SAR. If we archive emails that data is still held in school so is still accessible via a SAR request??

 

I think if it only exists in an archive which IT Support can access but no-one else, it doesn't need to be part of an SAR. That seems to be the guidance regarding right to be forgotten, so it makes sense (to me, anyway!) for the same to apply to SARs.

 

SARs would be a mighty fine reason to delete emails after 3 months!

[jmak]

Given how long some of the projects I get involved with take, three months isn't remotely enough...

 

Three years maybe....

[jthompson]

3 months?? Wow. That doesn't sound right. Surely you'd want 12 months at least, to cover the entirety of the current academic year?

 

Even then, year teams and the like will want to retain previous years.

Edited February 23, 2018 by jthompson

[Linfit]

I think 3 months is very short. Bear in mind that e-mails may be required for evidence in all sorts of legal situations - emplyment tribunals, for example, can look at stuff up to 6 year back, and there are some legal obligations for stuff related to employment that operate on similar timecales, so I would think retention of staff e-mails would need to be in the order of years, not months. We currently archive ours and keep for three years, and it is annoying, as its a LOT of data. If I coud keep it for less, I would, but wouldn't like to change without very clear gudiance from legal type people.

[GrumbleDook]

You have a range of options, and retention does not have to be on the email platform itself. You can save the message as a pdf or .msg file if you feel it may be needed.

 

It may be attached to a personal record of a student or member of staff.