Retention before licensing
How long should business emails be kept? US and UK rules
Updated
No single law says how long email must be kept. Each record-keeping rule reaches the mail that carries the records it covers, and the periods run from one year to seven.
Which period applies turns on who the company is and what a message is about; the table names each rule and whose mail it reaches.
Source: How long business email must be kept, and who may see it
| Record-keeping rule | Whose mail it reaches | Period it sets | Source |
|---|---|---|---|
| SEC Rule 17a-4 | US broker-dealers, for communications sent and received | At least three years, the first two easily accessible | 17 CFR 240.17a-4 |
| SEC Rule 204-2 | US investment advisers | At least five years from the end of the fiscal year of the last entry | 17 CFR 275.204-2 |
| FINRA Rule 4511 | FINRA members, records with no other period | At least six years | FINRA Rule 4511 |
| 17 CFR 210.2-06 | Auditors, for audit correspondence | Seven years | 17 CFR 210.2-06 |
| 29 CFR 1602.14 | US employers, for personnel records | One year | 29 CFR 1602.14 |
| 45 CFR 164.316 | HIPAA-covered entities, for required documentation | Six years | 45 CFR 164.316 |
| Companies Act 2006, s388 | UK companies, for accounting records | Three years if private, six if public | Companies Act 2006, s388 |
| VAT Notice 700/21 | UK VAT-registered businesses | At least six years | HMRC, VAT Notice 700/21 |
| FCA SYSC 9.1 | Common platform firms, for MiFID business records | At least five years | FCA Handbook, SYSC 9.1 |
Three checks before an archive copy is licensed
- Find which rows above bind the company, and for which mailboxes.
- Leave the originals where the rule needs them; a licence passes a prepared copy.
- Note any legal hold, which keeps mail past its period.
The rules on passing the mail on are a separate question from how long it must be kept.