Setting A Retention Policy

By Stephanie Jordan
in

Some organizations develop messaging retention policies based on regulation requirements, but many organizations do not have such guidelines to follow. Andres Kohn, vice president of technology and product management for Proofpoint sees no standard among its customers. “We see people with really different philosophies. I’d say we have customers that may keep data for just three months in archive. Or there are others who only allow 20 days worth of email in their inbox. But there are others that say 10 years.” When asked what is the most common duration of retention, Kohn replies, “Three to five years is what most organizations do, but we definitely have organizations that have really short policies and really long policies. And there are pros and cons to both.”

One of the important things to remember is that when an organization has a retention policy, it must adhere to it. “If you say, and can prove, that you only have three months of data, and you have systems in place to enforce that, then even if asked for three years of data, it is okay to say: ‘I only have three months.’ It does keep your costs down,” says Kohn, when noting the positives of having a short retention policy.

The nature of email messages is that there is a sender and a recipient, however. Which means, that if you have a short-term retention policy, there is a good chance that the other side may not. They may have a message, which you do not, and it may be the proverbial smoking gun. “A lot of legal counsels would rather have everything and be able to go through and know what is there—especially before the case goes to trial,” explains Kohn. “In that way, an organization may be able to make a more informed decision to settle a case or to fight, based on a full scope of evidence.”

No Retention Policy

It is not uncommon to not have a retention policy. “Most organizations are unclear about the retention policies they should adopt,” comments David Ferris, president and senior analyst of Ferris Research in a blog. Ferris points out that not having a retention policy can slow the deployment of archiving, but he is not in favor of that impeding implementation. “It usually makes sense to go ahead with archiving in advance of having decided one’s retention policy. Start by archiving everything, for an indeterminate period,” he recommends. “You’ll still get many of the advantages of archiving, such as better user mailbox performance, better eDiscovery, and reduced backup times. As you go along, you can reduce the scope of archiving (e.g., don’t include spam) and define retention policies.”

While the courts have not come out with a particular retention policy length, organizations are required to turn over any relevant data that exists, should it be requested. The problem can be that an organization does not have easy access to all messages. “I see organizations that say, we are going to have a six month retention policy, but then allow users to create PST files, so in reality, they have many year’s worth of emails on people’s laptops or network drives, but they don’t have central access to it,” points out Kohn. “If the court determines that is the case, and that there is evidence to be dug up, the court can order access to everybody’s laptops to get to the information and try to piece it all together. Many organizations are becoming smarter about saying the amount of information that is kept in archive has to be at least as much, if not more, that what users are allowed to keep.”

Without real guidance from a particular regulation, developing a retention policy can be difficult within the organization, because different people have different perspectives on what is important to keep and for how long. Ferris believes that this will ease over time. “In the fullness of time, most organizations will keep almost all of their electronic content (excluding spam, for example) for an arbitrarily long period because of the cheapness of storage, the expense of deleting material, and the value of holding on to material in case it is useful. Retention policies will gradually become less of a burning issue.”

Published November 24, 2009