Internet, Email & Telephones > Email & Communication Services

Archiving emails

By Lasa Information Systems Team

Email is a vital communication method for third sector organisations. But how do you ensure that you keep them in a readily accessible manner and satisfy legal requirements?

A question was asked on the UKRiders mailing list: “What do organisations do about archiving emails in practice? As I understand the legal position, emails are written documents and so can commit an organisation to a contract, libel people and so on. For this reason they should be kept for six years, the limit of civil liability, in case of legal action.

My impression is that emails are very seldom actually archived like this. Is this for good reasons (organisations assess the risk and believe it to be negligible) - or bad ones (it’s one more complicated thing to do so it falls off the end of the agenda)? Are organisations ever really taken to court on the basis of five-year-old emails?”

What’s the issue?

It is a serious issue, although generally not taken seriously by smaller organisations. The fact is that it is highly unlikely one in a million emails will be needed, but essential that anything contractual or human resource-related is saved as that is what is possibly a liability. So do you selectively save from the people who might have emails of this nature, or (horrible solution) make sure they get printed or what? Do organisations who have  in house email management keep six years worth of backups? Technically - and legally - you should but...

What tools or procedures are available to help?

There are a number of ways of dealing with archiving ranging from practical methods and policies using existing systems to specialist software and services. Some peripheral emails are troublesome to archive, specifically emails sent by a member of staff to and from personal accounts and mobile devices that keep separate folders. It's not always possible to catch them all. Perhaps a public folder or something of that nature could be set up to catch the important mail – however, this depends on staff actually doing this which may not be a priority for them.

For smaller organisations

A possible method for small organisations or individuals is when closing a project to copy all the related e-mails - without trying to sort out which are worth keeping - into a normal folder within the project folder, along with all the other documents, and archive the lot to (a) an archive on a spare hard drive and sometimes (b) a CD or DVD as well.  One thing to remember is to be sure to include sent e-mails as well as received ones. Copying and dragging the e-mails straight into a folder is quick and easy, and they can easily be restored as required.

For larger organisations

The least troublesome methods require no intervention from users. For example, Lasa uses Microsoft Exchange with a commercial archiving product on top called GFI MailArchiver, which takes copies of all e-mails (internal, external, inbound, outbound) and archives them away from Exchange Server in a SQL database. You can specify certain sorts of e-mails which are not saved (e.g. backup confirmation e-mails, spam, list mail and WAV format e-mails from our voicemail software). It’s searchable from within Outlook, but runs a bit slower than looking through an inbox.

That way everything is saved, but it doesn’t clog up Exchange or rely on Outlook's archiving (which by default archives to the local disc which is not a good idea) and means you can clear out mailboxes of ex-staff members after a suitable period in the knowledge that it's all still in the archive. The mail in the archive SQL files are arranged by year so can be deleted after six years if necessary and are backed up online and onto our internal NAS drive.

What's not archived

However, even with GFI MailArchiver on Exchange, you may not be able to capture all emails. For instance, if a user uses a smartphone that maintains its own "sent items" folder, that may not be captured by Exchange hence it won't be archived. This is the Achilles heel of efforts to archive emails for compliance with the 6 years rule. Essentially, this then comes down to organisational policy – if you are emailing something that has legal, financial or contractual content then make sure you do it from within the email system.

Other alternatives

Other alternatives to GFI include Mail Store (available for 30 day trial and at charity rates from Zen Software who also run a weekly webinar on Mail Store) and Symantec's Enterprise Vault.

The cloud is also bringing alternatives to traditional internal systems. For example, a zero hardware solution, fully hosted in the cloud  is Google Apps which has 10 year message archiving through Postini. It takes all the maintenance / hardware / location issues off your hands, and is a straightforward monthly fee. $83 USD for Google Apps Premier and Postini 10 year retention, per user, per year.

The obligatory data protection warnings

Don't forget that you may have to provide copies of emails you hold in response to a Data Protection Act subject access request.

A related but potentially huge issue then is - do you keep a record of where you got every email sign up for your e-newsletters? You may well be asked "why are you emailing me, where did you get my email from?" and under the DPA you should be able to prove  that they opted in.. whether that is from a form going into your email system like CharityeMail or CTTM@iler, and the system capturing the data, or them emailing you and you keeping it... It's the same as Gift Aid but not yet as regulated.. you have to be able to prove sign up.

Credit where it's due

Thanks to Colin Wilson for asking the original question and Esther Regenwetter, Paul Ticher, Stony Grunow, Norman Leach, Tim Watkins-Idle and Sue Fidler for replying –  edited, abridged and expanded by Lasa Information Systems Team.