Email Retention Period / Policy

[timbo343]

We are reviewing our email retention policies and would like to get a feel for what other schools / trusts do in terms of how long you allow staff to keep emails in their inboxes / folders / sent items along with their deleted items.

 

We have a policy that deletes emails from user's deleted items after 30 days but need to expand on this.

[EssentialRug]

We previously had our email retention set at 3 years, but upon a review with our DPO it was suggested we move this to 1 year. May provoke a few users into working differently but I definitely think 1 year or less should be standard.

[TechMonkey]

30 days seems harsh, 13/14 months would allow people to look back at this time last year for events. Though sitting on the fence, email shouldn't be a storage medium so they should get things out of email and into proper documents or process sheets.

 

EDIT: Sorry, just read your post properly and seen the 30 days is for deleted items. That seems sensible.

Edited March 10, 2023 by TechMonkey

[3s-gtech]

We moved to 6 months for Inbox. Untouched elsewhere currently.

 

This doesn’t hit all DP and SAR scenarios of course, and there was initial fury! This was with the backing of the head. Deleted items were recoverable.

 

Now everyone is used to it, and OWA has that handy little tooltip at the too, it’s a very useful strategy. Only downside - if someone is a bit clueless and sets up folders for retention actually within their Inbox, guess what happens to emails in those folders?

[TechMonkey]

Only downside - if someone is a bit clueless and sets up folders for retention actually within their Inbox, guess what happens to emails in those folders?

 

I'm guessing bye bye emails? That leads to a question actually. If a user has an Archive mailbox and move emails to that, are they exempt from the retention policy?

[timbo343]

Thank you for your replies, if anyone else has implemented retention rules, please let me know.

 

We use Google for our emails and obviously have Google Vault and we backup our Google Apps to a cloud provider too.

[3s-gtech]

I'm guessing bye bye emails? That leads to a question actually. If a user has an Archive mailbox and move emails to that, are they exempt from the retention policy?

 

Yes. That’s managed in the policy independently IIRC.

[EssentialRug]

We moved to 6 months for Inbox. Untouched elsewhere currently.

 

This doesn’t hit all DP and SAR scenarios of course, and there was initial fury! This was with the backing of the head. Deleted items were recoverable.

 

Now everyone is used to it, and OWA has that handy little tooltip at the too, it’s a very useful strategy. Only downside - if someone is a bit clueless and sets up folders for retention actually within their Inbox, guess what happens to emails in those folders?

 

Our DPO said 6 months would be the ideal retention. Would love that, but not sure I could get it approved here!

[3s-gtech]

It’s like ripping off a plaster. Brief flash of pain, then it can heal up nicely…

 

Or fester and get infected if you get an SAR and you forgot about Sent Items!

[GrumbleDook]

Simple rule of thumb, if the information is held elsewhere, e.g. has been put into CPOMS/MyConcern or you MIS, then that email should be deleted. Anything deleted can go with in 30 days ... that seems like a resonable approach. I've worked in a place where it was 7 days. That was fun!

[enjay]

Let's be realistic here, teachers are hoarders. Is setting a short retention period just making people archive their emails out to a location you can't access centrally in the event of an SAR?

[TechMonkey]

Sudden thought, with email retention what do you do with CYA emails? Is it a case of file them away?

[GrumbleDook]

Sudden thought, with email retention what do you do with CYA emails? Is it a case of file them away?

 

CYA should be recorded in the relevant system. If there is no other system (CPOMS, MyConcer, MIS, etc.) then a structured approach in your mailbox can be made to work, but that is not a free hand to save everything.

[kennysarmy]

We previously had our email retention set at 3 years, but upon a review with our DPO it was suggested we move this to 1 year. May provoke a few users into working differently but I definitely think 1 year or less should be standard.

 

We currently have no retention policies and everything is kept until...

 

SMT discussing having a value of 14 months for retention.

 

Any good online guides as I'll potentially need to set this up just for the teaching staff?

