GDPR vs. Retention Obligations: Balancing Email Archiving with the Right to Erasure

Every compliance officer managing an email archive eventually faces the same conflict: an employee leaves, a former customer invokes their rights, or a data subject sends a formal erasure request - and the archive contains their personal data that national law says you must keep for another six years. What do you do?

This tension is not a niche edge case. It sits at the intersection of two foundational legal frameworks: the GDPR's data minimisation and erasure rights on one side, and a patchwork of national retention statutes on the other. Getting it wrong in either direction carries real risk - regulatory fines for unlawful processing, or civil and criminal liability for destroying records under legal hold.

This article provides a practical, EU-wide framework for compliance professionals navigating that tension.

Article 17(1) GDPR grants data subjects the right to obtain erasure of personal data without undue delay where certain grounds apply - including withdrawal of consent, successful objection under Article 21, or where the data is simply no longer necessary for the purpose for which it was collected.

For email archives, the most commonly triggered grounds are necessity and consent. Former employees whose emails remain in the archive never provided separate consent for long-term archiving; the data was collected in the context of employment. Once the employment relationship ends, they may argue the data is no longer necessary.

However, Article 17(3)(b) creates a critical carve-out: the right to erasure does not apply when processing is necessary for compliance with a legal obligation which requires processing under Union or Member State law. This exception is not a blanket shield. It is conditional on three requirements:

A legal obligation must actually exist - and be specific enough to require retention of this category of data.
The processing must be necessary for that obligation - not merely convenient.
The obligation must be grounded in Union or Member State law applicable to the controller.

Where all three conditions are met, the controller may lawfully refuse an erasure request and must communicate the applicable legal basis to the data subject in the refusal.

The Lawful Basis Underneath: Article 6(1)(c)

The erasure exception in Article 17(3)(b) presupposes that the underlying archiving activity has a valid lawful basis in the first place. For legally mandated retention, that basis is Article 6(1)(c): processing necessary for compliance with a legal obligation to which the controller is subject.

This is distinct from the controller's legitimate interest under Article 6(1)(f), which is a weaker, balancing-test basis that is harder to defend in the face of an erasure request. Controllers who have documented their archiving under Article 6(1)(f) rather than 6(1)(c) are in a weaker position when refusing deletion demands.

The practical implication: your Records of Processing Activities (ROPA) should clearly identify the specific national statute - not just "legal obligation" - that mandates each retention period. Vague ROPA entries do not satisfy the accountability principle under Article 5(2).

National Retention Laws Across the EU as Lawful Archiving Bases

Retention obligations are not harmonised at EU level. Each Member State maintains its own framework, and controllers operating across borders must map each jurisdiction's requirements separately.

Germany is among the most prescriptive: the GoBD (Principles for Proper Electronic Bookkeeping) in conjunction with the HGB (Commercial Code) and AO (Tax Code) require retention of business correspondence with commercial or tax relevance for 6 years (commercial letters), 8 years (accounting vouchers such as invoices) or 10 years (books and annual financial statements). These obligations sit squarely within Article 6(1)(c).

France operates under the Code de commerce and the Livre des procédures fiscales, with retention periods of 10 years for accounting documents and 5 years for commercial correspondence. The CNIL has confirmed that archiving under these statutes constitutes lawful processing.

The Netherlands imposes a 7-year retention obligation for tax-relevant records under the Algemene wet inzake rijksbelastingen, and a 2-year obligation for employment-related documentation under the Wet op de loonbelasting.

Spain requires 4 years for tax records (Ley General Tributaria), 6 years for commercial books (Código de Comercio), and up to 10 years for anti-money-laundering purposes under Ley 10/2010.

Poland imposes a 5-year retention period for accounting records under the Ustawa o rachunkowości, and specific periods for employment documentation following 2019 reforms that extended some HR records to 50 years for pre-2019 employment.

