There is no single answer. Retention periods run anywhere from one to seven years depending on industry, record type, and jurisdiction. Some categories, like certain financial or government communications, get kept far longer than that. Sometimes permanently.
Financial Services: SEC and FINRA Set the Floor
Broker-dealers and investment advisors work under some of the strictest rules in any industry. SEC Rule 17a-4 requires most business records to be retained for a minimum of six years, the first two in an easily accessible location. FINRA imposes similar obligations on member firms.
Enforcement isn’t theoretical. In 2022, the SEC fined sixteen major financial firms a combined $1.1 billion for record-keeping failures tied to employees using personal devices and unapproved messaging apps for business communication. Sixteen firms. Over a billion dollars. The message was clear: retention policy has to cover every channel employees actually use, not just the corporate inbox.
Healthcare: What HIPAA Requires
HIPAA-covered entities must retain records related to protected health information for a minimum of six years from the date of creation or the date it was last in effect, whichever is later. That includes email containing patient information, referrals, and billing communications. State medical record laws sometimes extend that window further. The HIPAA minimum is a floor, not a ceiling.
How Long Do Government Agencies Need to Retain Email?
Public sector retention runs on different logic entirely. Government agencies have to weigh Freedom of Information Act obligations and state public records laws alongside their own operational needs. Records tied to senior officials or major policy decisions can carry retention periods measured in decades, sometimes permanently. Routine correspondence may qualify for shorter schedules. What decides it is usually whether an email reflects agency business, not who sent it or how casually it reads.
General Business Records: The Seven-Year Rule of Thumb
Outside regulated industries, tax and contract-related correspondence typically follows a seven-year retention window, aligned with IRS audit periods and typical statutes of limitation for contract disputes. Employment records fall under separate rules. The EEOC requires most personnel records be kept for at least one year, longer where state law or litigation risk suggests otherwise.
None of these numbers work as a policy on their own, though. A defensible retention schedule has to map every regulation that applies to the organization and reconcile the differences, because a litigation hold can override any of these timelines the moment a dispute becomes reasonably foreseeable.
Retention only works if it’s enforced consistently, not managed mailbox by mailbox. Messaging Architects helps organizations build retention schedules that hold up under audit and litigation, backed by the infrastructure our parent company eMazzanti Technologies puts in place. Read more retention guidance on our blog, or contact our team to map your industry’s requirements.
Frequently Asked Questions About Email Retention
How long should a business keep emails?
It depends on industry and record type. General business correspondence often follows a seven-year rule tied to IRS and contract limitation periods, while regulated industries like finance and healthcare have their own minimums.
How long must financial services firms retain emails under SEC rules?
SEC Rule 17a-4 requires most broker-dealer records to be retained for a minimum of six years, with the first two years in an easily accessible location.
How long does HIPAA require healthcare organizations to keep email records?
A minimum of six years from the date of creation or the date the record was last in effect, whichever is later. Some state laws extend this further.
Do government emails need to be retained differently than private business emails?
Yes. Public agencies weigh Freedom of Information Act and public records obligations, and retention periods for senior officials can run into decades or be permanent.
What happens to retention schedules during litigation?
A litigation hold suspends normal deletion schedules for relevant records the moment litigation is reasonably anticipated, no matter what the standard retention policy says.
