10.4 Defining a document retention policy

---

The concept of a document retention policy first briefly appears in the discussion on Outlook archiving to a PST (section 10.8.1). Email archiving is a very personal activity and its execution depends entirely on users, so to some degree you have to educate users about how to process email effectively in terms of how they file messages and how long they decide to keep them.

In the past, department secretaries kept business records and performed filing to ensure that they could retrieve information. They also took care of tasks such as archiving, disposing of obsolete papers, clearing out file cabinets, and so on. Today, many secretaries have disappeared, and users, all of whom have the ability to implement their own document management policy within their own mailboxes, PC file structure, and other repositories, take care of information.

You may not be able to do much about how people organize data on their PCs, but you can influence user behavior by imposing draconian mailbox quotas to force users to keep clean mailboxes, or you can use the Exchange Mailbox Manager to automate mailbox cleanups with minimal user input. For many companies, Mailbox Manager is an essential part of document retention, because it allows you to exercise some control over people's packrat behavior. However, you must factor the Mailbox Manager into an overall document retention policy that you set down and communicate clearly. It is not enough to simply write down and send a policy around to everyone. If users are not educated about how they can implement the policy and the tools that are available to help them, it is unlikely that the policy will be successful. The components of a document retention policy often include the following:

• Setting mailbox quotas for different types of users

• Basic advice on how long users should keep messages and the tools used to help users stay within the policy

• How to decommission mailboxes when users leave the organization

• Whether you archive messages in some manner or permanently delete them

The reasons why you need a document retention policy include:

• Data management:   You want to remove redundant or unneeded data from the Exchange Store so that you do not have to continue to manage it. In particular, it is very expensive to have to back up unwanted messages daily, so it makes sense to reduce the size of the Store databases by deleting messages as soon as they are no longer required.

• Compliance:   Your industry may operate under the legal requirement to manage information in a specific manner. For example, financial traders in the United States must keep records of all communications with clients, including email, to comply with U.S. Securities and Exchange Commission (SEC) regulations.

• Disaster recovery:   If a disaster happens, you need to know what documents are most important and should be recovered first and what you can leave for later.

• Support for litigation or defense against litigation:   If you want to sue someone, you may need to recover or access email or documents and need to know where you can find them and then recover copies. The same is true if someone sues you, in which case the presiding judge may rule that you have to provide copies of messages sent by nominated individuals over some period. Do not assume that deleting messages means that they are unrecoverable, because a judge can require a company to retrieve information from backup tapes, search user files to discover printed copies, look through PSTs to find email that users archive themselves, or even find copies of messages that users sent outside the company. In this respect, email is similar to cockroaches: You think you have eliminated them from your environment only to discover that they can come back from backups or other sources. While purging systems and restricting users to small mailbox quotas is good idea, it is definitely not a defense against litigation.

• Document management and publication:   You should decide how users most effectively communicate and share information via the different mechanisms that may be available, including email, instant messaging, network file shares, public folders, and document management systems (including SharePoint Portal Server). You might even consider giving advice to users about when it is appropriate to use email to communicate. Sometimes, a different tool such as Instant Messaging (IM) is a better choice. For example, if you want to ask someone a question and he or she is online, an IM conversation is a very convenient and effective communication mechanism. Even better, unlike email, unless you take steps to capture the content, IM conversations leave no trace on servers.

Every industry is different and requirements vary from country to country, so no hard and fast rule exists. One thing is for sure: If you give users free reign, they will swiftly fill every available disk with data-not all of which is vital.

---