"We'll Deal With It Later": Why That's the Costliest Line in Compliance

The practice manager remembers saying it clearly: "We'll sort out proper archiving once we're through this financial year." That was in 2022. In March 2026, a former client's lawyer sent a letter requesting all correspondence relating to a property settlement from that same year — and the firm's IT contractor spent four days establishing that the emails existed somewhere across two staff laptops, a departed paralegal's Outlook profile, and a Google Workspace account that had been partially migrated in 2023. Nobody had done anything wrong. Nobody had deleted anything maliciously. The firm just never got around to the thing it always meant to get around to.

This is the actual shape of most email compliance failures. Not a scandal, not a cover-up — a task that kept losing to whatever was more urgent that week, until the day arrived when "later" was no longer an option.

What the obligation actually requires

For Australian law firms, retention obligations aren't optional planning items — they're rules with commencement dates attached. Under the Legal Profession Uniform Law framework adopted in NSW, Victoria, and elsewhere, client files and related correspondence generally need to be retrievable for at least 7 years after a matter closes, and trust account records carry their own, often stricter, retention periods under state Legal Profession regulations. Accounting practices operate under the Corporations Act 2001 (Cth) s 286, which sets a 7-year minimum for financial records — and ASIC has shown it will act on firms that can't produce documents on request. Financial advisers face record-keeping duties under the Corporations Act and ASIC Regulatory Guide 175, plus, where relevant, AML/CTF Act obligations administered by AUSTRAC. UK firms answer to the SRA Standards and Regulations and, for anything client-money related, tighter still. None of this is exotic — but "all correspondence relating to the matter" includes email, and increasingly regulators, courts, and opposing counsel treat email as the primary record, not a supplement to the file note.

The penalty exposure isn't usually a headline fine. It's cost — an $8,000–$15,000 forensic recovery bill for a mid-sized dispute, an adverse discovery inference when you can't produce what the other side reasonably expects existed, or a regulator's finding that record-keeping systems were inadequate, which then colours every subsequent interaction with that regulator.

What most small firms actually do

The honest version: someone exports to a PST file when a mailbox gets full, a few key threads get manually saved into the client's folder on the shared drive, and everyone assumes Gmail or Outlook's own retention "just handles it" in the background. It doesn't — mailbox retention policies are usually tuned for storage management, not legal defensibility, and staff turnover means nobody remembers exactly what got migrated where. PST files in particular are a quieter liability than most firms realise — they're easy to lose, easy to corrupt, and nearly impossible to search reliably under time pressure. This works fine for years. It breaks exactly once, at exactly the wrong moment: a subpoena, an audit, or a partner departure where nobody's sure what's owed on the departing employee's mailbox.

What good looks like

An audit-ready archive isn't a bigger, better version of the shared drive folder — it's a different kind of system entirely. Four things distinguish it:

Continuous, automatic capture. Every sent and received email is archived at the point it moves through the mail server, not manually selected and filed by a staff member who's busy and occasionally forgets. Manual processes fail precisely because they depend on someone remembering, every time, for years.

Tamper-evident storage. If a record can be quietly edited or deleted after the fact, it doesn't hold up under scrutiny — a regulator or opposing counsel will ask how you can prove nothing was altered. Good archiving systems write once and log access.

Full metadata preservation. Headers, timestamps, delivery status, and attachments intact — not just the message body pasted into a document. Courts and regulators increasingly expect the full record, not a curated extract.

Fast, complete retrieval. When a request comes in — a subpoena, an audit, a client asking for their file — you need to search and produce results in hours, not days, and the search needs to cover sent mail as thoroughly as received. Most manual systems are asymmetric: inbound mail gets filed, outbound mail gets forgotten.

This is where a tool like AutoArchive Mail fits: it sits on your mail flow and captures every message automatically, into storage that's searchable and defensible, without relying on staff discipline to hold up for seven years straight.

The practical path forward

Start with what you can do this week. Audit where your firm's email actually lives right now — how many PST files, how many separate mailboxes, how much is genuinely in the cloud versus assumed to be. That's an afternoon's work, not a project.

Next, fix the leak, not just the archive. If email is still landing in a place nobody's capturing, adding a nice archive on top doesn't help. Set up automatic capture going forward — this is the part firms can genuinely do in about 30 minutes with the right tool, and it's worth doing before worrying about backfilling history. You can Start Free Trial to see what continuous capture looks like without committing budget first.

Then handle the backlog deliberately — a one-off project to consolidate old PSTs and departed-staff mailboxes into the same searchable system, rather than leaving them as separate risk pools. Loop in your IT provider or a compliance-literate lawyer if you're not sure what your specific retention period actually is, or if you're mid-merger, mid-migration, or facing an active dispute — those situations warrant a second opinion before you touch anything, including a provider switch that could affect existing archives.

One limitation

None of this replaces legal advice on your specific retention period — the 7-year figure varies by record type, state, and matter, and treating it as a universal default is its own risk. This article tells you how to stop deferring the setup; it doesn't tell you your firm's exact number.

← Back to all articles