How long should a business keep email, and how to set it up in Microsoft 365

Email is a business record

Quotes, contract changes, supplier agreements, complaints, staff matters and payment instructions often exist only in email. If a customer disputes an invoice from three years ago, or Inland Revenue asks about a transaction, that email may be the only evidence of what was agreed. In New Zealand, business and tax records generally need to be kept for several years, and some sectors, such as health, building and legal services, have longer or specific requirements. Check with your accountant or professional body for your situation.

At the same time, the Privacy Act 2020 expects you not to keep personal information longer than you need it. An unlimited keep-everything approach is not automatically safe. The goal is a clear rule that matches your obligations and is applied consistently. A practical approach for many small offices is two rules. General business mail is kept for the same period as financial records, then deleted. Mailboxes with especially sensitive content, such as HR or clinical correspondence, get their own rule set by the relevant legal or professional requirement. Write both down in a short policy so staff, auditors and insurers can see the reasoning.

Retention policies versus personal clean-ups

Without a policy, retention depends on each person. One staff member deletes everything after reading it; another keeps fifteen years of mail. When they leave, nobody knows what the business still has. A retention policy in Microsoft 365 sets the rule centrally, such as keep all mail for seven years, then delete, or move mail older than two years to the archive. It applies to every mailbox it covers, including shared mailboxes.

Retention policies can also prevent deletion. With a keep rule in place, an email a person deletes is still retained behind the scenes until the period ends, so it can be recovered or searched if needed. That protects the business when someone leaves on bad terms and empties their mailbox on the way out.

The online archive in practice

The online archive gives each mailbox a second storage area, visible in Outlook as a separate folder tree. An archive policy moves older items there automatically, keeping the main mailbox smaller and faster. Staff can still search and open archived mail, which matters more than they expect, because the email they need is almost always the one from two years ago. Archive size options depend on your licence, so check what your plan provides before setting expectations. Also explain the archive to staff before it switches on. People who suddenly cannot see old folders in their main mailbox often assume email has been deleted and raise a panicked support request.

Litigation hold and legal disputes

If the business is in a legal dispute, an employment investigation or expects either, you may need to preserve everything relevant, regardless of normal retention rules. A hold on the relevant mailboxes keeps every item, including anything deleted, until the hold is lifted. This feature is available on some plans and not others, and in some cases as an add-on, so confirm it is available before you need it in a hurry.

Holds should be applied quickly and quietly once a dispute is likely, and recorded somewhere: who requested it, which mailboxes, from what date. Your lawyer will advise on what needs preserving. The technical step is simple; the decision about scope is a legal one. Remember that a hold also stops normal clean-up from working, so mailboxes under hold grow over time. If a hold stays in place for years, the archive and recoverable items areas need watching so the mailbox keeps working normally for its owner.

Departing staff mailboxes

When someone leaves, their mailbox often holds client history the business needs. Rather than deleting the account straight away, many businesses convert the mailbox to a shared mailbox so a manager can access it, or keep it under a retention policy before the licence is removed. That preserves the record without paying for a licence indefinitely, within the size limits that apply. Set a review date for those mailboxes. Five former staff mailboxes kept forever with nobody checking them are a privacy risk and a clutter problem. After the retention period, the business should be able to say they were reviewed and deleted on purpose.

Archive is not backup

Retention and archiving keep email inside Microsoft 365. They do not protect against a compromised administrator account deleting things, a misconfigured policy removing mail early, or Microsoft service problems. A separate backup of Microsoft 365, stored outside your tenant, covers those cases and makes it easy to restore a whole mailbox or one folder to a specific date.

When you plan retention, decide alongside it how long backups are kept, so the two match. There is little point keeping mail for seven years in the archive while backups only go back thirty days, or the reverse. A one-page note recording both rules is enough for most small businesses.