How should a global company set an email retention schedule when UK, Canadian, Australian, and EU rules all set different periods for the same message?

Global organizations rarely get a single “correct” number for email retention, because the same message can be a tax record in one country, an employment record in another, and personal data subject to deletion rules in a third. The goal is a defensible, documented approach rather than a perfect one.

Start with the record, not the country

Email is a transmission medium, not a record type. The retention period attaches to the content and function of the message (a contract, an HR action, a financial entry), not to the fact that it arrived as email. Classify messages by record category first, then map each category to the legal and operational requirements that apply.

Map every applicable obligation

For a multinational message, several regimes may apply at once:

• Statutory minimums — tax, employment, and sector rules in the UK, Canada, Australia, and the EU each set a floor for how long certain records must be kept.
• Data-protection maximums — privacy frameworks (notably the EU’s, and similar Commonwealth regimes) push the other way, requiring that personal data not be kept longer than necessary.
• Litigation and regulatory holds — these can override a schedule and suspend disposition entirely.

Resolving the conflict

A common, defensible method is to take the longest applicable mandatory minimum for a given record category, provided no privacy rule forbids keeping it that long. Where a data-protection “no longer than necessary” duty collides with a long statutory floor, document the lawful basis for the retention and, where feasible, minimize or pseudonymize the data.

Where periods genuinely cannot be reconciled, consider jurisdiction-specific schedules keyed to where the record originated or where the relevant business unit operates, rather than forcing one global number.

Make it operational and defensible

• Write the rationale into the retention schedule so disposition decisions are documented and consistent.
• Apply retention by record class through automated classification, since manual sorting of email does not scale.
• Review the schedule on a regular cycle as laws change, and align it to a recognized standard so your program is auditable.

International standards such as ISO 15489 provide the principles for building schedules that hold up across borders. For related guidance, see the email and messaging topic hub.