Keeping staff leavers mailboxes

[Theldron]

Hi,

 

Hope you are well.

 

Just trying to find out if there is a maximum time you can keep former staff mailboxes for?

 

I have read in a few places it is 1-3 months, depending on their role.

 

Thanks

[Dos_Box]

This article suggest a 12 month period for the UK - https://www.n-able.com/blog/your-guide-to-email-archiving-under-uk-law

[Boredguy]

This article suggest a 12 month period for the UK - https://www.n-able.com/blog/your-guide-to-email-archiving-under-uk-law

 

Erm that only for the communications sector though not education.

[Dos_Box]

A quick look around for UK school retention policies brings up this (again, 12 months for accounts meeting certain criteria, on page 7) - Link

Hope it helps.

 

ETA - It's a PDF download.

Edited November 9, 2021 by Dos_Box

[Theldron]

A quick look around for UK school retention policies brings up this (again, 12 months for accounts meeting certain criteria, on page 7) - Link

Hope it helps.

 

ETA - It's a PDF download.

 

Hi, thanks for that. But isn't that for live accounts, rather than for staff that have left the school?

[CHiLL]

If it's a regular mailbox, I believe it's 90 days before it's removed. However, if you convert it to a shared mailbox upon their account deactivation date, it will stay indefinitely. We still have archived mailboxes dating to 2016, when we switched to Office 365.

[Boredguy]

That just appears to the policy for that MAT. It's certainly not been raised by either of our 2 external DPO's as important e-mails like that should be stored elsewhere other than in the mailbox.

 

We normally remove accounts once staff have left, and it's available for a further 90 days in 365 if we need to restore it.

[pete]

Typically there's a minimum determined by organisational (retention & destruction policy) or legal (financial records) requirements. Plus the "don't take the mickey" factor (a judge can decide your retention window is too short, even if it is company policy).

 

If it's not covered on the retention and destruction policy, then ask for it (plus backup retention, internet access logs, homedir retention, safeguarding (SW monitor/myconcern/etc) logs, print logs with document names, CCTV and phone recordings) to be added.

 

Here, mailbox contents are retained for up to 6 months after leaving (mailboxes have a rolling legal hold of 180 days).