Email retention and UK GDPR

Are emails covered by UK GDPR?

Yes, wherever they contain personal data, and almost all business email does. A sender's name and email address are personal data. So is anything the message says about a customer, an employee or a supplier contact. Archived email is no different: moving mail into an archive does not take it outside UK GDPR, it just changes where it is held.

That makes your email archive one of the largest stores of personal data your organisation has. It needs the same thinking as any other system: why you keep the data, for how long, how it is secured, and how you respond to people's rights over it.

Storage limitation: Article 5(1)(e)

The core principle is in UK GDPR Article 5(1)(e). Personal data must be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed".

Three practical consequences follow for email:

• You choose the period, and you must justify it. UK GDPR does not set a number. The period comes from your purpose: a legal duty, a regulator's rule, a contract, or a genuine business need.
• One period for everything is hard to defend. Keeping all mail for ten years because some of it needs ten years keeps far more personal data than the purpose requires. Category-based periods are easier to justify.
• Deletion is part of compliance. When the period ends and nothing else requires the mail, it should be deleted or anonymised.

A common misunderstanding: Article 5(1)(e) allows longer storage for "archiving purposes in the public interest", scientific or historical research, or statistics. That refers to those specific purposes, with safeguards. It does not mean that putting business email into an email archive lets you keep it indefinitely.

The data minimisation principle in Article 5(1)(c), that data is limited to what is necessary, points the same way.

Documenting your periods: accountability

Article 5(2) makes the controller responsible for, and able to demonstrate, compliance with these principles. For email, that means writing down your retention decisions rather than keeping them in someone's head.

Article 30(1)(f) adds that records of processing activities should include, where possible, the envisaged time limits for erasure of the different categories of data. Your email retention policy and its schedule are where those time limits live. A good schedule records, for each category of mail:

• the period and the point it runs from
• the reason (the law, rule, contract or business need)
• what happens at the end: deletion, review or a longer hold
• who can access the mail during the period

People can ask about this too. Article 15(1)(d) says a subject access response should include, where possible, the envisaged period for which the personal data will be stored, or the criteria used to set it. A written schedule gives you that answer ready-made.

Our page on how long a company should keep emails gives the sourced UK reference points for those periods.

Defensible deletion

Deletion is where many organisations fall down. Mail lingers in old mailboxes, PST files and forgotten archives long after any reason to keep it has gone. "Defensible deletion" means deleting on a documented schedule, consistently, with a record that it happened, and pausing it when there is a reason to keep data longer.

The usual reasons to pause deletion are a legal obligation to keep the data or the establishment, exercise or defence of legal claims. These are also two of the grounds in UK GDPR Article 17(3) on which the right to erasure does not apply. When a dispute or investigation is reasonably anticipated, a legal hold keeps the relevant mail until the matter is resolved.

An archive makes this workable. Retention policies apply deletion centrally instead of relying on each user, and a legal hold overrides them where needed. NinjaOne describes its Archiver retention as supporting "defensible deletion practices without manual intervention".

Security: Article 5(1)(f)

Article 5(1)(f) requires personal data to be processed with appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

An email archive concentrates years of personal data in one place, so security and access control matter as much as retention. The questions to ask of any archive, and how NinjaOne Archiver answers them according to NinjaOne's own material:

Where your archive is held matters for your records of processing and any transfer assessment. We confirm the location for your archive when we quote, so you can record it in your own documentation.

Data subject rights and archived email

People's rights under UK GDPR apply to archived mail as much as to live mailboxes, so an archive should help you meet them, not hide data from them.

Subject access requests. Under Articles 12 and 12A you normally have one month to respond, which you can extend by two further months where that is necessary because of the complexity or number of requests. Article 12A also lets you ask for further information to identify what a request relates to, for example where you hold a large amount of information about the person, and the clock pauses while you wait. Article 15(1A), inserted by the Data (Use and Access) Act 2025, says a person is entitled to what the controller can provide based on "a reasonable and proportionate search". Searching years of email, including leavers' mail, in Microsoft 365 or Google Workspace, is far more practical in an archive with eDiscovery than across individual mailboxes, Vault exports and PST files. See searching email for subject access requests.

Erasure. Requests to erase data have to be weighed against your reasons for keeping it, and Article 17(3) lists situations where the right does not apply, including a legal obligation and legal claims. An immutable archive is designed so records cannot be quietly altered; how you handle an erasure request that touches archived mail is a decision for your data protection lead, and we can show you what the archive can and cannot do before you rely on it.

None of this is legal advice. If you are unsure how a right applies, ask your data protection adviser.

How NinjaOne Archiver helps with UK GDPR

No product makes an organisation compliant with UK GDPR; compliance comes from your decisions, policies and processes. What a well-run archive does is give those decisions somewhere to live and evidence that they are being followed. In NinjaOne Archiver, NinjaOne says the product helps organisations meet GDPR requirements, and the relevant features are:

• Retention policies: a standard policy plus custom policies by department or email account, from 30 days to over a decade or unlimited, so each category of mail gets its documented period.
• Legal hold: freezes retention for held data until the hold is removed, so deletion stops where a claim or investigation requires it.
• eDiscovery: search by account, date, sender, recipients and keywords, with saved searches and tagging, to find personal data for requests.
• Role-based access: compliance and reviewer roles, with the IT Admin role kept out of compliance features, so sensitive searches stay with the right people.
• Both platforms: journaling for Microsoft 365 and, through a Gmail routing rule, for Google Workspace, so the same controls apply wherever your mail lives.
• Audit log: a record of activity in the archive to support accountability.

Staff awareness matters too: most personal data reaches email because people send it there. Our sister site covers GDPR training for staff.

We can set up retention policies, roles and holds to match your schedule, and confirm data location, storage allowance and seats when we quote. Contact us to talk it through.