For How Long?
The FRCP does not state a specific period of time for retaining information. But each regulated industry has its own requirements. "FRCP itself only states that organizations must have a policy around electronically stored information, and that you must tell the other party in the lawsuit what that policy is," says Raghavan. It can get complicated. He points out that if an employee takes an email and prints it out and places it in a file folder, the organization is obligated to likewise keep a record. "Companies need to make a risk assessment on how long a duration to store information and how quickly do they want to respond," adds Raghavan.
Patient records, customer invoices, boardroom minutes, etc. are all examples of business records that have specific retention requirements. It might be useful to gather a team together to determine retention length, for which groups within an organization. "Consult with a compliance expert for your industry to determine the time period," recommends Spurzem.
But many companies do not fall into a mandated time frame. "There are no best practices or mathematical rules to state how long to keep stuff," states Lock. "In general, it comes down to cost and ethics. Most archives are priced on a per mailbox basis. They are quite expensive to set up for a user, but once set up, extending the archive period is an incremental cost. Other solutions, like Mirapoint's, are capacity-based pricing.