10 Steps to a Sanction-Proof Email Retention Policy

In order to address growing e-discovery, compliance and knowledge management requirements, organizations must retain a greater number of emails than ever before. Yet with such a large percentage of internal and external business communications performed via email, this is becoming an increasingly difficult task, one with which many struggle to keep pace. Additionally, as the volumes of messages requiring retention grow, so too, do the related storage, retrieval and administrative costs. To address these challenges and prepare for litigation and compliance reviews, enterprises need a standardized, policy-based email retention system that ensures all relevant messages are stored safely and in accordance with any pertinent industry laws and governing bodies.

Developing a well-planned, enterprise-wide email retention policy helps establish uniform and consistent rules for all email and electronic records. Such a policy outlines email content, sets retention and deletion criteria and provides the flexibility to accommodate litigation holds and enable role-based user access. Leveraging a robust information governance solution also helps simplify the management of this process. The ideal solution should automate retention policy enforcement and task documentation, while providing an archiving and retrieval engine that streamlines an organization’s ability to locate messages for audits, litigation and e-discovery in a timely and cost-effective manner.  By doing so, organizations can reduce e-discovery costs, improve regulatory compliance, enhance data access, reduce the risk of litigation and improve IT performance without increasing costs.

To make email management procedures a cost-effective business asset, enterprises need to develop, actively enforce and audit comprehensive retention guidelines. These rules should specify consistent, enterprise-wide data archive windows and define permissions for who can access, change or delete messages, attachments and other records. To this end, organizations should guide themselves through the process of developing, implementing, monitoring and auditing a comprehensive email retention policy using the following 10 steps.

In order to fully understand its retention obligations, an organization must first have a clear understanding of the types of content it transmits electronically. To provide this insight, the email retention policy should specify:

• Document types that employees can send via email, as well as the specific files, such as sensitive business contracts, that must be transmitted using a different method.
• Content guidelines defining what should or should not go into emails, including policies around what constitutes sexual harassment or other unacceptable language.
• Enforcement measures and best practices that automatically scan for policy violations and designate an internal authority to periodically review content.

Without formal archiving guidelines and an automated system to manage the process, employees often save old messages and attachments on local storage systems, such as a PC hard drive. This lack of standardization makes tracking and protecting archived messages problematic. For example, a judge can request messages saved on personal archives during litigation and e-discovery. But if an employee saves these on a hard drive, which then fails, the information is lost and the enterprise becomes vulnerable to legal and regulatory penalties around the spoliation of data.

Moreover, locating the necessary data on all local hard drives throughout a large organization is a difficult, time-consuming and expensive process that often fails to discover every message saved on a nonstandardized source. To avoid the possibility of missing a message, email retention policies should include specific, centralized archiving methods that prohibit employees from saving messages in personal folders.

Even though a formal email retention policy may be defined and in place, many employees may remain unaware that such guidelines exist. To ensure that archiving rules are followed across the enterprise, all employees must be trained on the policy and able to demonstrate that they understand content and storage procedures, as well as any rules restricting the use of personal folders. Moreover, education should:

• Detail the reasons why these rules are in place,
• Offer instructions for using any supporting archiving technology and
• Outline the consequences of noncompliance at both a business and personal level.

It is critical that all email retention policies incorporate the requirements of the mandates governing the industry in which an organization operates. There are many common regulations to consider:

• Sarbanes-Oxley regulations apply to public companies across all industries and impose severe penalties on any business that deliberately alters or deletes documents in order to defraud customers or other third parties. To comply with SOX guidelines, companies must retain auditable emails for a minimum of five years from the end of their last fiscal year.
• FINRA rules demand that financial services firms establish formal, written policies and procedures that detail their email retention policies. After outlining these policies, a business must then demonstrate that all retention processes are in full compliance with FINRA guidelines.
• HIPAA regulations apply to any email message or other electronic records that contain sensitive information about an individual’s medical history. The preservation period for a medical record is a minimum of five years, though some related statutes dictate that certain information be retained for the life of the patient. 

Although many regulations exist beyond the three listed above, all regulatory bodies — regardless of industry — make meeting the following requirements a key aspect of compliance:

• Data permanence, where data must be in its original state without being altered or deleted.
• Data security, where all retained information must be protected against security threats, including access by unauthorized persons and any outside forces that could physically damage or endanger the availability of archived messages.
• Availability, where organizations must prove that all emails subject to the retention policy can be easily accessed by authorized personnel in a timely manner.

Specific organizational roles have unique archiving requirements, which must be captured in the larger retention policy. For example, brokers at financial services firms are obligated to keep all of their electronic correspondence for up to six years. Likewise, in pharmaceutical companies, scientists or physicians who perform drug tests must keep test-related emails on hand for even longer, as these may contain highly sensitive information that can be requested as evidence in e-discovery. Finally, it is common practice in most enterprises to save the emails of CEOs indefinitely, even after their tenures have ended.