Email Retention Policy Examples

Data Retention and Archiving

As companies increase their dependency on emails for daily communications, more and more of them are asking questions about how to handle this data avalanche.

• How long must they retain emails?
• What should they do with emails when they are no longer required for daily business operations?
• Can emails that are no longer needed be destroyed or must they be archived for long-term retention?

As a managed service provider (MSP), you can answer these questions — and profit from them — by adding email retention services to your collection of client offerings.

Why Do Clients Need Email Retention?

There is a myriad of reasons why clients should — and are often required to — retain emails.

Personnel, human relations and other departments that engage with company employees work with an enormous amount of documents containing sensitive data. Email data in this case can include resumes, employment applications, reference checks, payroll information, drug tests, performance reviews and more.

Because many of these records contain personal identification information, they are subject to a variety of federal and state regulations. Each of these laws and regulations requires records containing personal information to be retained for a specified period of time — many times after the employee leaves the company.

Some examples of additional regulations that will influence an organization's internal email retention policy include:

• Gramm-Leach-Bliley Act
  Affects the email and data retention policies financial institutions follow to protect sensitive consumer data
   
• Health Insurance Portability and Accountability Act (HIPAA)
  Protects the privacy of patient health information, including information that is shared via email
   
• Payment Card Industry Data Security Standard (PCI DSS)
  Requires "all entities that store, process, and/or transmit cardholder data" to maintain secure data retention according to technical and operational guidelines

Beyond these regulations, organizations are encouraged to retain employee records in the event they should face future litigation.

Companies that comply with federal or state regulation are subject to periodic audits and investigations that may require them to produce emails. A company that is unable to comply with such requests can be deemed as non-compliant and become vulnerable to litigation and penalties.

Email Retention Policy Examples by Industry

Most laws require companies to retain their email from three to seven years. However, best practices recommend consultations with legal experts to determine retention periods. Such consultations should also cover whether an organization must comply with more than one regulation. For example, a hospital might have to adhere to OSHA in its medical facility, HIPAA in its medical records department and Sarbanes-Oxley (SOX) in its finance department.

The following table summarizes certain industries and the corresponding regulation and data retention period.

A Compelling Reason for Automated Email Retention

When it comes to retaining emails, companies are faced with the dilemma of whether to handle this requirement manually or automatically.

Adopting a manual email retention policy puts the burden of email retention on users. While this approach may be easy to implement, it is problematic and fraught with holes that become apparent when companies attempt to retrieve critical information. Leaving email retention to employees also reduces productivity by taking employees away from their core job responsibilities.

A better approach for your clients is to adopt an automatic email retention policy using a proven solution. Storing archived email at a central site mitigates the loss of emails that employees delete, either inadvertently or intentionally. IT staff also aren't forced to search to hunt down an important message when it's needed for legal reasons or for an audit.

Email Retention With SolarWinds Mail Assure From SolarWinds MSP (Formerly LOGICnow)

SolarWinds Mail Assure from SolarWinds MSP allows MSPs to support their clients with an email retention tool that conforms to their retention policy. SolarWinds Mail Assure offers industry-leading indexing and searching capabilities that makes it much easier for users to find emails any time they're needed. This can also be done in bulk using date tagging, and retained emails can be exported or forwarded out of the archive securely and with a detailed process log.

Some examples of the email retention features of SolarWinds Mail Assure include:

• Stores archived email in the cloud and backs it up across geographically distributed data centers in North America and Europe
• Data centers meet SSAE or ISO regulations while delivering an impressive 99.999% uptime
• Ensures bullet-proof security by encrypting all email being sent, received and retained in the archive
• All archived email is compressed during archiving and electronically sealed with a checksum to verify its authenticity and aid legal team in establishing the integrity of messages
• Platform-agnostic and compatible with all on-premises and cloud-based email infrastructures including Microsoft Office 365 and Google Apps
• Archived messages can be accessed directly from Microsoft Outlook via a custom plugin
• Existing emails can be imported to SolarWinds Mail Assure’s archives quickly and easily
• Supports Microsoft Exchange’s Personal Storage Table (PST) file-storage format as well as mbox and EML formats

Improve Your Client's Retention Practices

If your clients face litigation or compliance issues and immediately need specific email communications and attachments, would you be able to support them? Can you narrow searches to a specific range of dates and then pinpoint the records associated with the matter at hand?

SolarWinds Mail Assure allows you to deliver the industry’s most robust archiving and searching solutions. SolarWinds Mail Assure can be used with other data-protection solutions from SolarWinds MSP to enrich your product offerings and offer clients a layered approach to their IT security requirements.

To experience for yourself these examples of how SolarWinds Mail Assure supports any email retention policy, start your free trial today.

For more information, contact SolarWinds MSP.

----------
Sources:

Radicati Group: www.radicati.com/wp/wp-content

FTC: www.ftc.gov/tips-advice/business-center/privacy-and-security/gramm-leach-bliley-act