Email Retention Policy

[Reboot_IT]

Good Afternoon and Happy Valentines Day.

 

We're a MAT using the GDPR Sentry software which we are very impressed with. I've had a meeting with them today and Email retention cropped up and I wondered what other MATs and Schools are doing with regards to this.

 

Currently staff manage their email accounts and aren't really advised to delete or archive their emails which basically makes it a dumping ground for conversations. This can particularly be an issue should we receive a Subject Access Request.

There isn't a law on this but it seems the ICO advise that emails be kept in an inbox for 3-6 months and really no longer than 18 months. Should it need to be kept longer, it should be filed somewhere (perhaps PDF'd).

 

The problem I have is that it would cause a massive shift in the way people work and use the email system. Has anyone enforced anything to improve compliance? We are using Gsuite at the moment.

 

Thanks

Edited February 14, 2020 by Reboot_IT

[steveg]

For all but certain key staff we enforce a retention policy of 26 months, which allows them to find emails from 2 years ago if they need to.

[synaesthesia]

They've recently added a built in archive facility which you can enforce for all users which can go some way to helping.

[MartinT]

Our retention policy matches what we say in our GDPR policy, which is the crucial thing.

 

Inbox: 1 year

Sent Items: 2 years

All folders at the root or lower levels: 7 years

Deleted items: 7 days

Junk: 14 days

[norwegian_imposter]

Our retention policy matches what we say in our GDPR policy, which is the crucial thing.

 

Inbox: 1 year

Sent Items: 2 years

All folders at the root or lower levels: 7 years

Deleted items: 7 days

Junk: 14 days

Is it possible that you could provide an draft copy of your gdpr policy for IT services in your school so I can compare ours? I am one man abroad with a team that are still playing catchup regarding this.

 

Thanks

[MartinT]

Is it possible that you could provide an draft copy of your gdpr policy for IT services in your school so I can compare ours? I am one man abroad with a team that are still playing catchup regarding this.

I shall ask whether that's ok to supply.

[norwegian_imposter]

I shall ask whether that's ok to supply.

 

Thank you, I really appreciate it. of course you should remove any identifiable data.

[MS2011]

Our retention policy matches what we say in our GDPR policy, which is the crucial thing.

 

Inbox: 1 year

Sent Items: 2 years

All folders at the root or lower levels: 7 years

Deleted items: 7 days

Junk: 14 days

 

Would it be possible to have your GDPR policy for IT Sevices?

 

Thanks

[GrumbleDook]

Your retention policy is based on need and is not specific to the technology. The technology should fit around this and this is what we consistently say to all our schools when they ask.

 

We also recommend you look at the IRMS Records Management Toolkit for Schools as it goes into a lot of detail about retention.

 

In short, email should not be a data storage system. Information from there should be put into the most relevant system and the email deleted if no longer needed.

 

This is set out with law as it is part of the Data Minimisation principle.