Email retention from the ground up

[Jobos]

I'm looking for help with email retention policies and what other schools use. We are using 365 here and as it stands we don't have any retention policies set so all email is kept and I know some staff have emails going back 15 years including emails in their deleted items which is bulging under the weight of all that kept spam.

 

What is the recommended length of time to keep emails and would this apply to all folders i.e. inbox, sent and deleted items? Finally, how long before deleting a mailbox for staff who leave the school?

 

Thanks in advance.

[paulkerton]

Does your school have a data retention policy?

You should follow that.

You should definitely have one in the world of GDPR. It's that policy that defines what your processing terms are to parents/students etc.

If you don't, you need to press home the need urgently.

 

It's not your job as a techy to do this stuff either, it's an SLT level thing.

The IRMS Schools Toolkit is a good place to start, and a place most schools go to.

Edited July 1, 2020 by paulkerton

[mwnci]

The difficulty with linking a data retention policy with how long emails should be kept is that this is dependent on the content of the email.

What if email contains SEN information? What if the email contains HR info about someone who has now left? The two data types would probably have different retention requirements, governed by legislation. If this data is not held elsewhere and email is used as a filing cabinet for random attached documents it is hard to effectively enforce a retention policy.

[paulkerton]

The difficulty with linking a data retention policy with how long emails should be kept is that this is dependent on the content of the email.

What if email contains SEN information? What if the email contains HR info about someone who has now left? The two data types would probably have different retention requirements, governed by legislation. If this data is not held elsewhere and email is used as a filing cabinet for random attached documents it is hard to effectively enforce a retention policy.

 

The problem isn't email retention. The problem is people using it as a big filing cabinet for random attached documents. This is what you need to cut out.

There is a reasonable expectation for people to use tools correctly, including putting those files into safeguarding platforms and their MIS tools. That's what they're for.

[mwnci]

I agree, but how can you enforce that and ensure that it is being done, short of auditing different inboxes.

[Jawloms]

This topic drifted very quickly. @Jobos has simply asked what other people do, not to start a debate about the whos, hows and wheres. This is something I am interested too. I have mailboxes still present for staff and students who left years ago as I simply don't know (and can't find out) how long I should keep them. There will always be a few variables, but can anyone offer a basic idea please?

[paulkerton]

This topic drifted very quickly. @Jobos has simply asked what other people do, not to start a debate about the whos, hows and wheres. This is something I am interested too. I have mailboxes still present for staff and students who left years ago as I simply don't know (and can't find out) how long I should keep them. There will always be a few variables, but can anyone offer a basic idea please?

And it's the same answer:

 

Your school should have a data retention policy that will define exactly how long you should keep them for. There isn't a set default answer, you have to make decisions for your own school and define what your policies are.

Data retention is at the centre of GDPR that you'll only process the data for as long as is absolutely needed. If your school doesn't have a policy, then they're not GDPR complaint and they need to pull their finger out and put one in place before it becomes an issue.

[Jawloms]

And it's the same answer:

 

Your school should have a data retention policy that will define exactly how long you should keep them for. There isn't a set default answer, you have to make decisions for your own school and define what your policies are.

Data retention is at the centre of GDPR that you'll only process the data for as long as is absolutely needed. If your school doesn't have a policy, then they're not GDPR complaint and they need to pull their finger out and put one in place before it becomes an issue.

 

Yes, agree with all of that, but what is the harm in asking what others do and getting a response of "We keep emails of students for three years and staff for five" or something?

[paulkerton]

Yes, agree with all of that, but what is the harm in asking what others do and getting a response of "We keep emails of students for three years and staff for five" or something?

Err...

The IRMS Schools Toolkit is a good place to start, and a place most schools go to.

[Jobos]

Thanks all. I'm not going to get involved in making policies, don't get paid enough for that but as I said in another post the school GDPR practice is very poor in my opinion.

 

I've asked the question and been told to start with the deleted items folder and set the data retention policy to 3 years so I'll start with that.

[AndyCrow]

As long as you're not an Independent school you should have a DPO .

They should be able to give you the correct info.

[Boredguy]

As a trust, it was decided that for the majority of staff they can only retain messages for 1 year.

There is a subset of staff who need content for longer (finance etc), so they can retain 2 years in their mailbox, and a 3rd year in their online archive.

Our shared mailboxes are limited to just 90 days.

 

We informed all staff across the MAT before last years summer break so they had time to clean up and ensure any content they needed was identified, then we enabled the retention policy once we got back in September.

[flyinghaggis]

My school has proposed a 2 year email retention period. To me this seems like an incredibly short period of time for an organisation like a school given safeguarding requirements and the fact most children will there for at least 6 years in terms of education/qualifications? Understandably it's SLT's decision and call to make but the timeframe surprised me.

 

What kind of timeframe have your schools/MAT's opted for? Are there any DFE Guidelines around this? Does 2 years seem like a reasonable duration for email retention in the Education sector ?

Edited October 29, 2021 by flyinghaggis

[Boredguy]

With regards the safeguarding, our CP records for instance are not kept electronically, but rather in secured filing cabinets, and other correspondence for students that need to be kept on file can be added to most MIS systems, even as a PDF of the e-mail, so no reason to use the e-mail as a file storage system (which it's not)

[steveg]

We have ours set to 26 months for almost all staff except a few senior leaders and the HR person. We have separate systems for child protection and HR files so there should be nothing in email inboxes that is required to be kept that isn't already stored elsewhere, and 26 months lets them look up things from up to 2 years ago.

