Do You Need to Keep Employee Emails After They Leave?

Yes — in most cases you need to retain a departed employee's email for years after they leave, not days. Financial records legislation typically requires 7 years, litigation holds can extend that indefinitely, and client-matter correspondence often has its own retention rule attached to the file, not the person who wrote it. Deleting the mailbox on their last day is one of the more common compliance mistakes small firms make, and it usually happens quietly, as part of an IT offboarding checklist nobody has reviewed since it was written.

Here's how it typically plays out: an employee resigns, IT revokes their license and deletes the mailbox within 48 hours to free up the seat and reduce the attack surface. Three months later, a former client disputes advice given by that employee, or a regulator asks for correspondence relating to a file they worked on, or a discrimination claim references an internal exchange. The firm goes looking for the emails and finds nothing — because the deletion happened before anyone checked whether a retention obligation applied.

What retention actually requires

The obligation doesn't disappear when someone leaves your firm — it attaches to the record, not the employment relationship. In Australia, the Corporations Act 2001 (Cth) s286 requires financial records to be kept for 7 years, and correspondence that evidences a transaction counts. Law firms carry an added layer: NSW's Legal Profession Uniform Law and equivalent rules in other states typically require client files — including the emails in them — to be retained for 7 years after a matter closes, regardless of whether the solicitor who ran the file is still employed. The Fair Work Regulations 2009 (Cth) separately require certain employee records to be kept for 7 years, though this is narrower than general correspondence.

In the UK, the position is similar in spirit but different in mechanics. The Limitation Act 1980 gives most contract claims a 6-year window, and financial services firms under FCA rules face specific record-keeping periods on top of that. GDPR adds a real wrinkle: personal data shouldn't be kept longer than necessary for the purpose it was collected for. That's not a reason to delete early — it's a reason to have a defined retention schedule rather than keeping everything forever "just in case," which is its own compliance exposure.

Then there's litigation hold, which overrides ordinary retention schedules entirely. Once a dispute is reasonably anticipated — a demand letter, a complaint, a departing employee who left on bad terms — you have an obligation to preserve relevant records, including email, even if your normal policy would allow deletion. Destroying records after that point is spoliation, and courts in Australia, the UK and the US treat it harshly: adverse inference directions, cost penalties, and in serious cases, sanctions against the firm directly.

What most small firms actually do

Offboarding checklists are written for security and licensing, not compliance. "Delete mailbox" sits next to "revoke building access" and "collect laptop," and nobody flags that email might be evidence in something that hasn't happened yet. Some firms go the other way and just leave dormant mailboxes sitting in the tenant indefinitely, paying for unused licenses and creating an unmanaged pile of data with no retention logic behind it at all — which is its own GDPR and discovery problem. Neither approach is a policy. Both are just the absence of one, and they tend to surface at the worst possible moment: mid-audit, mid-dispute, or mid-discovery request.

What good looks like

An audit-ready approach separates the record from the person. Email is captured continuously, as it's sent and received, into an archive that exists independently of the live mailbox — so a departure is a non-event for retention purposes rather than a trigger for a manual decision under time pressure. The archive needs to be tamper-evident, meaning nobody, including IT, can quietly edit or delete an entry without it being detectable. Full headers, timestamps, and attachments need to be preserved, not just the message body — metadata is often what a regulator or opposing counsel actually wants. Sent mail matters as much as received mail; a lot of firms archive inbound and miss outbound, which is backwards, since outbound is usually the advice that gets scrutinised.

Retrieval speed matters too. If a search request takes a week of digging through PSTs a departed employee happened to export before they left, that's not really an archive — it's a hope. And the system needs a retention schedule with teeth: records held for the required period, then deleted on schedule, with holds that can be applied to specific custodians or matters when a dispute becomes likely, and released cleanly once it resolves.

The practical path forward

Start today: stop deleting mailboxes on departure. Change the offboarding checklist to "suspend and archive," not "delete," and make that change now — it costs nothing and closes the biggest single point of exposure. Next, set a retention schedule by record type (financial, client-matter, general correspondence) rather than one blanket rule, since the periods genuinely differ. If you're in the middle of a dispute or one looks likely, apply a hold to that person's mail before you do anything else with their account.

For the ongoing piece, manual tracking doesn't scale past a handful of departures a year — someone has to remember who left, what their hold status is, and when their retention period lapses, and that person eventually gets it wrong. This is the gap AutoArchive Mail is built for: it captures mail continuously and independently of the mailbox, applies retention and hold rules automatically per employee or matter, and keeps the record searchable long after the account itself is gone. You can start a free trial to see how it handles a departure without anyone having to remember a checklist item. If your firm has fewer than 10 people and limited litigation exposure, a documented manual process — a spreadsheet tracking hold status, checked before any deletion — may genuinely be enough for now.

One thing this article doesn't cover: the specific limitation periods for employment claims like discrimination or unfair dismissal, which vary by state and country and are often shorter to file but require longer retention to defend properly. If a departure was contentious, get specific advice from an employment lawyer before deleting anything, regardless of what your general retention schedule says.