The key takeaway across all jurisdictions: the lawful basis under Article 6(1)(c) is only as strong as the identification of the specific national statute underpinning it. Document precisely which law mandates retention of which category of email, and for how long.

EDPB 2025 Coordinated Enforcement: What the Findings Mean for Email Archives

The European Data Protection Board's 2025 Coordinated Enforcement Action (CEA) on the right to erasure examined 764 controllers across 32 Data Protection Authorities. The findings are instructive for anyone managing email archives.

The EDPB found widespread failure to implement erasure in backup and archival systems. Controllers routinely deleted data from production systems in response to erasure requests but neglected to apply equivalent deletion to backup copies and email archives. This partial compliance was treated as a breach - not as good-faith effort.

The report identified inconsistent retention periods as a systemic problem. Many controllers had no documented rationale linking their retention schedules to specific legal obligations, making it impossible to determine when data should be deleted after the legal basis expired.

Weak or absent anonymisation was another recurring finding. Some controllers claimed data was "anonymised" in archives but used techniques that DPA investigators assessed as reversible, meaning the data retained its personal character and full GDPR protections continued to apply.

The practical implication for email archive operators is clear: if you process an erasure request, you must either delete the data from all systems - including archives - or document the specific legal obligation that overrides the request. Incomplete deletion is not a compliant response.

CJEU Case Law: The Limits of Blanket Retention

Two foundational CJEU rulings establish the constitutional boundaries within which national retention mandates must operate.

In Digital Rights Ireland (C-293/12), the Court struck down the EU Data Retention Directive because it required generalised, indiscriminate retention of communications metadata without sufficient safeguards. The Court held that blanket retention regimes - requiring retention of all data regardless of any link to a threat or legal need - are incompatible with Articles 7 and 8 of the Charter of Fundamental Rights.

In Tele2 Sverige (C-203/15), the Court confirmed that EU law, as interpreted in the light of the Charter, precludes national legislation that prescribes general and indiscriminate retention of all traffic and location data.

These rulings primarily addressed state surveillance contexts, but they articulate a principle relevant to private controllers: retention must be proportionate, targeted, and justified by a specific objective. A retention policy that captures every email ever sent or received, regardless of content or legal relevance, on the theory that "something might be needed someday", cannot be reconciled with the storage limitation principle in Article 5(1)(e).

This means your archiving scope matters. Archiving all emails indefinitely - including purely personal communications, spam, and internal chatter with no commercial or legal significance - is difficult to justify under Article 5(1)(e) even where a general retention obligation exists for business correspondence.

Practical Framework: Retention Schedules and Rule-Based Deletion

A compliant email archiving posture requires a structured retention framework. The following approach integrates GDPR requirements with national retention obligations.

Step 1 - Map your retention obligations by category. Not all emails carry the same legal weight. Distinguish between categories: tax-relevant invoices and purchase orders (8 years in Germany, 10 years in France); commercial correspondence (6 years in Germany, 5 years in France); HR correspondence (varies widely by country); general internal communications (often no specific mandate). Map each category to the specific statute requiring retention.

Step 2 - Assign retention labels at ingestion. Configure your archive to classify emails by category at the point of ingestion - based on sender, recipient, subject patterns, or attachment type. This classification drives automated retention and deletion.

Step 3 - Set automated deletion rules after retention expiry. Once the legal retention period for a category expires, emails in that category should be deleted automatically unless placed under a specific legal hold. This satisfies the storage limitation principle and means you are not indefinitely accumulating data beyond its legal purpose.

Step 4 - Implement legal hold overrides. Where litigation is anticipated or ongoing, specific emails may need to be preserved beyond their normal retention period. Legal holds should be documented, time-limited where possible, and reviewed regularly. A hold is not a license for indefinite preservation.

Step 5 - Document everything in your ROPA. Each retention category, its legal basis, the applicable statute, the retention period, and the deletion mechanism should be documented in your Records of Processing Activities. This documentation is your primary defence in a supervisory authority investigation.

