Email retention policy: how long to keep staff email

The rule: no legal period for email, but a policy with standard periods

UK GDPR sets no retention period for email, or for any other kind of record. Article 5(1)(e) of UK GDPR, the storage limitation principle, says personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”, and the ICO's guidance Principle (e): Storage limitation states the consequence plainly: “The UK GDPR does not dictate how long you should keep personal data. It is up to you to justify this, based on your purposes for processing.”

The same page says what an organisation must do instead: “You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.” The duty is to decide, write the decision down and keep to it. The ICO allows that “If you are a small organisation undertaking occasional low-risk processing, you may not need a documented retention policy”, but a school, a trust, a care provider or a charity with staff is rarely in that position, and without a policy the organisation “must still regularly review the data you hold, and delete or anonymise anything you no longer need.”

The regulator has been the Information Commission since 30 September 2026, when the Data (Use and Access) Act 2025 abolished the office of the Information Commissioner; it is still known as the ICO. Its storage limitation page, as published on 1 November 2026, carries the banner “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.”

Maintained schools and academy trusts have a second set of rules, because Schedule 1 to the Freedom of Information Act 2000 makes their governing bodies and proprietors public authorities. Paragraph 2.3.1 of the Code of Practice on the management of records issued under section 46 of the Freedom of Information Act 2000 (2021) says “Authorities must define how long to keep information and dispose of it when it is no longer needed” and “must be able to explain why information is no longer held either by reference to a record of its destruction or by reference to the authority's policy.” An email retention policy is how an authority answers that for its mailboxes. Most charities and independent care providers are not public authorities, but the ICO says The National Archives' records management guidance for public authorities “can help you comply with the storage limitation principle (even if you are not a public authority)”.

The point that shapes the whole policy is that email is a format, not a type of record. One inbox holds a safeguarding concern, a supplier's invoice, a parent's complaint, a reference request and a dozen out-of-office replies, and the law attaches a retention period to each of those, not to the inbox. A policy that keeps all email for seven years keeps the trivia far too long and can delete a child protection record years before its time.

What a staff inbox holds, and how long each part is kept

Sort the mail into three kinds before choosing any number.

• Records with their own period. An email that is part of a record takes that record's period, wherever it sits. For schools in England, the Department for Education's Data protection in schools: record keeping and management lists the statutory periods: child protection files “Until the child’s 25th birthday”, or the 75th if the file relates to child sexual abuse; allegations against a member of staff, including unfounded ones, “Until the staff member’s normal retirement age, or 10 years from the date of the allegation, whichever is later”; contracts “6 years from the last payment on the contract”; admissions and attendance registers 6 years, both under regulation 7 of the School Attendance (Pupil Registration) (England) Regulations 2024, which keeps every entry in the school's admission and attendance register “for six years beginning with the day on which the entry was made”.
• Records in a charity or a care service. In England and Wales, an emailed invoice, receipt or bank confirmation can be part of the accounting records that section 131 of the Charities Act 2011 requires the trustees of a charity that is not a company to preserve “for at least 6 years from the end of the financial year of the charity in which they are made”; an exempt charity keeps its books for at least 6 years under section 136, and a charitable company keeps its accounting records under section 388 of the Companies Act 2006, which sets three years from the date they are made for a private company and six for a public one. In a care service, an email about a person's care belongs in the care record and takes its period, set out in care records retention. A staff matter in any sector takes the personnel file's period: see how long to keep employee records.
• Working copies. The email that carried a document now filed elsewhere, the copy sent to six colleagues, the reply-all. Once the record is kept where it belongs, each inbox copy is a duplicate, and paragraph 2.7.3 of the section 46 Code asks authorities to be “discouraging staff from keeping multiple or personal copies of documents”.
• Ephemeral mail. Meeting invitations, newsletters, thank-you notes and out-of-office replies. The same paragraph says “there is no need to keep ephemeral material, and this may be destroyed on a routine basis. For example, by deleting trivial emails and messages after they have been read”.

The DfE introduces its list: “The following records have statutory retention periods. You should decide how long you need to keep other records, in line with the business need of your school.” That second sentence is the honest answer to how long schools keep staff emails: the records go to the periods above, and the school sets the period for the rest. The DfE's periods apply to schools in England; the record keeping chapter was last changed on 16 September 2025.

Seven years is not a UK rule for email. The common statutory figure is six, as in section 131 and the DfE's contracts row, and seven is usually six rounded up for safety; the data retention policy guide traces where it comes from and how to build the full retention schedule an email policy sits inside.

