Most businesses keep email far longer than they need to, or not long enough for the records that actually matter. The result is either bloated archives that create discovery liability, or gaps that surface when a dispute arises and the relevant emails are already gone.
This guide covers what US law and major industry regulations actually require, how to think about email retention by category, and what a workable retention policy looks like in practice. It’s not legal advice — if your organization has specific regulatory requirements, work with counsel to confirm your obligations. But it will give you a solid foundation for understanding the landscape.
The Default Rule: Statutes of Limitations
In the absence of a specific regulatory requirement, the practical floor for business email retention is the applicable statute of limitations for contract and business disputes. If someone might sue you over something discussed in an email, you need that email for as long as you could be sued.
Statutes of limitations vary by state and claim type, but general guidelines for US businesses:
- Contract disputes: 3–6 years in most states, up to 10 years for written contracts in some jurisdictions
- Tort claims (fraud, negligence, etc.): 2–6 years, depending on state and when the claim was discovered
- Federal employment claims (EEOC charges): 180–300 days to file a charge; related litigation can extend further
- Tax-related records: 3 years in most cases (IRS audit window), 6 years if there’s a substantial understatement of income, 7 years for fraud
A common baseline for routine business email is 3–7 years, which covers most statutory limitations periods. Emails related to ongoing contracts or pending matters should be retained until the matter is fully resolved plus the relevant limitations period.
Industry-Specific Requirements
Several industries have regulatory email retention requirements that supersede the general rule.
Financial services (SEC, FINRA, CFTC)
Financial services is the most heavily regulated industry for email retention. Key rules:
- SEC Rule 17a-4: Broker-dealers must retain business-related electronic records, including emails, for a minimum of 3 years. Communications related to order tickets must be retained for 3 years; other records for 6 years.
- FINRA rules: Member firms must retain correspondence and internal communications for 3 years. Written supervisory procedures related to email review must be maintained for 3 years after the procedure is terminated.
- CFTC Regulation 1.31: Commodity pool operators and trading advisors must retain business records for 5 years.
- Investment advisers (SEC Advisers Act Rule 204-2): Registered investment advisers must keep communications with clients or relating to advice given for 5 years.
Financial services firms also have strict requirements about how email records are stored — immutable, non-rewritable, searchable, and auditable. A personal email account or a standard mailbox that can be edited doesn’t satisfy these requirements.
Healthcare (HIPAA)
HIPAA doesn’t specify an email retention period directly, but it requires covered entities to retain medical records for 6 years from creation or last use (for adults; longer for minors in some states). More relevantly, HIPAA’s Security Rule requires retention of policies, procedures, and documentation related to security measures for 6 years.
Business Associate Agreements (BAAs) — often negotiated via email — should be retained for 6 years. Emails that document patient care decisions or that contain Protected Health Information (PHI) may need to be retained according to state medical records laws, which often run 7–10 years.
Government contractors (FAR)
Federal Acquisition Regulation (FAR) 4.703 requires contractors to retain records related to government contracts for 3 years after final payment, or until completion of any audit, litigation, or claim — whichever is later. For contracts over $2 million that required certified cost or pricing data, records must be retained for 3 years after final payment.
Public companies (Sarbanes-Oxley)
SOX Section 802 makes it a crime to destroy or alter documents in contemplation of a federal investigation or bankruptcy proceeding. The practical implication: emails related to financial reporting, auditing, or accounting must be retained for 7 years. SOX also requires audit-related records to be retained for 5 years by the auditing firm, and 7 years by the company.
Legal holds
Regardless of your general retention policy, if your organization reasonably anticipates litigation, it has a legal hold obligation. Once litigation is reasonably anticipated, you must preserve all potentially relevant evidence — including email — until the matter resolves. Destroying records subject to a legal hold can result in sanctions for spoliation.
Thinking About Email by Category
Not all email has the same retention value. A reasonable email retention policy categorizes email and applies appropriate retention periods to each category rather than treating all email the same.
Transactional correspondence
Emails documenting business transactions — contracts, purchase orders, invoices, payment confirmations, delivery records. These are business records in the traditional sense and should be retained through the applicable limitations period for contract disputes (5–7 years is common).
Project and client communication
Emails documenting work performed, decisions made, scope changes, and client approvals. Retain through the project completion date plus the applicable limitations period. For professional services firms, this correspondence often represents the primary record of what was agreed to.
HR and employment correspondence
Emails related to hiring, performance reviews, disciplinary actions, terminations, and accommodation requests. EEOC guidelines and state employment laws create retention requirements that often run 1–4 years from the relevant employment action. For terminated employees, retain records for at least the applicable limitations period for employment claims in your state.
Financial and accounting correspondence
Emails related to financial reporting, auditing, tax matters, and accounting decisions. 7 years is the common benchmark, driven by IRS audit windows and SOX requirements for public companies.
General internal communication
Routine internal email — meeting scheduling, coordination, general updates — has little long-term evidentiary value in most organizations. Many retention policies apply a shorter period (1–3 years) to this category, or leave deletion to employee discretion after a defined period. The risk with a short retention period for general email is that some messages that look routine turn out to be relevant when a dispute arises. Balance this against the cost of retaining everything indefinitely.
