Legal wants to "keep emails just in case." DPO wants to "minimize." IT wants to "not saturate shared server." Result: no written rule, 50 GB mailboxes, e-discovery costing a fortune — or accidental purge of evidence.
Email retention on hosted mail — Exchange, IMAP, mail included in shared hosting, Google Workspace or suite at a host — balances sector legal obligations, GDPR minimization, and technical capacity. A "defensible" duration is one you can explain to an auditor and apply automatically — not one copied from a generic legal blog.
Classify before setting duration
One mail server holds invoices and contracts — long retention, sometimes ten years in accounting; HR and disciplinary — specific durations, restricted access; customer support — often shorter once limitation period; newsletters — days to months.
Without classification, global retention is either too long for GDPR or too short for litigation.
| Category | Approach | Typical tool |
|---|---|---|
| Current | 12–36 month retention | Quota plus purge |
| Evidentiary | Separate legal archive | WORM archive |
| Ephemeral | 90 days | Automatic rule |
"We never delete" is not a policy — it is a risk.
Make policy enforceable at the host
Shared / IMAP: quotas, purge scripts, manual export to archive if needed. Managed mail: retention policies per folder or compliance label. Cloud migration: legal hold versus automatic purge; watch local Outlook or Thunderbird copies.
Document in GDPR register: duration per category, legal basis, tool, owner. Link with Legal archiving for evidentiary flows.
Frequent mistakes
Uniform purge without upstream archiving. Shared mailboxes without owner. No export before employee departure. Host recycling server without alert — evidence loss.
Require from mail provider: mail backup, configurable retention, standard export — PST, mbox, API —, EU location if required.
The peak: absence or chaos
Decide and move forward without blind spots
Run legal plus IT workshop to produce categories, durations, and tools table, implement pilot rule this month on test mailbox, consult directory to compare mail offers, then align with IP address retention for associated logs.
Frequently asked questions
What legal duration?
Varies by content — classify before setting single global retention.
Host automatic purge?
Yes if configurable; protect flows archived elsewhere or on legal hold.
Indefinite retention?
Hard to defend under GDPR without documented legal basis per category.
Who is responsible?
You set policy; provider executes per DPA with technical proof.
A mature mail policy fits in one table — not a mailbox growing until the next panic.