The Retention Rule That Deleted the Evidence

How the pieces interact:

• Retention rule (90 days): Vault keeps messages for the configured period, then they can be purged. Default retention governs data not under hold.
• Legal hold: Overrides retention - held data is preserved beyond the retention period until the hold is removed. Holds are per-custodian (or per-matter) and protect that custodian's data.
• Deletion: Deleting a user account does not automatically preserve their data forever; once retention expires and no hold exists, data becomes unrecoverable through Vault.

Situation-by-situation:

1. Custodians under legal hold (employment dispute): Their data is preserved regardless of the 90-day rule. Recoverable. Do not release the hold until legal says so.
2. 'Keep everything 7 years' regulated dataset: The current 90-day rule does not do this. You need a separate retention rule scoped to that dataset/custodians with a 7-year period (or as the regulation requires). As configured today, that data is being purged at 90 days - a compliance gap to fix.
3. Departed employee, 5 months ago, no hold, account deleted: The 90-day retention elapsed and no hold protected it. This data is not recoverable through Vault. You should tell the manager honestly rather than promise recovery.

Bottom line: holds preserve; retention purges; deletion plus expired retention equals gone. Only situation 1 is safely recoverable; 2 is a fixable policy gap; 3 is a loss.

Design principles: scope narrowly, hold deliberately, review regularly.

1. Tiered retention rules by scope, not one org-wide rule:
   • Default org rule: a reasonable business period (e.g., the current 90 days or a defined default) for ordinary mail.
   • Separate rule for the regulated dataset/custodians: 7 years (or the regulatory minimum), scoped to the specific organizational unit, group, or custodian set that the regulation covers. Do not apply 7 years to everyone - that inflates cost, discovery burden, and privacy exposure.
2. Custom retention for specific groups/OUs: use OUs or groups to target regulated populations. New regulated staff get covered by group membership.
3. Legal hold procedure: documented, with a named owner (legal), applied promptly when litigation is reasonably anticipated, and released only on legal's instruction. Holds override retention, so they must be tracked to avoid indefinite accumulation.
4. Deletion/offboarding step: before deleting any account, check whether it's under hold or in a regulated scope; if so, preserve/transfer first.

Over-retention risk: keeping everything 7 years increases breach impact, storage cost, and legal discovery scope, and may conflict with data-minimization obligations. The goal is keep what you must, purge what you may - regulated data long, ordinary data short, holds as the exception.

Operational safeguard - gate deletion on a preservation check:

• Offboarding checklist that, before any account deletion, verifies: (a) is the account/custodian under legal hold? (b) is it in a regulated retention scope? (c) does the manager need data recovered? Only after these are cleared does deletion proceed.
• Automated hold check: tie account deletion to a step that queries Vault holds so a held account can't be deleted out from under preservation.
• Manager sign-off confirming no pending disputes involving that person.
• Time buffer: require the check to happen before the retention window closes on the account, so there's still data to preserve if a need appears.

Audit evidence to retain:

• Retention rule configuration (scope, duration, effective dates) and change history.
• Legal hold records: who placed the hold, when, on which custodians, and release date/authorization.
• Offboarding/deletion logs showing the preservation check was performed and by whom.
• Access/export logs from Vault for any matter (who exported what, when) to show chain of custody.

This turns 'we meant to keep it' into documented, repeatable proof - and prevents the next 5-month-old unrecoverable request.