From customer and client data to patient records, organizations face an increasing number of ESI retention requirements. ESI retention determines the lifecycle of each email, file or IM transcript taking into consideration not only the practical business life of records (satisfying administrative, fiscal, and research needs) but also federal, state and local regulatory requirements. Sarbanes-Oxley, HIPAA, SEC 17a-3 and 17a-4, FRCP, FOIA, Open Records laws, Sunshine laws and other local regulations all place restrictions on the manner in which data is retained directly impact every organization’s ESI management policies and IT’s ability to execute and enforce those policies. All organizations (public or private sector) subject to litigation are affected.

Creating an effective e-mail retention policy should be at the top of your agenda. You need to preserve data today, know what you have, know where it is located and be able to respond rapidly to e-discovery requests. Institutional paralysis is no longer an option. Data retention policies form an important foundation for helping manage an organization's data. A good policy does not need to retain all possible information and documents, but should be customized to your organization;s specific requirements. Retention policies will evolve over time. There’s nothing wrong with regularly revisiting your archiving and retention policies and revising them.

All organizations should at a minimum establish broad retention policies that meet the applicable internal requirements and comply with external laws and regulations and then fine tune them as appropriate moving forward. This enables you to efficiently and effectively preserve ESI in the event of litigation and significantly reduce organizational risk.