How to Build a GDPR-Compliant Email Retention Policy

Every organisation that archives email faces a structural compliance problem. GDPR Article 5(1)(e) requires that personal data be kept "no longer than is necessary for the purposes for which the personal data are processed." At the same time, national tax and commercial laws across the EU require retention of business correspondence for six to ten years. These obligations are not contradictory, but reconciling them demands a formal, documented email retention policy - not an informal practice, and not a vendor setting buried in an IT system.

This guide takes you through the six steps required to build a policy that satisfies both frameworks. It draws on the GDPR text, EDPB guidance, and the findings of the 2025 Coordinated Enforcement Action on the right to erasure.

Step 1: Map All Email Data Flows and Processing Purposes

Before you can write a retention rule, you need to know what email data you hold, where it lives, and why it was collected. This mapping exercise is the foundation of every subsequent step.

Start by identifying all email systems in scope: corporate mail servers, Microsoft 365 or Google Workspace tenants, legacy on-premise Exchange, distribution lists, shared mailboxes, and any third-party archiving or backup systems that receive copies of email. Do not overlook backup tapes or cloud backup snapshots - the EDPB's 2025 enforcement findings specifically flagged backup systems as the most commonly missed data store when controllers process erasure requests.

For each system, document:

• What categories of email are held: commercial correspondence, invoices, HR communications, customer support threads, internal project discussions, newsletters
• The sender and recipient populations: employees, former employees, customers, suppliers, regulators
• The purposes for which the data was originally collected: contract performance, employment administration, customer relationship management, regulatory compliance
• The technical path: how email flows from the mail server into the archive, whether copies exist elsewhere, and how long they persist in each location

This mapping feeds directly into your Records of Processing Activities under Article 30 GDPR. It also surfaces the practical problem that many organisations discover at this stage: email is archived wholesale, without any classification, meaning the archive contains everything from ten-year-old purchase orders to last week's lunch arrangements. A compliant retention policy cannot be applied to an undifferentiated mass of data.

Step 2: Identify Applicable Retention Periods by Jurisdiction and Category

Retention periods are not uniform across the EU. They vary by jurisdiction, by category of email, and sometimes by industry. A controller operating in multiple member states must map each relevant jurisdiction separately.

The table in the section below provides a starting reference, but the critical discipline is linking every retention period to the specific statute that mandates it. "Legal obligation" is not a sufficient entry in a retention schedule. The entry must identify the law by name, the retention period it prescribes, and the category of data it covers.

Common retention categories for email archives include:

• Tax-relevant correspondence (invoices, payment confirmations, purchase orders, expense approvals): 8 years in Germany under AO §147 and UStG §14b; 10 years in France under the Code de commerce; 7 years in the Netherlands under the Algemene wet inzake rijksbelastingen.
• Commercial correspondence (contracts, offers, order confirmations, delivery notes): 6 years in Germany under HGB; 5 years in France under the Code de commerce; 6 years in Spain under the Codigo de Comercio.
• Employment and HR correspondence (offer letters, salary communications, disciplinary proceedings, termination notices): periods vary substantially by member state, from 2 to 50 years depending on the type of document and national law.
• Regulated industry communications (financial advice, medical correspondence, legal communications): sector-specific regulations such as MiFID II and professional conduct rules may prescribe their own periods, often longer than general commercial retention requirements.
• General internal communications (meeting invitations, project discussions, internal announcements): in most jurisdictions, no specific retention obligation applies. These emails should be treated as personal data subject to the storage limitation principle without a countervailing legal obligation.

Where multiple jurisdictions apply to the same email - for example, a contract negotiation between a German sender and a French recipient - apply the longer of the applicable periods, and document that decision.

Step 3: Define Lawful Bases for Each Retention Category

Every retention category in your policy must be backed by a lawful basis under Article 6 GDPR. For legally mandated retention, the correct basis is Article 6(1)(c): processing necessary for compliance with a legal obligation to which the controller is subject.

This distinction matters more than it may appear. Some controllers document their archiving under Article 6(1)(f), the legitimate interests basis, on the theory that retaining email is in the organisation's interest. The EDPB and most DPAs take a more demanding view: where a specific legal obligation exists, that obligation should be the documented basis. Relying on legitimate interests for retention that is actually mandated by law conflates two different legal foundations and weakens your position in both directions - it makes your erasure refusals harder to defend, and it implies that a balancing test applies where statute has already resolved the question.