[pete]

Remember that an email retention isn't terribly effective for SAR purposes if someone's using Power Automate to save attachments to OneDrive.

 

*grumbles about a finance system that doesn't allow budget holders to search earlier than current financial year*

[Boredguy]

We have 1 Year retention for virtually all staff.

Incumbent staff in Finance/Pastoral/PA were granted 3 years, with the 3rd year being an Online Archive in our 365 Tenancy, but when those staff are replaced the new starters only get 1 year.

 

Was a bit of shock to staff when it first happened as some had 14 years worth of mail with passwords to sites etc, but they quickly got over the issue.

[enjay]

Was a bit of shock to staff when it first happened ... but they quickly got over the issue.

 

Or they moved their emails to an archive PST folder in their MyDocs folder....

[DrCheese]

Or they moved their emails to an archive PST folder in their MyDocs folder....

 

You can stop the creation of PST files in GPO.

 

We're moving to a 1-year retention policy shortly following ratification by governors.

Was partly bought on by some massive SARs that if we didn't have the data in the first place, we wouldn't have been able to do - Also of course we're only supposed to keep data on people for as short as time as it's needed.

 

I have had some pushback from staff & I admit it'll bug me as I've referred back to older emails in the past but it's a nessaca

[kennysarmy]

You can stop the creation of PST files in GPO.

 

We're moving to a 1-year retention policy shortly following ratification by governors.

Was partly bought on by some massive SARs that if we didn't have the data in the first place, we wouldn't have been able to do - Also of course we're only supposed to keep data on people for as short as time as it's needed.

 

I have had some pushback from staff & I admit it'll bug me as I've referred back to older emails in the past but it's a nessaca

 

Surely there is a big difference between admin staff who keep emails about orders and operational stuff and teaching staff who keep data on students?

[PotNoodleTech]

You can stop the creation of PST files in GPO.

 

We're moving to a 1-year retention policy shortly following ratification by governors.

Was partly bought on by some massive SARs that if we didn't have the data in the first place, we wouldn't have been able to do - Also of course we're only supposed to keep data on people for as short as time as it's needed.

 

I have had some pushback from staff & I admit it'll bug me as I've referred back to older emails in the past but it's a nessaca

 

This is a really interesting thread. Clearly we are only supposeed to retain information whilst it is relavent and if it is reasonable.

 

How would you cope with an official investigation for example into professional standards or the like if your deleting everything within one year? I've been involved in investigations in the past where the school had to go back several years in order to literally prove someone innocent and save their job/career, which was successful. If all that email evidence was not there 12 months on then things could be very different for that person.

 

Is that it now - we say sorry mate GDPR has made us incapable of proving any form of wrongdoing or wrightdoing?

[DrCheese]

Surely there is a big difference between admin staff who keep emails about orders and operational stuff and teaching staff who keep data on students?

 

Yes, but we all hold information about students or staff at some level - Be that full school emails or just emails copied into a group. It's far far simpler to just apply a blanket policy

[kennysarmy]

So SMT have decided that our email retention policy needs to be:

 

All teaching and most staff 14 months

Specific staff with job roles away from "teaching and learning" - 3 years.

 

Any good guides on how to achieve this with Office 365?

 

Cheers

[DalekSec]

So SMT have decided that our email retention policy needs to be:

 

All teaching and most staff 14 months

Specific staff with job roles away from "teaching and learning" - 3 years.

 

Any good guides on how to achieve this with Office 365?

 

Cheers

 

 

https://compliance.microsoft.com/ > Data Lifecycle Management > Retention Polices.

 

Pretty much self explanatory.

[kennysarmy]

Test policy seems to work however Deleted Items folder was unaffected and still retains many old emails.

 

Is this folder not affected by Email retention policy? Odd.

[DrCheese]

Test policy seems to work however Deleted Items folder was unaffected and still retains many old emails.

 

Is this folder not affected by Email retention policy? Odd.

 

It is, but the policy takes time to apply everywhere. It took about a week to properly kick in on everything here.