Email archiving for businesses: what to keep from sent mail and for how long

From sent mail you keep what you may later need to prove something, and no longer than that requires. In practice that comes down to three categories: messages with evidential value (invoices, contract confirmations, cancellations) you keep as long as the underlying obligation runs; delivery logs you keep briefly, to be able to investigate problems; marketing mail you keep as a template, not per recipient. This article gives the practical breakdown; for your specific periods, consult your accountant or lawyer.

Why "everything forever" is not a policy

A mail server that keeps everything feels safe. Until someone makes an access request and you have to search ten years of outgoing mail for everything about that person. Or until there is a data breach and its scope is determined by everything you ever kept. The GDPR calls this storage limitation: you do not keep personal data longer than necessary for the purpose you collected it for. An order confirmation from eight years ago serves no purpose any more, and is therefore only risk.

The opposite is also a problem. Whoever wipes all outgoing mail after three months can no longer show, in a dispute about a delivery, what exactly was agreed.

Three kinds of sent mail, three regimes

1. Messages with evidential value

Invoices, order confirmations, contract confirmations, cancellations, payment reminders. Here the email is often the only trace of an agreement. The period follows from the underlying obligation: accounting documents have a statutory retention period in Belgium (usually several years; your accountant knows the current period), and contracts you keep as long as claims can still arise from them.

Practically: do not keep the email itself but the document. The invoice PDF in your accounting package is the supporting document; the email around it does not need separate archiving. Do keep the fact that it was sent and delivered, with date and address. That is exactly what a delivery log gives you.

2. Delivery logs

Per message: to whom, when, which subject, and what the receiving server answered (accepted, bounce, refusal). You need those logs to check what happened when there is a complaint, and to see patterns in bounces. They contain personal data (the email address) and therefore fall under the same principles, but their purpose is short-lived. A few months is ample for most businesses; whoever needs it longer must be able to say why.

An SMTP relay that logs deliveries, bounces and refusals gives you this without building anything yourself. Export what you want to keep as evidence for a specific file, and let the rest disappear according to the fixed period.

3. Marketing mail

Of a newsletter to 20,000 addresses you do not need to keep 20,000 copies. Keep the template and the sending list definition (which segment, which date), plus the statistics. What you do need to be able to show per person is the consent: when and how someone subscribed, and when they unsubscribed if they did. That is not an archive of mail but a register of consents, and you keep it as long as you mail that person plus a reasonable period afterwards, so you can answer a complaint.

A practical breakdown

• Accounting documents (invoices, credit notes): in the accounting package, according to the statutory period.
• Contractual correspondence (quotes, confirmations, cancellations): in the customer file or CRM, as long as the relationship and possible claims run.
• Delivery logs: on the sending platform, a fixed short period; only what you attach to a file is exported.
• Campaigns: templates and statistics indefinitely (no personal data), consent register per address as long as needed.
• System mail (password resets, verification codes): do not keep; only the log that they were sent, briefly.

What you write down

Put it in a short table: type of mail, purpose, where it is kept, how long, and who deletes it. That is what a supervisory authority or a customer requesting access wants to see, and it is also the only way to keep it consistent after a staff change. Add where the data physically resides: mail through a European platform with storage within the EU, such as 2Mail, makes that question easy to answer; with a processor outside the EU you have to justify the transfer separately.

An example

An installation company sends quotes and invoices through Odoo, and a monthly newsletter. The company keeps invoices in Odoo for the statutory period, quotes and confirmations in the customer file until two years after the last job, delivery logs for three months on the sending platform, and the newsletter subscription data as long as the address is on the list. In a dispute about an invoice not received, the company shows the invoice from Odoo and the log that the message was accepted by the customer's mail server on that date. Nothing more is needed.

Frequently asked questions

Do I have to keep the full content of transactional emails?

Usually not. The document inside it, or the data from which the mail was generated, is already in your system. The log that it was sent is usually enough. With transactional email that log is exactly what you get.

How long may I keep delivery logs?

As long as you can name a concrete purpose. For investigating complaints and delivery problems that is usually a matter of weeks to a few months.

What if a customer asks to delete everything?

Then you delete what you are not legally required to keep. Invoices stay; the newsletter subscription and the logs go. Explain which data you still keep and for what reason.