Email archiving: Regulations and solutions companies should know about

We all send emails. In fact, we send an awful lot of emails every single day. In 2015, the total number of emails sent and received worldwide exceeded 205 billion a day, with the average user partaking in 122 business-related email exchanges a day. Email is now a far bigger form of communication than postal letters; but if we all understand the importance of storing bank letters and receipts, why don’t we do the same for emails too? The truth is, if you’re operating a business, the law requires you to archive emails. Different countries have different rules and regulations regarding mail archiving, so it’s important to know where you stand. We’ll take you through the dos and don’ts of email archiving, focusing on the governing laws for Canada and the US.

Canadian laws on email archiving stem from 2 principle regulations: the Personal Information Protection and Electronic Documents Act and the Canadian Sarbanes-Oxley Act. The Investment Industry Regulatory Organization of Canada, founded in 2008, is the body responsible for enforcing these restrictions. 

The 1934 Act (full title: The Security Exchange Act of 1934) mainly dictates that records must be kept for any security exchanges. These exchanges usually involve stocks, and some of the largest and best-known of these include the New York Stock Exchange, the American Stock Exchange, and the Pacific Stock Exchange. Though not specifically defined, the ‘records’ that must be kept are very broadly defined, which would almost certainly cover emails if it came to a legal dispute. These records have to be kept for a minimum of 6 years, and the Securities and Exchange Commission (SEC) has the right to impose fines if records can’t be produced within a given time frame. The highest profile case of this was in 2002, when the SEC, acting in conjunction with the New York Stock Exchange (NYSE) and the National Association of Securities Dealers (NASD), fined 5 companies a total of 8.25 million US dollars for failing to comply with the 1934 Act. The parties involved included Goldman, Sachs & Co., Morgan Stanley & Co. Incorporated, and Deutsche Bank Securities Inc. The firms each paid 1.65 million USD, to be shared between the NYSE, NASD, and the US Treasury.

The basic rule is to be sure to store any emails that could potentially be used as evidence in any current or future lawsuits, either against you or in your defense. But it’s not enough to simply “store” these emails, you also have to know:

• Exactly where the data is saved
• The archiving technology used to store emails
• The archiving schedule (how quickly are files added? Are they added on a particular day/at a particular time? How many years are they stored for before they’re eventually deleted?)
• How the email recycling process works (Do files stay on the server after archiving?)
• The search function/process used to locate emails
• How long it would take to produce emails for evidence
• The different formats you could produce the emails in

These are all questions you could be asked to answer in cases of a potential lawsuit. Remember: If you can’t answer these questions when required, you’re breaking the law. And if you can’t locate and submit these emails in a quick and easy manner, you’re in danger of being subject to legal action yourself.

On a daily basis, sensitive information like invoices, contracts, and internal business content is sent via email. So, it’s important to have a solid archiving solution in place to ensure that this data can always be retrieved.

There are three main ways to archive emails: Third-party solutions, on-site solutions, and cloud-based solutions. Third-party solutions host your email archive through outsourcing, meaning that the business doesn’t have to bear the cost of hardware or software. On-site solutions, on the other hand, require you to handle your own archiving, through the use of external software. Nowadays, companies are increasingly focusing on cloud-based solutions. This type of solution typically means lower entry costs and a simple monthly subscription charge. Most of the leading email archive solution providers, like Veritas Enterprise Vault, Barracuda Message Archiver, and EMC SourceOne offer two or even all three of these methods. These email archiving solutions collect your emails in two different ways: they either take content directly from your mail server (this process is known as journaling), or they copy your emails while they are being sent/received. These archives also feature a search function, allowing you to locate important emails quickly in cases of emergency. However, a cloud-based solution also means that all data will be located on the provider’s system together with other companies’ data. If another company gets hacked, your information could also be compromised.

Once you’ve chosen an archiving solution, we recommend that you outline a clear policy to pass onto employees. Since email archiving may seem trivial to some people, you should explain the key points behind it. We suggest you mention:

• The importance of archiving emails
• Where emails will be archived
• How long emails will be stored for (and why)
• Which emails will be kept and which can be deleted
• The person/company responsible for the email archiving, with a point of contact for enquiries

By doing this, you will ensure that all your employees understand the importance of email archiving and cooperate to help your company avoid a potentially sticky situation in future.

Emails have been around a while now, becoming our biggest form of communication in the workplace. As a result, it’s crucial that you know the archiving laws in your state and follow them. Failure to do so could result in severe penalties, like large fines, a damaged reputation, and in some cases even prison sentences. But email archiving isn’t just important because it’s required by law: there are many benefits to having an extra storage system for older emails. You can free up server space, boosting speed and efficiency, and you don’t have to panic if you accidentally delete an email either. By choosing a solid email archiving solution, you can take the pressure off and let a third party handle your archives. Alternatively, you can choose to keep your email archiving on site, equipping your IT department with the perfect tools to take care of it. Whichever way you choose to handle mail archiving, you can be sure that having a good policy in place will save you a lot of stress and potentially a nasty penalty in the future.