For retention that is not legally mandated - general internal communications, for example, or newsletters received from third parties - no Article 6(1)(c) basis exists. If you retain this data, you need a different basis, typically Article 6(1)(f), and you must accept that erasure requests for this category cannot be refused under Article 17(3)(b). The practical implication is that non-mandatory email categories should either not be archived at all, or should be subject to short retention periods that reflect their limited purpose.

Document the lawful basis for each retention category in your ROPA. Article 30 GDPR requires the ROPA to include "the purposes of the processing" and "a description of the categories of data subjects and of the categories of personal data." Adding the applicable legal basis and statute to each category entry satisfies the accountability principle under Article 5(2) and gives you a defensible audit trail.

Step 4: Implement Automated Retention Rules

A retention policy written in a document but not enforced in a system is not a compliant retention policy. The EDPB's SME Guide on storage limitation is explicit: controllers must implement technical measures that ensure personal data is actually deleted when the retention period expires, not merely flagged for review.

Manual deletion management does not scale. An organisation archiving several hundred emails per day accumulates millions of messages over a ten-year retention window. Identifying and deleting individual messages by hand as their retention periods expire is not operationally feasible and introduces inconsistency that will be visible in any audit.

A compliant technical implementation has four components.

The archive must be capable of applying different retention periods to different categories of email, with rules triggered by configurable criteria: sender domain, recipient address, folder path, attachment type, subject line pattern, or metadata values injected at ingestion. Each rule maps a category to a retention period and a deletion action.

When a message reaches the end of its retention period, it should be deleted automatically without requiring manual approval, unless a legal hold flag is active on that specific message. Deletion should occur in the archive and in any backup or replica copies. Removing data from production systems while leaving it in backups was the most common finding in the EDPB 2025 enforcement action and is treated as a compliance failure, not a technical limitation.

Where litigation is anticipated, ongoing, or a regulator has requested preservation, specific messages or mailboxes may need to be preserved beyond their normal retention period. Legal holds should be applied with documentation: who applied the hold, why, with reference to the specific proceeding or request, and a review date. Holds are not licenses for indefinite preservation. They should be reviewed at regular intervals and released when the underlying justification lapses.

Every deletion event should generate an immutable log entry recording the message identifier, the retention category, the retention period end date, the date of deletion, and the system that performed the deletion. This log is your evidence that deletion actually occurred, evidence that supervisory authorities can and do request.

Step 5: Handle DSARs and Erasure Requests Within Archived Email

A formal retention policy changes how you respond to data subject requests. Where no retention policy exists, any erasure request touching the archive is effectively impossible to process systematically. Where a documented policy exists, the response follows a defined decision tree.

When an erasure request arrives:

First, search the archive. You cannot respond to a request you cannot locate. Your archive must support search by data subject identifier (name, email address, employee number). Document the search and its results.

Second, apply the retention schedule. For each message identified, determine which retention category applies and whether the legal retention period is still running. Messages within a mandatory retention period cannot be deleted; the Article 17(3)(b) exception applies.

Third, delete what can be deleted. Messages that do not fall within a mandatory retention period, such as general internal communications and non-mandatory categories, must be deleted. The retention policy exists to make this determination automated and consistent rather than ad hoc.

Fourth, issue a documented refusal for retained messages. Article 12(4) GDPR requires you to inform the data subject within one month of the reasons for not acting on the request and of their right to lodge a complaint with a supervisory authority. The refusal must identify the specific legal basis: not "legal obligation" in the abstract, but the specific statute, the retention period it prescribes, and the date on which the obligation will lapse and deletion will occur.

Fifth, restrict access to retained data. Data retained solely because of a legal obligation should not be freely accessible to all archive users. The obligation to retain it does not mean it should be available for general business use. Implement access controls that limit retrieval of legally held data to the specific purposes (tax audit, legal proceedings) that justify the retention.

When a Data Subject Access Request (DSAR) is received rather than an erasure request, the presence of a legal hold does not exempt you from providing a copy of the data. Respond to the DSAR in full, applying any national exemptions that may apply - for example, exemptions for data subject to legal professional privilege or covered by ongoing regulatory proceedings.

