Email Retention Policies: What You Need to Know

Akins IT • May 4, 2016
Connect with us

After awarding a $500 million iPad contract, emails surfaced demonstrating that former Los Angeles Unified School District (LAUSD) superintendent had begun meeting personally with Apple and Pearson a year before the contract went out to public bid. The FBI is now sorting through old emails as evidence and LAUSD has announced recently that it will double the amount of time emails are saved to two years. 


Companies that cannot produce electronic documents, including emails, during the process of legal discovery are generally disfavored in court. At times, the inability to produce such documents may even be seen as destruction of evidence. A good email retention policy can protect against this.


An email retention policy determines how long emails will exist in your archiving solution before being automatically deleted. Even beyond a working email retention policy, you should consider using legal holds which allow you to prevent particular mailboxes or messages from being automatically deleted from the email archiving system.


Why it’s a big deal: In a nutshell, an email archiving policy reduces your risk for liability. Your industry may even be regulated by federal or state laws requiring that you maintain emails for a specific period of time. Even within industries the details of the laws and regulations may have nuances depending on the type of work being performed or area of expertise so it’s important to take the time to really familiarize yourself with them. The chart below lists out some of the regulated industries.


You can start to build a best practice retention policy with these few tips:


  1. Determine what regulations apply to your organization and start with those as minimums
  2. Segment to avoid keeping everything for the legal maximum. You can segment by content (for example, you might have different policies for sales records, invoices, etc.). You can also segment by department or use- for example, human resources, executive emails, marketing, etc.
  3. Consider other department and business needs
By Shawn Akins October 20, 2025
October 20, 2025 — Early today, Amazon Web Services experienced a major incident centered in its US‑EAST‑1 (N. Virginia) region. AWS reports the event began around 12:11 a.m. PT and tied back to DNS resolution affecting DynamoDB , with mitigation within a couple of hours and recovery continuing thereafter. As the outage rippled, popular services like Snapchat, Venmo, Ring, Roblox, Fortnite , and even some Amazon properties saw disruptions before recovering. If your apps or data are anchored to a single cloud, a morning like this can turn into a help‑desk fire drill. A multi‑cloud or cloud‑smart approach helps you ride through these moments with minimal end‑user impact. What happened (and why it matters) Single‑region fragility: US‑EAST‑1 is massive—and when it sneezes, the internet catches a cold. Incidents here have a history of wide blast radius. Shared dependencies: DNS issues to core services (like DynamoDB endpoints) can cascade across workloads that never directly “touch” that service. Multi‑cloud: practical resilience, not buzzwords For mid‑sized orgs, schools, and local government, multi‑cloud doesn’t have to mean “every app in every cloud.” It means thoughtful redundancy where it counts : Multi‑region or multi‑provider failover for critical apps Run active/standby across AWS and Azure (or another provider), or at least across two AWS regions with automated failover. Start with citizen‑facing portals, SIS/LMS access, emergency comms, and payment gateways. Portable platforms Use Kubernetes and containers, keep state externalized, and standardize infra with Terraform/Ansible so you can redeploy fast when a region (or a provider) wobbles. (Today’s DNS hiccup is exactly the kind of scenario this protects against.) Resilient data layers Replicate data asynchronously across clouds/regions; choose databases with cross‑region failover and test RPO/RTO quarterly. If you rely on a managed database tied to one region, design an escape hatch. Traffic and identity that float Use global traffic managers/DNS to shift users automatically; keep identity (MFA/SSO) highly available and not hard‑wired to a single provider’s control plane. Run the playbook Document health checks, automated cutover, and comms templates. Then practice —tabletops and live failovers. Many services today recovered within hours, but only teams with rehearsed playbooks avoided user‑visible downtime. The bottom line Cloud concentration risk is real. Outages will happen—what matters is whether your constituents, students, and staff feel it. A pragmatic multi‑cloud stance limits the blast radius and keeps your mission‑critical services online when one provider has a bad day. Need a resilience check? Akins IT can help you prioritize which systems should be multi‑cloud, design the right level of redundancy, and validate your failover plan—without overspending. Let’s start with a quick, 30‑minute review of your most critical services and RPO/RTO targets. (No slideware, just actionable next steps.)
By Shawn Akins October 13, 2025
How a Zero-Day in GoAnywhere MFT Sparked a Ransomware Wave—and What Mid-Sized IT Leaders Must Do Now
By Shawn Akins October 13, 2025
The clock is ticking: Learn your options for Windows 11 migration, Extended Security Updates, and cost‑smart strategies before support ends.
More Posts