Writing the email retention policy

The controller decides the periods: usually the governing body in a maintained school, the trust in an academy, the trustees in a charity and the registered provider in a care service. IT applies the policy in the system and the data protection officer, where there is one, advises on compliance, but neither should be choosing the retention rules. The DfE tells schools to “Share the results of your audit with your school leaders, governors and trustees. They are responsible for making sure the school is compliant with the Data Protection Act 2018 and only keeps the data it needs.”

A workable email retention policy covers eight things:

1. Records leave the mailbox. A safeguarding concern goes into the safeguarding system, a complaint into the complaints file, a contract or invoice into finance, a staff matter into the HR file and a care matter into the care record. The mailbox is where mail arrives, not where records live, and the policy says who files what and how quickly.
2. A default period for everything not filed, applied automatically. No law or regulator sets this number. Choose it, write down the reason, and keep it short enough that the mailbox does not become the archive by accident.
3. Exceptions by role. A few mailboxes, such as the headteacher's, the designated safeguarding lead's or the finance office's, may justify a longer default because more of their mail is record. Set those by role, with the reason, never by individual preference.
4. Shared and role mailboxes (the school office, admissions, a safeguarding address, the clerk to the governors or trustees): each has a named owner and the same rules, so the record survives a change of staff.
5. Personal email accounts. The ICO says “It is not usually appropriate for your staff to hold information about customers, contacts or other employees on their personal devices (eg in private email accounts, smartphones, home computers or private instant messaging applications)” and “You should have a policy which makes this clear”. Say that work is done on work accounts; FOI and personal devices covers the search when it is not.
6. Deleted items, archives and backups. Set how long the Deleted items folder, any archive and the backups keep mail, because each is still held; the ICO's subject access guidance says “You should have defined retention periods for how long you keep archived or backed-up information.” Archiving mail does not stop the clock: the longer retention UK GDPR allows is only for “public interest archiving, scientific or historical research, or statistical purposes”, and the ICO says you “should not keep data indefinitely ‘just in case’”. The ICO also says “If it is appropriate to delete personal data from a live system, you should also delete it from any back-up of the information on that system”, and paragraph 2.7.8 of the section 46 Code says deletion should be permanent, meaning “all known copies and versions of the information, including back-ups, have been destroyed or deleted”.
7. The record of destruction. The Code expects authorities to “have a destruction schedule” (2.7.4), and the DfE tells schools “You must document the destruction. Record a brief description of the data, the number of files and who authorised the destruction.” For automatic deletion, the record is the policy, its settings in the system and a dated note each time they change, which is what lets an authority explain “by reference to the authority's policy” why an email is no longer held.
8. The pause. Who can stop deletion, for which mailboxes, and when: a claim or threatened claim, a public inquiry, an allegation against a member of staff, a subject access request or an FOI request. Paragraph 2.7.2 of the Code says “Destruction policies should be sufficiently flexible to adapt to the requirements of extraordinary circumstances such as litigation or a public inquiry.”

Review the policy on a fixed cycle. The ICO says “You should also periodically review the data you hold, and erase or anonymise it when you no longer need it”, and the DfE asks schools to “check each year what data you hold and if you still need to keep it.”

In Microsoft 365 the policy is applied as a Microsoft Purview retention policy for Exchange mailboxes, which can retain mail for a period, delete it after a period, or retain it and then delete it. Each policy carries one period and one action, so one policy carries the default and a separate policy scoped to the relevant mailboxes (or a retention label) carries each exception; a mailbox can also be placed on hold to stop deletion while a claim or request is open. Microsoft's Learn about retention for Exchange notes that chat is separate: “Other items stored in a mailbox, such as Skype and Teams messages, aren't included in retention policies or labels for Exchange. These items have their own retention policies.” The Teams chat retention policy guide covers that half.

Leavers: what happens to the mailbox when someone leaves

The leaver's mailbox is where email retention most often fails, because the default is deletion. Microsoft's Learn about inactive mailboxes says “The employee's mailbox data is retained for 30 days after the account is removed. During this period, you can still recover the mailbox data by undeleting the account. After 30 days, the data is permanently removed.” A mailbox becomes an inactive mailbox, kept for the retention period, only if a retention policy or a hold covered it before the account was deleted, and “The retention settings must be configured to retain content, or retain and then delete content. If the retention action is configured to only delete content, the mailbox won't become inactive when the user account is deleted.”

So the leaver process needs three steps before the account goes:

1. the line manager and the leaver go through the mailbox during the notice period and file anything that is part of a record, above all the open safeguarding concern, the complaint still being answered and the contract still being paid;
2. IT confirms the mailbox is covered by a retention policy that keeps mail, or places it on hold if a claim, an allegation or a request is open, and only then removes the account;
3. the policy names who may open a former colleague's mailbox afterwards, for which reasons (a subject access request, an FOI request, a claim, a safeguarding enquiry) and how each access is recorded. Monitoring staff communications covers what an employer may check and what staff should be told in advance.

