How long business email must be kept, and who may see it

The consumer privacy ombudsman may appear and be heard at such hearing and shall provide to the court information to assist the court in its consideration of the facts, circumstances, and conditions of the proposed sale or lease of personally identifiable information under section 363(b)(1)(B). 11 U.S. Code § 332, consumer privacy ombudsman (Cornell LII)

then the trustee may not sell or lease personally identifiable information to any person unless— (A) such sale or such lease is consistent with such policy; or (B) after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease 11 U.S. Code § 363, use, sale, or lease of property (Cornell LII)

Memoranda, correspondence, communications, other documents, and records (including electronic records) described in paragraph (a) of this section shall be retained whether they support the auditor's final conclusions regarding the audit or review 17 CFR 210.2-06, retention of audit and review records (eCFR)

every broker or dealer registered pursuant to section 15 of the Act (15 U.S.C. 78o) must make and keep current the following books and records relating to its business 17 CFR 240.17a-3, records to be made by brokers and dealers (eCFR)

Every member, broker or dealer subject to § 240.17a-3 must preserve for a period of not less than three years, the first two years in an easily accessible place 17 CFR 240.17a-4, records to be preserved by brokers and dealers (eCFR)

shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record 17 CFR 275.204-2, books and records of investment advisers (eCFR)

It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception 18 U.S. Code § 2511, interception and disclosure of communications (Cornell LII)

with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service 18 U.S. Code § 2702, voluntary disclosure of customer communications or records (Cornell LII)

The books or records required by this section shall be kept at all times available for inspection by authorized internal revenue officers or employees, and shall be retained so long as the contents thereof may become material in the administration of any internal revenue law. 26 CFR 1.6001-1, records (eCFR)

Any personnel or employment record made or kept by an employer (including but not necessarily limited to requests for reasonable accommodation, application forms submitted by applicants and other records having to do with hiring, promotion, demotion, transfer, lay-off or termination, rates of pay or other terms of compensation, and selection for training or apprenticeship) shall be preserved by the employer for a period of one year from the date of the making of the record or the personnel action involved, whichever occurs later. 29 CFR 1602.14, preservation of records made or kept (eCFR)

Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later. 45 CFR 164.316, policies and procedures and documentation requirements (eCFR)

Accounting records that a company is required by section 386 to keep must be preserved by it— (a) in the case of a private company, for three years from the date on which they are made; (b) in the case of a public company, for six years from the date on which they are made. Companies Act 2006, section 388 (legislation.gov.uk)

It is an offence for a person knowingly or recklessly— (a) to obtain or disclose personal data without the consent of the controller, (b) to procure the disclosure of personal data to another person without the consent of the controller, or (c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained. Data Protection Act 2018, section 170, unlawful obtaining of personal data (legislation.gov.uk)

A common platform firm must retain all records kept by it under this chapter in relation to its MiFID business for a period of at least five years. FCA Handbook, SYSC 9.1 general rules on record-keeping

Members shall preserve for a period of at least six years those FINRA books and records for which there is no specified period under the FINRA rules or applicable Exchange Act rules. FINRA Rule 4511, general requirements

This includes records of: all money spent by the company, for example receipts, petty cash books, orders and delivery notes all money received by the company, for example invoices, contracts, sales books and till rolls any other relevant documents, for example bank statements and correspondence GOV.UK, Running a limited company: company and accounting records

Generally, you must keep all your business records for VAT purposes for at least 6 years. Records that you use for other tax purposes may need to be kept for longer periods. HMRC, VAT Notice 700/21: record keeping

You must determine your lawful basis before you start using the personal information and you must document it. ICO, A guide to lawful basis

Power to sell or otherwise dispose of the property of the company by public auction or private contract Insolvency Act 1986, Schedule 1, powers of administrator or administrative receiver (legislation.gov.uk)

The administrator of a company has the powers specified in Schedule 1 to this Act. Insolvency Act 1986, Schedule B1, paragraph 60 (legislation.gov.uk)

But it is not an offence under subsection (1) for a person to intercept a communication in the course of its transmission by means of a private telecommunication system if the person— (a) is a person with a right to control the operation or use of the system, or (b) has the express or implied consent of such a person to carry out the interception. Investigatory Powers Act 2016, section 3, offence of unlawful interception (legislation.gov.uk)

An action founded on simple contract shall not be brought after the expiration of six years from the date on which the cause of action accrued. Limitation Act 1980, section 5 (legislation.gov.uk)

within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed UK GDPR, Article 14, information where data not obtained from the data subject (legislation.gov.uk)

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes UK GDPR, Article 5, principles relating to processing of personal data (legislation.gov.uk)

Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes UK GDPR, Article 6, lawfulness of processing (legislation.gov.uk)