How to Archive Email for Retention Compliance
Retention compliance isn’t just about keeping emails — it’s about keeping them in a way that makes them accessible, unaltered, and producible if needed.
Archiving in native format
The most defensible approach to email archiving is preserving emails in their native formats — MSG files for Outlook, EML files for other systems. Native files preserve all metadata in its original form and can be subjected to forensic analysis if authenticity is challenged.
Most email archiving platforms (Barracuda, Mimecast, Proofpoint, Microsoft 365 compliance archiving, Google Vault) capture email in native or near-native format automatically. If you’re using one of these platforms, the technical aspects of retention and format are handled for you — your policy decisions are about what categories to retain and for how long.
Archiving as PDF
For smaller organizations or specific use cases, converting emails to PDF for archiving is a common approach. PDF is universally readable, doesn’t require email client software to view, and is a well-understood format for document retention. The downside is that PDFs aren’t as easily searched programmatically as native email files, and some metadata is lost in conversion.
If you’re archiving to PDF, use a purpose-built email converter that preserves all headers including BCC — not print-to-PDF or a generic file converter. The MSG to PDF converter and EML to PDF converter both produce output that includes the full header block, making the PDFs useful as records even years later. For converting large volumes of email for archival purposes, the bulk converter processes multiple files at once.
Immutability
For regulated industries, archived email must be immutable — it can’t be altered or deleted before the retention period expires. This is a technical requirement, not just a policy one. Standard mailboxes don’t provide immutability. Dedicated archiving platforms do, typically by writing email to write-once storage or maintaining a cryptographic audit trail.
Email archiving vs. backup: These are different things. An email backup is a point-in-time copy for disaster recovery. An email archive is an indexed, searchable, immutable record for compliance and legal purposes. Backup systems typically overwrite older backups as new ones are created; archives retain records for the specified period regardless of other changes. Don’t rely on backups for retention compliance.
Disposition: Deleting Email After Retention Periods
A retention policy isn’t just about keeping records — it’s also about deleting them appropriately when they’re no longer needed. Retaining records beyond their applicable retention period creates unnecessary discovery liability. If records exist, they may be discoverable in litigation even if they’re old.
A defensible disposition process:
- The retention period for a record category is defined in the policy
- Records are flagged for review when they reach the end of their retention period
- A designated records manager reviews flagged records to confirm no legal hold applies
- Records not subject to a hold are deleted according to a documented disposition process
- The disposition is logged — what was deleted, when, and who authorized it
The key point is that disposition is a deliberate, documented process — not employees deleting email ad hoc. Routine, policy-driven deletion is defensible in litigation. Selective deletion in response to a dispute or investigation is spoliation.
Building a Practical Email Retention Policy
An email retention policy should be short enough that people will actually read it, specific enough to be useful, and flexible enough to accommodate legal holds. Key elements:
- Scope: What email systems and accounts does this policy cover?
- Categories and retention periods: The categories above, with specific retention periods for your organization’s context
- Legal hold process: How legal holds are triggered, who manages them, and how they override normal retention periods
- Archiving method: Where email is archived, in what format, with what access controls
- Disposition process: How email is reviewed and deleted at end of retention period
- Responsibility: Who owns the policy and who employees contact with questions
The policy should be approved by legal counsel and senior management, distributed to all employees, and reviewed periodically — at minimum when regulations change or when litigation reveals gaps.
What to Do With Email From Departed Employees
Employee departures create email retention complications. The departed employee’s mailbox contains business records that may still be needed — but the mailbox needs to be managed and eventually decommissioned.
Standard practice: when an employee leaves, their mailbox is placed on a retention hold for a defined period (often 90 days to 1 year) to allow the organization to review and preserve relevant business records. Important correspondence should be forwarded to relevant colleagues or archived according to the retention policy. The mailbox can then be decommissioned, but archived records remain available for the applicable retention periods.
Check your email archiving system — most enterprise platforms handle departed employee mailboxes automatically, continuing to retain email subject to the policy even after the mailbox is closed. If you don’t have a platform and are relying on manual export, this is a step that’s easy to miss when someone leaves quickly. The legal and compliance guide covers some of the production considerations for mailbox data.
Quick Reference: Common Retention Periods
- General business correspondence: 3–7 years (follow applicable SOL)
- Financial records and accounting-related email: 7 years
- HR and employment records: 3–7 years depending on claim type and state
- Government contract records: 3 years after final payment
- Broker-dealer communications (SEC 17a-4): 3–6 years depending on record type
- HIPAA-related documentation: 6 years from creation or last use
- Tax records: 7 years (IRS audit window plus buffer)
- Legal hold records: Until the hold is lifted
Review these with counsel for your specific jurisdiction and industry. State laws often impose requirements beyond federal minimums, and industry-specific regulations change periodically.
Need to archive business emails as PDF for compliance or recordkeeping? Convert MSG and EML files to complete, properly formatted PDFs — individually or in bulk.Archive Email as PDF →