A subpoena arrives. A malpractice claim surfaces. A HIPAA complaint or FTC review raises questions. The request sounds simple: “Turn over all emails related to this matter.”
Then comes the uncomfortable question: Where are those emails, and can you find and preserve them?
For many small and midsized firms, the answer depends on whoever happens to remember an old inbox, a former employee’s mailbox, or a file saved on a desktop. That is not a records policy. It is a gamble with your time, your clients’ confidence, and your firm’s ability to respond.
Email retention means a plan, not just a mailbox full of messages.
A retention policy defines what records you keep, where they live, how long you keep them, and when they can be securely deleted. A legal hold is different: it pauses ordinary deletion when relevant information must be preserved. Both need clear ownership and reliable processes.
“Hey Margaret, Do We Still Have Those Emails?”
It starts innocently. A partner asks the office manager, “Hey Margaret, can you find the emails from the attorney who left three years ago?”
Margaret searches her inbox. Someone checks an old laptop. Another person remembers that messages may have been forwarded to a personal Gmail account. Meanwhile, nobody knows whether automatic deletion is enabled, or whether it stopped working after a Microsoft 365 change.
This is what happens when the informal rule is “it’s in someone’s inbox.” People leave. Mailboxes change. Messages move to phones, shared drives, practice-management systems, and personal accounts. When a request arrives, your firm must identify the right records without knowing all the places they could be.
Keeping Everything Forever Isn’t a Retention Policy
The opposite approach sounds safer: never delete anything. But email hoarding creates its own risks. It increases the amount of sensitive information you must protect, expands what may be responsive to a future request, and makes searches slower and less reliable. And it does not tell staff what belongs in an official file, what to preserve, or when disposal is appropriate.
Think of retention like keeping financial books or medical charts. A disciplined process records what matters, keeps it for the right period, and disposes of it properly. “Save everything” is not the same as a retention schedule, and it cannot override a legal hold.
Your schedule should reflect your firm’s work, applicable jurisdiction, industry requirements, and client or engagement agreements. For example:
- Law firms should consider client-file and communication obligations, engagement terms, professional guidance, and the risk of losing relevant electronically stored information once a duty to preserve arises.
- Medical practices should distinguish patient records from compliance documentation. HIPAA requires retention of certain records for defined periods, which vary by provision and state; it does not create one universal retention period for every patient chart. See the HIPAA documentation standard.
- Accounting and financial firms should account for tax and recordkeeping expectations, client obligations, and applicable GLBA compliance requirements. Firms subject to the FTC Safeguards Rule should address data retention and secure disposal in their written information security program.
There is no one schedule that fits every firm. Have qualified counsel help determine what applies to your records and jurisdictions.
A Legal Hold Changes the Rules
A legal hold, also called a litigation hold, is an instruction to preserve potentially relevant information. The duty to preserve can arise when litigation is reasonably anticipated, not only after a lawsuit is filed. A demand letter, credible claim, investigation, or other event may require prompt attention. Ask your counsel to assess the facts and advise when a hold is necessary.
Once a hold applies, ordinary deletion may need to stop for relevant records and custodians. That includes email, attachments, shared files, and other communications identified by counsel. An automatic deletion setting that continues to remove relevant messages could create serious preservation problems and may become evidence in a dispute.
A hold needs more than a quick instruction to “save everything.” Someone must identify custodians and systems, document the scope, notify the right people, confirm they understand, and track the hold until counsel authorizes its release. The ABA’s guidance on preserving electronically stored information offers useful context for why written procedures matter.
Microsoft 365: Check What Your Tenant Actually Does
Microsoft 365 provides tools for retention and eDiscovery, but having a tenant does not automatically mean your records are retained in the way your firm needs. Mailbox settings, retention policies and labels, legal holds, and eDiscovery capabilities serve different purposes. They also depend on configuration, available features, and licensing.
A setting that keeps a copy of deleted mail is not necessarily a records schedule. A retention policy is not automatically a case-specific hold. And the tools available in your tenant may not match assumptions made when it was first set up.
Microsoft Purview eDiscovery can help authorized users search, preserve, and export information across supported Microsoft 365 locations. The exact capabilities and licensing depend on your environment and change over time. Review Microsoft’s current eDiscovery documentation, then verify your actual setup with a qualified IT professional.
Before relying on Microsoft 365 for a response, ask: Are former staff mailboxes still accessible? Are shared mailboxes included? Can you search and export the information you need? Do your retention policies match counsel’s schedule? A practical IT assessment can surface gaps before they become urgent.
DIY or Managed Support? The Trade-Offs
Doing it internally can work when you have documented policies, a knowledgeable administrator, time to test the configuration, and a clear owner. You retain direct control and may avoid outside service costs. But configuration is easy to misunderstand, staff turnover can leave no one who knows how it works, and undocumented settings can be difficult to defend or reproduce.
Working with a managed services provider can bring technical experience, documented procedures, and regular review. A provider may help configure Microsoft 365, test search and export workflows, and integrate retention with broader business continuity and security planning. But technology support cannot decide legal retention periods or replace counsel. You still need clear business ownership, legal guidance, and employee cooperation.
Seven Steps to Improve Email Retention Readiness
Start with the basics. Make them repeatable.
-
Inventory where records live. Include Microsoft 365, shared mailboxes, retired staff accounts, mobile devices, forwarded copies, personal accounts, Teams, file-sharing tools, and practice-management or accounting systems. Good IT asset management includes knowing where business information resides, not just which devices you own.
-
Build a simple retention schedule with counsel. Identify record categories, applicable rules, the event that starts the retention period, and how authorized disposal happens. Document exceptions for client agreements, audits, investigations, and legal holds.
-
Configure your tools to match the schedule. Review Microsoft 365 retention policies and labels, eDiscovery options, access permissions, and licensing. Do not assume your default settings are your policy.
-
Write a legal-hold procedure. Name the person who contacts counsel, the staff member responsible for technical preservation, and the leaders who identify custodians. Include instructions for acknowledging and following a hold, and for releasing it only with authorization.
-
Train staff not to work around the process. Personal Gmail, text messages, and unapproved file-sharing may put client or patient information outside your controls. Explain the approved channels and how to report a hold notice or preservation request.
-
Test search and export. Run a controlled exercise. Can you locate relevant messages, identify their source, and export them in a useful format? Record what worked and what needs fixing.
-
Review annually and after major changes. Revisit the schedule, employee responsibilities, Microsoft 365 configuration, and vendor systems. An IT audit or IT consulting engagement can help assess whether your controls still match your operations.
Email retention also connects to email security. Archived messages remain valuable targets for phishing and business email compromise, especially if they contain sensitive client details or old conversations that could be exploited in a convincing reply. Protect retained data with appropriate access controls, monitoring, and staff awareness.
And remember: retention is not backup. Retention helps manage records over time and preserve selected information. Backups support recovery after accidental deletion, ransomware, or system failure. They serve different purposes. Your disaster recovery and business continuity plans should account for both.
Final Word
When the request is “turn over all related emails,” you want a documented answer, not a round of frantic inbox searches. A practical retention schedule, a tested hold process, and secure, well-managed systems are inexpensive safeguards against disruption and preventable uncertainty.
Whether you need Microsoft 365 support, IT support for small business, or a complete outsourced IT partner, the right next step is to understand what your environment actually retains and how quickly you can find it. A PC of Mind helps professional firms assess and strengthen their technology through cybersecurity services and direct consultation.
This article provides general information, not legal advice. Retention periods and legal-hold obligations vary by jurisdiction, industry rules, and engagement or retainer agreements. Consult qualified legal counsel for a retention schedule and guidance on specific holds.