 

Steve

[GrumbleDook]

Email retention ... a tricky thing for some but simple for others.

Have a look at a few cardinal rules

 

1 - Do you need to keep the email or just something within the email?

2 - Do you have a different system for holding things like HR, safeguarding, behaviour data?

3 - Do you have the practice of deleting the email once the information is in that other system?

4 - Are there other things which need archiving (emails from exam boards, discussion groups for professional development)? Can these be dropped into particular folders?

5 - Once all this is done, then consider ROT - redundant, obselete, trivial. Can a ROT folder be created with a short life-span?

6 - Until you have a different way of storing things and people are trained on it, accept that your email will be a sorage system!

[jthompson]

I'm looking for help with email retention policies and what other schools use. We are using 365 here and as it stands we don't have any retention policies set so all email is kept and I know some staff have emails going back 15 years including emails in their deleted items which is bulging under the weight of all that kept spam.

 

What is the recommended length of time to keep emails and would this apply to all folders i.e. inbox, sent and deleted items? Finally, how long before deleting a mailbox for staff who leave the school?

 

Thanks in advance.

 

When migrating an old Exchange instance over to Gmail a few years ago, I just set the Gmail retention limit to 10 years and figured that that would exceed any specific email retention periods that might be getting configured later. It's worth having some limit in place to avoid the technical problem that you have (indefinite retention of ancient garbage), but err on the side of lengthy to keep it well above whatever might actually be needed down the line for finance, HR, etc. Going in with a short period like 2 or 3 years might mean you lose some stuff that's still needed/wanted, leaving you a bit snookered should a more detailed set of retention policies then get worked out.

[BFCIT]

We use Google and Microsoft email systems and have defined as per our data retention policy, 365 days retention. Any email that is considered important staff know to assign a 'never delete' policy which keeps it in their inbox indefinitely or they set this retention tag to a folder and move critical items into here. Safeguarding etc is primarily on CPOMS and copies of critical emails are often submitted on here too. In my view, like most things it is the initial roll out/buy in that is the most difficult aspect, it requires your users to take complete ownership of their mailbox, delete what they no longer require and evaluate what really is critical, I think we gave staff around 3 months notice before we went live with the retention rule.

 

Long email retention policies create a nightmare from a data protection perspective, a SAR requesting copies of all emails with the individuals name in could run into the 1000s and the redaction process thereafter is nasty - for this reason alone I'd recommend a lower retention period. In terms of staff/student email accounts we delete staff accounts 3 months after they have left unless they were a member of senior management which we keep for a year, student accounts are deleted a month after they are officially off roll. Staff and student leavers are routinely notified that this is the process and they are urged to make copies of their critical data to their own respective devices/cloud services.

[Planehazza]

Just jumping in here as it's an interesting. Can't help but think some of you have way to high an expectation of level of ability and caring of your staff. Some do not want to learn or change, and some will never understand 'techy stuff'. A team of four managing two schools consisting of 3000 students and 500 staff simply cannot be responsible for staff training full time.

[paulkerton]

Can't help but think some of you have way to high an expectation of level of ability and caring of your staff. Some do not want to learn or change, and some will never understand 'techy stuff'.

 

And I would argue that schools should have a higher level of expectation of ability for our staff. If people don't want to learn and change, then they should be invited to look for work elsewhere.

The idea that anyone in the private sector would be able to hold back their businesses from progressing because "I don't wanna do it" would be farcical. It should be no different in education and the public sector. A failure to learn or change is absolutely the antithesis of what we try and teach children, expecting them to become "life long learners" who can adapt to change.

[Planehazza]

And I would argue that schools should have a higher level of expectation of ability for our staff. If people don't want to learn and change, then they should be invited to look for work elsewhere.

The idea that anyone in the private sector would be able to hold back their businesses from progressing because "I don't wanna do it" would be farcical. It should be no different in education and the public sector. A failure to learn or change is absolutely the antithesis of what we try and teach children, expecting them to become "life long learners" who can adapt to change.

 

I agree, but it seems teacher workload is obscene nowadays so many simply don't have time to learn. What boils my pi55 is when I spend time implementing something that would save them several hours every week if they would spend 30 mins watching a video I've made for them or pointed them to, but refuse to because "they don't have time". The irony is not lost on me...

 

90% of the time, as you touched upon, it's change they fear, not the IT. Moving to SharePoint is different to files and folders on a network share, but if I could show them all the benefits to the user such as 'one copy for all Team members', recycle bin, retention, file version history etc. The pros far outweigh so the cons that are largely just "it's change, so I can't do it, it's too hard"

[msi_school]

The idea that anyone in the private sector would be able to hold back their businesses from progressing because "I don't wanna do it" would be farcical.

 

Schools can be hidebound but so can all types of organisation just because someone is working in the private sector does not magically make them more reasonable, /r/sysadmin has some great examples of this. I have been known to have go at teachers in specific and in general but they are no better or worse than any other profession.

 

I have problems with finance forms and can not work out the difference between a Cheque Requisition and a Purchase Request and this is probably because really I don't care this is the same for the staff when I am going on about password policies or email retention.