The leaver's own personal data is a separate question with its own answer. The ICO's storage limitation guidance gives the example: “An employer should review the personal data it holds about an employee when they leave the organisation’s employment.” Trustees and governors who use personal addresses are a different case again, covered by trustee email retention.

Subject access requests, FOI requests and deleted email

A subject access request reaches the requester's personal data in every email the organisation holds, wherever it is kept. The ICO's How do we find and retrieve the relevant information? says “You must make a reasonable and proportionate search to respond to a SAR”, and it settles three questions an email retention policy has to answer:

• Deleted items: “An email has not been deleted just because a user has moved it to their ‘Deleted items’ folder, as it’s still easily accessible in this location.”
• Archives and backups: “there is no technology exemption from the right of access”, and “you should use the same effort to find information to respond to a SAR as you would to find archived or backed-up information for your own purposes.”
• Mail genuinely deleted: “We do not require you to use time and effort reconstituting information that you have deleted as part of your general records management.”

Only the requester's information is due: “The right of access only applies to the personal information in the email that relates to the person making the SAR.” Where there is good reason to think staff hold the requester's information in private email, the ICO says the organisation “should ask them to search their private emails, devices or instant messaging applications, as appropriate”. The subject access request policy guide covers the rest of the response.

This is where a short default pays for itself. The storage limitation page reminds organisations: “Remember that you must also respond to subject access requests for any personal data you hold. This may be more difficult if you are holding old data for longer than you need.” Mail permanently deleted on schedule before any request arrived (gone from the Recoverable Items folder, where Microsoft 365 keeps it for 14 days by default after a retention policy deletes it, and from any backup) is no longer held and need not be reconstituted. The same page gives the other reasons: deleting what is no longer needed “reduces the risk that you will use such data in error”, and “it is inefficient to hold more personal data than you need, and there may be unnecessary costs associated with storage and security.”

For a maintained school or academy trust, an FOI request reaches information held in staff mailboxes in the same way. An email permanently deleted under the policy before the request arrived is not held, and the authority explains why by pointing to its policy; information not held under FOI covers the reply.

Deletion prompted by a request is a different matter, and can be a crime. Under section 77 of the Freedom of Information Act 2000, once a request has been made, the public authority and any person who is “employed by, is an officer of, or is subject to the direction of, the public authority” commits an offence if they alter, erase, destroy or conceal a record “with the intention of preventing the disclosure” of information the applicant would have been entitled to. The penalty is a fine at level 5 on the standard scale, which in England and Wales has been a fine of any amount since 12 March 2015 under section 85 of the Legal Aid, Sentencing and Punishment of Offenders Act 2012, and in England and Wales a prosecution can be brought only by the Information Commission or by or with the consent of the Director of Public Prosecutions. Section 77 applies to public authorities, not to charities or independent care providers; Scotland has its own freedom of information law.

Section 173 of the Data Protection Act 2018 applies the same rule to subject access requests and to every controller, so schools, charities and care providers alike: once a request is made, it is an offence for the controller or its staff “to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure”. Routine deletion done without that intention is no offence, and section 173(5)(a) adds a defence that protects it even if it is questioned: a person charged can show that the deletion “would have occurred in the absence of a request made in exercise of a data subject access right”. The ICO puts the same line in practical terms: routine use “may result in it being amended or deleted while you are dealing with the request”, but “it’s not acceptable to amend or delete the information if you would not otherwise have done so.”

So routine deletion may carry on, but the safer course is to pause it for whatever a request covers: place the relevant mailboxes on hold the day the request arrives, and record that you did. For a public authority, paragraph 2.3.2 of the section 46 Code lists information that “contains or relates to information requested under FOIA or the EIRs” among the reasons to keep it, and paragraph 2.7.2 asks destruction policies to adapt to “extraordinary circumstances”. An automatic deletion that runs the week after a request about the same emails is an offence only if it is done to prevent disclosure, but if it were ever questioned you would need to show it would have happened anyway, and a hold is easier to show than a defence.

The conversations that never reach the mailbox

An email retention policy governs one system: the organisation's own mail. Much of what used to be email no longer arrives there. The parent who once wrote to the school office now texts the teacher whose number she has. The deputy manager of a care home sorts out a resident's weekend in a staff group chat. A trustee approves a payment with a thumbs-up in a group on a personal phone. Each is the kind of message the policy would have filed or deleted on schedule, and none of them is in a mailbox the policy reaches.

