How Long Should You Hold onto Old Messages?

Unless your organization’s IM and e-mail are governed by law or regulation—such as the SEC’s dictate that brokerage firms be prepared to produce three years’ worth of electronic records immediately upon request, or the Employee Retirement Income Security Act’s rule that e-mail and other correspondence related to employee benefit plans be kept indefinitely^[10]—then you are free to determine the retention period that is most appropriate for your organization.

Mindful of Sarbanes-Oxley, HIPAA, the eSignature Act, and other widely publicized laws and regulations, and thanks to the declining cost of storage, many unregulated companies are now opting to hold onto e-mail for increasingly long periods of time. ^[11]

If your organization’s IM and e-mail retention periods are not specified by law or regulation, then—as a rule—you should keep electronic business records for the same length of time as paper records. If, for example, you store employee personnel records for three years, then retain e-mail and instant messaging personnel records for three years as well. Consistency is key. ^[12]

^[10]Michael Osterman, ‘‘A Legal Guide to E-Mail Retention,’’ Network World Messaging Newsletter (February 4, 2002), www.nwfusion.com/newsletters/gwm/2002/01209344.html.

^[11]Steve Ulfelder, ‘‘CSI: Lost E-Mails,’’ Network World ( September 8, 2003), www.nwfusion.com/research/2003/0908csi.html.

^[12]Excerpted from Nancy Flynn and Randolph Kahn, Esq., E-Mail Rules, New York, AMACOM, 2003.