This is practical guidance, not legal advice. Regulated businesses should check the rules of their regulator or professional body.
Why “keep everything forever” is the wrong answer
It is tempting to keep every email indefinitely, just in case. Two things push the other way. UK GDPR’s storage limitation principle requires that personal data is kept no longer than necessary for the purpose it was collected for, and every extra year of mail is more personal data to secure, search for subject access requests, and lose in a breach. And a mailbox that holds a decade of everything makes it harder, not easier, to find what you need in a dispute.
The answer is a retention policy: decide how long each kind of information needs keeping, then let your mail system enforce it.
The UK periods that matter for most businesses
| Information | Keep for | Why |
|---|---|---|
| Company and accounting records (limited companies) | 6 years from the end of the financial year | HMRC — longer in some cases, such as assets lasting over 6 years or a late return |
| VAT records | 6 years | HMRC VAT record-keeping rules |
| Payroll records | 3 years from the end of the tax year | HMRC PAYE rules |
| Self-employed records | At least 5 years after the 31 January return deadline | HMRC Self Assessment |
| Contracts and related correspondence | 6 years after the contract ends (12 for deeds) | Limitation Act 1980 claim periods |
| Personal data generally | No longer than necessary | UK GDPR storage limitation |
If an email is an invoice, an order confirmation or an agreement, it takes on that record’s retention period. A lunch arrangement does not need keeping for six years.
Regulated sectors have their own rules
Solicitors, financial services firms, accountants, healthcare and care providers often have longer or more specific requirements from their regulator or professional body — file retention for legal matters, for example, or records relating to patients and clients. Take those from your regulator’s guidance; they usually override the general periods above.
Turning it into a policy
- List the categories of information that arrive by email: client correspondence, invoices and orders, HR, marketing, general.
- Give each a retention period using the table above and any regulatory rules.
- Decide what happens at the end — deletion, or moving to an archive with a longer limit.
- Write it down in a short policy staff can follow, and reference it in your privacy notice.
- Let the system enforce it rather than relying on people tidying their inboxes.
How Exchange enforces retention
Exchange has the tools built in:
- Retention tags and policies automatically archive or delete mail after a set period, by folder or for the whole mailbox.
- Archive mailboxes move older mail out of the main mailbox so Outlook stays fast, while keeping it searchable.
- Litigation hold preserves everything in a mailbox, including deleted items, when a dispute or investigation is expected.
- Journaling keeps an independent copy of every message for organisations that must prove nothing was altered.
On MyExchangeServer, retention policies and litigation hold are included and managed in the SolidCP control panel; archive mailboxes and journaling are optional add-ons on our price list.
Archive is not the same as backup
An archive is for keeping mail you need for a long time, searchable by users. A backup is for recovering from loss or corruption, usually kept for weeks rather than years. You need both, and one does not replace the other — our answer page on email archive vs backup explains the difference.