Corporate Email Archiving: Retention Periods and the Law
How long corporate email should be kept, what UK GDPR and HMRC require, and how Turkey's VUK and TTK rules differ; a practical archiving setup.
rabbitclip teamPublished: 5 min read
Short answer
In the UK there is no single fixed retention period for email under UK GDPR; the ICO expects a business to decide how long it actually needs the data for and to write that down in a retention schedule, though HMRC sets a six-year floor for tax-related records. In Turkey the same correspondence, if it counts as commercial correspondence, must be kept for at least five years under the Tax Procedure Law and at least ten years under the Turkish Commercial Code; where the two overlap, the longer period, ten years, applies.
A flooring manufacturer needing to produce an old email in a supplier dispute can find it already deleted because the employee's account was closed. Archiving means a copy held somewhere separate from the inbox; the record survives even after the account closes or the employee leaves.
What is email archiving, and how does it differ from backup?
Email archiving is keeping an unalterable, searchable copy of sent and received correspondence, usually in a system separate from the mailbox itself, for the long term. Backup is a short-term copy kept to restore a system after a disaster; the two serve different purposes.
Pulling a single email out of a backup three years later is usually not possible, or not practical; an archiving system is built for exactly that, searchable by date, sender or subject.
UK retention: what does ICO actually require?
ICO does not set one retention period for personal data in correspondence; it expects a business to write a retention schedule that names why each category of data is kept and for how long, and to review that schedule regularly. Keeping everything indefinitely 'just in case' is not, in ICO's own words, a lawful retention policy.
For tax-related records specifically, gov.uk's guidance for limited companies sets a six-year floor from the end of the relevant financial year; some documents, the company's statutory books, board meeting minutes, need to be kept for ten years.
How does Turkey's requirement differ?
Under Turkey's Tax Procedure Law (VUK), Article 253, anyone required to keep books must retain related documents for five years following the year they relate to. The Turkish Commercial Code (TTK), Article 82, extends that to ten years for commercial ledgers, inventories, opening balance sheets and other documents required to be kept.
When the two periods conflict, the practical answer is to follow the longer one; five years covers a tax audit, but ten years is the safer floor if the correspondence might ever need to serve as evidence in a legal dispute.
Setting up an archiving system
For a small business, archiving is less about complex software and more about discipline.
- A leaving employee's account is not deleted immediately; it is archived first, then closed after a defined period
- Correspondence that counts as commercial, contracts, orders, invoice-related emails, is kept in a separate folder or archiving tool
- Retention periods are tagged by document type; applying one blanket period to everything either deletes some records too early or keeps others far longer than needed
- The archiving tool needs to support search by date and sender; otherwise the archive exists in name only
Who gets access to whose email?
An employer's access to a staff member's mailbox is not unrestricted under UK GDPR or Turkey's KVKK; access needs a legitimate purpose, an investigation, account handover, a legal retention duty, and that purpose should be communicated to the employee in advance.
Personal messages mixed into a work inbox is common; an archiving policy needs to draw that line too, stating clearly that only commercial correspondence is kept long term, with personal content handled separately.
Common mistakes
Archiving is usually either never set up at all, or set up once and never followed up.
- Deleting a leaving employee's account immediately, losing commercial correspondence along with it
- Keeping every email indefinitely, which raises both storage cost and the risk in a data breach
- Leaving retention periods to individual judgement instead of a written policy
- Setting up an archive and never testing whether search and access actually work
Why does the archive matter in a dispute?
In a pricing dispute between a workwear manufacturer and a supplier, the strongest evidence handed to a court is usually not a contract but the emails exchanged at the time; when a delivery date was agreed, which price was actually confirmed, tends to sit in that correspondence. Without an archive, those emails are usually either already deleted or nobody can say which account they ended up in.
The same holds in an employment dispute; when a warning was actually issued, and in what terms, gets proved by the email record. Without an archive, the process falls back on who said what, which is a far weaker position.
Email archiving is not disaster backup; it is keeping legal and commercial evidence accessible over the long term. The right retention period, the right access rules and a searchable system are what actually matter in a dispute. A discovery call with rabbitclip is a good place to review your current email and archiving setup.
FAQ
Does email backup replace archiving?
No. Backup is built to restore a system, not to find one specific email years later; the two should run alongside each other.
How many years should UK businesses keep email?
There is no single figure for personal data; a written retention schedule based on actual need is what ICO expects. Tax-related records need at least six years under HMRC rules.
How long should Turkish businesses keep commercial email?
Ten years under the Turkish Commercial Code is the safer floor, even though the Tax Procedure Law's five years covers a tax audit on its own.
Should a leaving employee's mailbox be deleted straight away?
No. It should first be checked for commercial correspondence, archived if needed, and only closed afterwards.
Does an archive actually matter in a legal dispute?
Yes. It is not as binding as a signed contract, but email correspondence is concrete evidence of who said what and when; without archiving, that evidence is usually gone.
