Email Retention and Legal Hold for Small Businesses

How long should a Singapore business keep email?

There is no single law that says "keep email for X years". Instead, email that forms part of your business records falls under record-keeping rules, and email that might be evidence matters for the time limits on legal claims.

IRAS's record-keeping page says records must be kept for at least 5 years from the end of the accounting period. Section 6 of the Limitation Act says actions founded on contract or tort cannot be brought after 6 years from the date the cause of action accrued. Many SMEs therefore choose 6 or 7 years for mailboxes that handle contracts and finance. Check with your lawyer if your sector has its own rules.

Balancing retention with PDPA

Keeping everything forever feels safe, but it creates a different risk. Under the PDPA, organisations must stop keeping personal data once the purpose is no longer served and there is no legal or business reason to keep it. A ten-year-old mailbox full of customer NRIC details, addresses and complaints is exactly what makes a data breach worse.

Our data retention policy template gives a simple table you can adapt for email, files and paper records.

Microsoft 365: retention policies and legal hold by plan

Microsoft's Purview service description lists Business Premium among the licences that include organisation-wide retention policies. For Exchange mailboxes, Exchange Online Plan 2 or the Exchange Online Archiving add-on also qualify. The Exchange Online Archiving service description says Business Premium already includes archiving, while Business Basic and Standard can add it.

A litigation hold preserves everything in a mailbox, including items the user deletes and original versions of edited items, either indefinitely or for a set number of days. For leavers, Microsoft's inactive mailbox guidance recommends using Microsoft 365 retention policies or labels, and notes that older In-Place Holds are retired.

Google Workspace: Vault for retention and holds

In Google Workspace, retention rules and legal holds live in Google Vault. Vault is included from Business Plus upwards, not in Business Starter or Standard; our Starter vs Standard comparison covers the plan differences and prices.

• Retention rules: keep Gmail and Drive data for a set period, then allow deletion.
• Holds: preserve a specific user's or group's data indefinitely for a dispute, overriding retention rules.
• Search and export: find and export messages for lawyers or regulators.

Departed staff mailboxes: the right order

This is where most small businesses lose email. Microsoft's inactive mailbox guidance explains that when you delete a user, their mailbox is kept for 30 days and then permanently removed, unless a hold was applied before deletion, in which case it becomes an inactive mailbox that admins can still search.

1. 1

   Block sign-in and reset the password

   Do this on the last day so the leaver cannot access mail.

2. 2

   Decide the retention need

   Finance, sales and management mailboxes usually need the full 5 to 6 year period; others may need only months.

3. 3

   Apply a retention policy or hold if needed

   Before deleting anything. In Microsoft 365 this needs Business Premium or the archiving add-on; in Google, Vault on Business Plus or above.

4. 4

   Give the manager access to what they need now

   Convert to a shared mailbox (Microsoft 365, free up to 50 GB) or delegate access, so ongoing customer emails are not missed.

5. 5

   Remove the licence or delete the user

   Only after the hold is in place. In Microsoft 365 the mailbox then becomes inactive and does not need a licence.

6. 6

   Record what you did

   Note the date, the hold or retention applied, and when it can be released.

Our guides for Microsoft 365 leavers and recovering deleted emails cover the clicks in each admin centre.

When a dispute is likely: legal hold checklist

Once you expect a claim, for example a customer threatening to sue, a dismissed employee's complaint or a supplier dispute, normal deletion should stop for the people involved. Deleting relevant email after that point can damage your position.

A hold keeps data but does not protect against an admin deleting the whole tenant or a ransomware attack on synced files. A separate backup covers that; see our guide to backing up Microsoft 365 and Google Workspace.

Do it yourself or get help?

An admin on Business Premium or Business Plus can set a basic retention policy and know how to apply a hold in an afternoon. Mixed licences, leavers already deleted, shared mailboxes over 50 GB, or an active dispute are where help avoids mistakes that cannot be undone.

Our Microsoft 365 / Google Security Lockdown (S$590) includes retention and leaver settings alongside MFA and sharing controls. Backup & Ransomware Recovery (S$290) adds independent backups so you can restore mail, not just preserve it. IT Sorted is a Singapore-based team of developers with over 10 years of experience. You pay upfront, send your brief in writing through the site chat or contact form, and track progress on your order page. This guide is general information, not legal advice.