For a school or trust, that leaves the gap the section 46 Code describes: an authority “must be able to explain why information is no longer held”, by its destruction record or by its policy, and for messages on personal phones it can do neither. For every controller, the ICO's subject access guidance means it may still have to ask staff to search those phones. The retention policy is only as complete as the systems it reaches.

ComplyChat is designed to bring those conversations inside the organisation's control. Staff, and parents, families or volunteers added by their mobile number, talk in channels the organisation runs; a mobile number verified by SMS is an identity, so nobody needs an account on the organisation's systems; and everyone added is told the channel is on the record and can object or leave. On paid plans, once the organisation's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription, the same place its email retention policy already works. ComplyChat is not an email archive and does not capture email or WhatsApp; it replaces the group chat, and the mailbox still needs its own policy.

A question for the next leadership or board meeting: which of last term's decisions sit in a mailbox your email retention policy reaches, and which sit on someone's phone?

Questions people ask

What is the recommended email retention policy?

There is no recommended or statutory period for email in the UK: the ICO says “The UK GDPR does not dictate how long you should keep personal data”, but that you need “a policy setting standard retention periods wherever possible”. A sound email retention policy sets periods by what each email records, an automatic default for routine mail, rules for leavers' mailboxes and backups, and a pause when a claim or request arrives; the section 46 Code says trivial emails may be deleted “after they have been read”.

What is the 7 year retention policy?

Seven years is a convention, not a UK legal rule. The common statutory figure is six: the trustees of a charity in England and Wales that is not a company must keep accounting records “for at least 6 years from the end of the financial year” in which they are made (a charitable company follows the Companies Act 2006), and the DfE's schedule for schools in England keeps contracts 6 years from the last payment. An email that forms part of such a record takes that record's period.

How long should a school keep staff emails?

As long as the record each email belongs to. The DfE's guidance for schools in England lists statutory periods by record type, including child protection files to the child's 25th birthday, allegations against staff to normal retirement age or 10 years, whichever is later, and contracts 6 years from the last payment, and says “You should decide how long you need to keep other records, in line with the business need of your school.” The routine mail left over takes the default the school sets in its policy.

Do deleted emails have to be searched for a subject access request?

Emails in a Deleted items folder do: the ICO says “An email has not been deleted just because a user has moved it to their ‘Deleted items’ folder”. The ICO will not expect extreme measures to recreate information genuinely deleted under records management, but it says you should search archives and backups with the same effort you would use to find them for your own purposes.

What happens to a leaver's mailbox?

In Microsoft 365, a removed account's mailbox data is kept for 30 days and then permanently removed, unless a retention policy that retains mail (or retains and then deletes it), or a hold, covered it first; then it becomes an inactive mailbox kept for the retention period. The policy should say who reviews a leaver's mailbox and files its records before the account goes, and who may open it afterwards.

Can we delete emails once an FOI request or SAR has arrived?

Routine deletion under the policy can continue, but deleting, altering or concealing a record to stop it being disclosed is a criminal offence: section 77 of the Freedom of Information Act 2000 for FOI requests to public authorities, and section 173 of the Data Protection Act 2018 for subject access requests to any controller. Section 173 gives a defence where the deletion “would have occurred in the absence of” the request, and the ICO accepts that routine use may amend or delete information during a request. The safest course is to pause deletion of the material the request covers.

Official guidance and your next step

The rules are in Article 5(1)(e) of UK GDPR, section 173 of the Data Protection Act 2018, section 77 of the Freedom of Information Act 2000 and section 131 of the Charities Act 2011. The ICO's Principle (e): Storage limitation and How do we find and retrieve the relevant information? are the regulator's guidance; the storage limitation page is marked as under review after the Data (Use and Access) Act 2025. For schools in England, the DfE's record keeping and management chapter of Data protection in schools sets the statutory periods, and public authorities have the Code of Practice on the management of records (2021). Microsoft's inactive mailboxes and retention for Exchange pages describe product behaviour, which is Microsoft's, not the law. The two council replies quoted in section 04 are from WhatDoTheyKnow, as captured, classified and verified for our evidence pack on 29 October 2026; each is that council's reply on its date, not a statement of its current policy. Other quotations are from the pages named as published on 1 November 2026.

This guide covers the UK, with the DfE's periods for schools in England and the Charities Act rule for England and Wales, and is not legal advice. The periods for a care provider's own records are in care records retention, and the pupil record periods in how long schools keep pupil records.

Then do one thing: open the retention settings for your staff mailboxes and write down what they do today – the default period, what happens to Deleted items, how long backups keep mail, and what happens to a leaver's account on the day it is removed. If nobody can answer one of those, that is the first line of your email retention policy.