Step 6 - Test your deletion procedures. Run periodic audits to confirm that emails flagged for deletion are actually being deleted - not just flagged but left in place, and not just deleted from primary storage while copies remain in backup archives.

Handling Data Subject Access Requests When Emails Are Under Legal Hold

When a data subject submits an erasure request and the emails in question fall within a lawful retention period, the correct response follows a defined sequence.

First, verify that a specific legal obligation actually applies to those emails. A general commercial retention period does not cover purely personal emails between colleagues that happen to sit in the archive.

Second, issue a refusal that identifies the specific legal basis. Article 12(4) GDPR requires you to inform the data subject without undue delay, and in any event within one month, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. The refusal must cite the specific national statute.

Third, confirm that access to the retained data is restricted. Data that cannot be deleted due to a legal obligation should not be freely accessible to all archive users. Implement access controls that limit who can retrieve retained emails and for what purpose.

Fourth, delete as soon as the legal obligation lapses. The refusal of an erasure request today does not mean the data can be retained indefinitely. Document the expiry date and ensure deletion occurs when the obligation ends.

Where a Data Subject Access Request (DSAR) is received rather than an erasure request, the legal hold does not exempt you from the obligation to provide a copy of the data. You must respond to the DSAR while applying any applicable exemptions under national law (for example, exemptions for data protected by legal professional privilege or ongoing litigation).

Technical Implementation: Automated Retention Policies

Manual retention management at scale is not viable. An email archive receiving tens of thousands of messages per day cannot be managed through human review. Automation is both a practical necessity and a compliance requirement.

A compliant technical implementation should provide:

Category-based retention rules that assign different retention periods to different email categories, triggered by configurable criteria such as sender domain, recipient, folder, attachment content, or header values.

Automated expiry and deletion that removes emails from the archive without manual intervention when the retention period expires, unless a legal hold flag is active on the message.

Legal hold management with an audit trail showing when holds were applied, by whom, with what justification, and when they were released.

Deletion confirmation logs that record the deletion of individual messages with timestamps, so you can demonstrate to a supervisory authority that deletion actually occurred and when.

Separation of archive and backup so that deletion from the archive triggers corresponding deletion from backup copies. This directly addresses the EDPB 2025 finding that backup erasure is the most commonly missed step.

Audit logging of all access, including search queries, message views, and exports, so that purpose limitation can be demonstrated and access was for legitimate archiving purposes, not casual browsing.

Conclusion: Compliance Is a System, Not a Setting

The GDPR's right to erasure and national retention obligations are not irreconcilable. Article 17(3)(b) provides a clear legal path for refusing erasure where a specific legal obligation requires retention. But that exception demands rigorous documentation: the specific statute, the applicable retention period, and a system that actually deletes data when the period expires.

The EDPB's 2025 enforcement findings show that most organisations fall short because their archiving systems operate independently of their GDPR compliance processes. Emails get archived, retention periods are documented somewhere in a ROPA, but the two systems never connect, so data accumulates indefinitely, erasure requests are partially fulfilled, and backup copies are forgotten entirely.

A purpose-built archiving solution that integrates retention schedules, automated deletion, legal hold management, and full audit logging closes that gap.

EasyMailArchive is designed to make the retention-vs-erasure balance manageable:

Configurable retention policies let you define different retention periods for different email categories, mapped to the specific legal obligations in each jurisdiction where you operate
Automated deletion removes emails when their retention period expires, with no manual intervention required
Legal hold flags preserve specific messages beyond their normal retention period while the rest of the archive continues to age out normally
Full audit logging records every access, search, and export so you can demonstrate purpose limitation to a supervisory authority
EU-hosted infrastructure ensures all archived data remains within EU jurisdiction, simplifying cross-border data transfer compliance
Deletion confirmation logs provide evidence that erasure has occurred in the archive and in backups, addressing the most common finding in EDPB enforcement actions