Email retention and the Law

Paddyo

Hi

Is there any law in Ireland which states that a company must retain email for a certain length of time?

If so can someone point me in the direction for this law.

I have been looking and I cannot find details anywhere

Many thanks

Paddyo

The Apprentice

Ive never heard of such a thing.. ?

What would this be in relation too ? or have you any examples of why you would need this. Ive seen and heard my engineer friend keeping them but that's for saving their own arse when projects are going tits up ..

kippy

The Apprentice wrote: »

Ive never heard of such a thing.. ?

What would this be in relation too ? or have you any examples of why you would need this. Ive seen and heard my engineer friend keeping them but that's for saving their own arse when projects are going tits up ..

There are laws in relation to this for certain types of company/organisation.
Financial Institutions and Government bodies being two areas that have rules pertaining to this (from working in both in the past)
I have no idea where the law part of it comes from but in the financial side of it I assume it would come from something like Sarbanes Oxley Compliance or something similar and in the government side probably under FOI or Data protection.

Paddyo

Hi The Apprentice

I have no idea if there is such a thing.

Its a question I was asked and having found nothing in searches, I though I would ask here.

Thanks to you and Kippy for your replies

Paddyo

kippy

Paddyo wrote: »

Hi The Apprentice

I have no idea if there is such a thing.

Its a question I was asked and having found nothing in searches, I though I would ask here.

Thanks to you and Kippy for your replies

Paddyo

http://www.techrepublic.com/article/what-the-sarbanes-oxley-act-means-for-it-managers/5034345
There is mention there about email retention. I think the SoX act has been replaced since but I do think there are some pointers about email retention.

The Apprentice

Fair Play kippy i can see now where it could come into play and how data protection namely emails must be kept/recorded .. expecially now with finanicial organisations being investigated because of abuse.

It mentions data size, of keeping emails and retention over long periods.. i think this could be a whine with 12tb storage availalbe on nas drives for under €300 but it makes interesting reading all the same.
You learn something new everyday.

kippy

The Apprentice wrote: »

Fair Play kippy i can see now where it could come into play and how data protection namely emails must be kept/recorded .. expecially now with finanicial organisations being investigated because of abuse.

It mentions data size, of keeping emails and retention over long periods.. i think this could be a whine with 12tb storage availalbe on nas drives for under €300 but it makes interesting reading all the same.
You learn something new everyday.

Most of the bigger financial organisations that this type of thing pertains to would use pretty significant SANS for this type of storage/backup.

bennyineire

Howdy all,

Sorry to resurrect an old thread but I have recently been tasked with writing an email retention policy.

Has there been any updates legally since this thread was last commented on

kippy

bennyineire wrote: »

Howdy all,

Sorry to resurrect an old thread but I have recently been tasked with writing an email retention policy.

Has there been any updates legally since this thread was last commented on

Not as far as I am aware but something big may be coming down the tracks shortly in the form of the GDPR. Worth a google.

Mrs OBumble

GDPR doesn't say how long you retain any data. It just has some principles that you need to follow.

For email, as with any other business records, you need to keep them for certain amounts of time depending on what they're about. Eg financial records for the amount of years required by Revenue.

The challenge is sorting out what emails are what sort of records

kippy

Mrs OBumble wrote: »

GDPR doesn't say how long you retain any data. It just has some principles that you need to follow.

For email, as with any other business records, you need to keep them for certain amounts of time depending on what they're about. Eg financial records for the amount of years required by Revenue.

The challenge is sorting out what emails are what sort of records

GDPR has a direct impact on the retention of data.

bennyineire

Yep I'm aware of the upcoming GDPR , I'm doing a foundation course on it in September
https://www.itgovernance.eu/shop/product/certified-eu-general-data-protection-regulation-foundation-gdpr-training-course

Maybe I'll wait until I do that before writing the policy