How Long Should a Small Business Keep Emails?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

There’s no single federal rule for how long to keep all email. What matters is what’s inside the email. If an email is a tax, payroll, hiring, or contract record, keep it as long as that type of record must be kept. Write a short policy that says what you keep, where you archive it, when you delete it, and how you stop deletion when a dispute or lawsuit comes up.

What this means

The outline asks for three rules:

Retention: how long each kind of email is kept.
Archiving: where older email is stored so it’s safe and searchable, but out of the way.
Deletion: when and how email is removed for good.

Retention follows the record, not the format. An invoice attached to an email is still an invoice. See 9.8.2 Record Retention Periods for the main list.

Federal examples:

Tax records: the Internal Revenue Service (IRS) says to keep most records 3 years, some for 6 or 7 years, and employment tax records at least 4 years after the tax is due or paid, whichever is later.
Employment records: the Equal Employment Opportunity Commission (EEOC) says to keep personnel records for 1 year, or 1 year from the date of an involuntary termination, and longer if a charge is filed.

State laws and industry rules can require longer periods. Check with your certified public accountant (CPA) and attorney.

Made-up example: Harbor Point Physical Therapy sets three rules. Billing and tax email is kept 7 years in an archive. Hiring email is kept at least as long as the employment record rules require. General newsletters and vendor ads are deleted after 1 year. When a former patient threatens to sue, the owner turns on a legal hold for every related mailbox.

Why it matters

Too short can break the law if an email is a required record.
Too long adds risk. Old email full of customer details is more to lose in a breach (see 11.9.4 Data Breach Response).
Deleting during a dispute can be serious. Once a lawsuit is likely, you may need to keep related records (see 9.8.6 Legal Hold).
Departed staff mailboxes hold history. Deleting them right away can lose customer agreements and account ownership proof.

Who this applies to

Every business. If you have employees, handle taxes, sign contracts, or collect marketing consent by email, retention rules touch your inbox.

How to do it

List the kinds of email you get: customer agreements, invoices, tax, payroll, hiring, vendor, account notices, consent records, and general mail.
Match each to a retention period from 9.8.2 Record Retention Periods. Ask your CPA and attorney for anything unclear.
Save key emails as records. Move contracts, consents, and invoices into your shared files or bookkeeping system so they don’t depend on one inbox (see 12.2 Shared Files).
Turn on archiving or retention settings in your email provider if available.
Set a departure rule. Keep a leaving employee’s mailbox for a set time, then archive what must be kept (see 11.7.7 Removing Access When People Leave).
Write down how legal holds work and who can turn one on.
Delete on schedule what you no longer need, and do it securely (see 9.8.5 Secure Record Destruction).
Back up email you’re required to keep (see 11.8 Business Backups).

What proof to keep

The written email retention policy with the date
Screenshots of archive or retention settings
A log of legal holds turned on and off
Records of scheduled deletions

Common mistakes

Keeping everything forever because it’s easier.
Deleting a former employee’s mailbox the day they leave.
Relying on the inbox as the only copy of a contract or consent.
Auto-delete rules running during a dispute.
Forgetting shared inboxes in the policy.

When to get help from a pro

CPA: for tax and payroll record periods. Attorney: for contracts, employment records, legal holds, and state rules. Questions to ask:

Which of our emails count as required records, and for how long?
What state rules make us keep anything longer?
What should we do with email when a dispute starts?

Bill’s note

[Bill: add a short note. For example, an old email that proved who owned a client’s Google Business Profile or domain, and why you keep account setup emails.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: SiteSmarty’s email retention rules and archive setting]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the retention setting]
[Result so far:]

Questions people ask

How long do I need to keep business emails? It depends on what’s in them. Tax emails follow IRS periods, hiring emails follow employment record rules, and so on.

Is there one law on how long to keep email? Not one federal rule for all email. The record type decides it.

What’s the difference between archiving and deleting? Archiving moves email to safe storage you can still search. Deleting removes it for good.

Can I delete a former employee’s mailbox? After you’ve saved what you’re required to keep and confirmed there’s no legal hold.

Audit check

Question: Does the business have a written email retention policy that covers retention, archiving, deletion, departures, and legal holds?
Pass looks like: A short policy matched to record periods, archiving turned on, key emails saved as records, and a legal hold process.
Fail looks like: No policy, mailboxes deleted on departure, or everything kept forever with no plan.
Evidence to collect: The policy, admin settings screenshots, and the legal hold log.

Where this fits

Do this first: 9.8.2 Record Retention Periods, 12.1.2 Email Accounts and Shared Inboxes

Do this next: 12.2 Shared Files

Sources

Internal Revenue Service, "How long should I keep records?" (checked October 17, 2026)
U.S. Equal Employment Opportunity Commission, "Recordkeeping Requirements" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.