What are the steps to write an email and instant messaging records policy employees will actually follow?

A policy only works if people can understand it, apply it without guessing, and see why it matters. The goal is not the longest document; it is the one that changes behavior at the moment an employee hits send. Use these steps to build a policy for email and instant messaging (IM) that holds up in practice.

1. Define what counts as a record

The single biggest source of confusion is whether a message is a record at all. State plainly that content, not the channel, determines record status: a message documenting a decision, transaction, or obligation is a record whether it lives in email, chat, or a collaboration tool. Give concrete examples for both record and non-record messages so employees are not left interpreting abstractions.

2. Tie messages to your existing retention schedule

Avoid inventing separate rules for email and IM. Map them to the same retention categories you already use for other formats, so a contract discussion is retained by its subject matter, not by the tool it traveled through. This keeps the policy consistent and defensible.

3. Name the systems of record

Tell employees where messages of enduring value belong and how to get them there. If a chat thread documents a decision, specify how it is captured into the official repository. Ambiguity here is where records quietly disappear.

4. Address legal holds and search

State that retention obligations override routine deletion when a legal hold is in place, and explain in plain terms how holds are issued and lifted. Employees follow rules they understand the stakes of.

5. Set rules for ephemeral and personal channels

Disappearing-message features and personal accounts are common gaps. Clarify whether they are permitted for business and how any resulting records must be preserved.

6. Write for the reader, then train and reinforce

Use short sentences, examples, and a one-page quick reference. Pair the policy with brief role-based training and periodic reminders. A policy issued once and never revisited becomes shelfware.

7. Review and improve

Revisit the policy as tools and obligations change, and gather feedback from the people applying it daily.

For more on managing these channels, see the email and messaging topic hub.