Step 6: Document Everything

The accountability principle under Article 5(2) GDPR requires you to be able to demonstrate compliance, not merely achieve it. Documentation is not an optional enhancement. It is a substantive requirement, and gaps in documentation are themselves regulatory findings.

Three documents are central to a compliant email retention policy.

Records of Processing Activities (Article 30). Your ROPA entry for email archiving should identify: the purposes of processing (legal obligation compliance, specific statutes); the categories of data subjects (employees, former employees, customers, suppliers); the categories of personal data (email content, metadata, attachments); the recipients or categories of recipients; the retention periods for each category, linked to the specific statutory basis; and a general description of the technical and organisational security measures.

Data Protection Impact Assessment (Article 35). Large-scale systematic monitoring of employees' communications is likely to meet the threshold for a mandatory DPIA under Article 35(3)(c). Email archiving at organisational scale, particularly where it includes HR and internal communications, should be assessed. The DPIA should document the necessity and proportionality of the archiving scope, the risks to data subjects, and the measures taken to mitigate those risks. EDPB Guidelines 4/2019 on Data Protection by Design and Default, paragraphs 52 to 54, address storage limitation as a design principle and are directly relevant.

Retention schedule. A standalone document, separate from or extracted from the ROPA, listing every retention category, the applicable statute, the retention period, the deletion mechanism, and the review date. This document should be reviewed annually and whenever a relevant legal change occurs. It is the operational reference that IT and compliance teams use when configuring the archive system.

EDPB 2025 Findings: Common Pitfalls

The European Data Protection Board's 2025 Coordinated Enforcement Action on the right to erasure examined 764 controllers across 32 DPAs. The findings identify the most common failure modes in retention and erasure compliance - and the patterns are directly relevant to email archive operators.

The single most frequently observed deficiency was failure to erase from backups and archives. Controllers deleted data from production systems in response to erasure requests but made no corresponding deletion in archive or backup copies. DPAs assessed this as a complete breach of the erasure obligation, not partial compliance. The GDPR does not distinguish between production and non-production copies: erasure means erasure from all systems.

Inconsistent and undocumented retention periods were also widespread. Many controllers had no coherent retention schedule. Different teams applied different periods to the same category of data, and no documentation connected any period to a specific statutory basis. When DPA investigators asked why data from seven years ago was still being held, controllers could not provide a legal justification. Data retained beyond any applicable legal period without documented justification is unlawful processing.

Some controllers claimed that archived data had been anonymised and was therefore outside the GDPR's scope. DPAs found in multiple cases that the techniques used, such as keyword removal or partial redaction, were reversible or incomplete. Pseudonymised data is not anonymous data. If a reasonable effort could re-identify the individual, the data retains its personal character and full GDPR protections continue to apply.

A substantial number of controllers had a DSAR and erasure response process for production systems but no documented process for searching or deleting from the email archive. When a data subject's email address appeared in thousands of archived messages, the controller had no operational method for identifying and processing those records.

Several controllers archived all email indefinitely on the theory that retention was costless and something might be needed someday. DPAs found this approach inconsistent with the storage limitation principle regardless of technical capability. Storage capacity is not a lawful basis for retention.

Sample Email Retention Schedule

The following table illustrates the structure of a retention schedule for a controller operating in Germany. Adapt the legal references and periods to your own jurisdictions.

This schedule is a reference template. Before adopting any period, verify the current statutory requirements for each jurisdiction in which your organisation operates, and take legal advice where the applicable statute is unclear or contested.

How EasyMailArchive Supports Your Retention Policy

Building a defensible email retention policy requires tools that can actually enforce it. A policy document that sits in a SharePoint folder while the archive accumulates data indefinitely is not compliance - it is documentation of an intention that was never implemented.

EasyMailArchive provides the technical layer that connects your written policy to your live archive. Configurable retention rules let you define different retention periods for different email categories, triggered by the criteria that map to your classification scheme. Automated deletion removes emails when their retention period expires with no manual intervention. Legal hold management preserves specific messages beyond their normal period with a full audit trail of who applied the hold, why, and when it was released. Deletion confirmation logs give you immutable evidence that erasure occurred - in the archive and in backups - addressing the specific gap that EDPB enforcement actions most commonly find.

If you are ready to translate your retention schedule into enforced policy, the EasyMailArchive retention policy builder walks you through configuration step by step and generates a draft retention schedule aligned to your jurisdictions.