The one-sentence version#
Data retention policy defines how long mailbox data and marketing records are kept and when they are deleted. DSARs (data subject access requests) require producing or erasing a person's data on request.
Why you should care#
GDPR and similar laws require minimization and timely response to requests; over-retention increases breach exposure.
The mental model#
Think of email data retention as a contract between you and the mailbox providers receiving your mail. You publish or configure something they can check; they check it on every message; the result feeds their decision about where your message lands. Everything below is about making that check pass consistently.
Your first setup, step by step#
- Classify data: consent records, engagement logs, message content.
- Set retention periods per class and automate deletion.
- Build a DSAR process that can search and export across ESP, CRM, and mailbox.
- Log every deletion and export for accountability.
Words you will see#
- Mailbox provider: Gmail, Microsoft, Yahoo, Apple, and the corporate gateways that decide where mail lands.
- Authentication: proof that a message is from who it says it is (SPF, DKIM, DMARC).
- Reputation: the provider's running score of your domain and IP.
- Placement: whether a message reaches the inbox, spam, or is rejected.
Common mistakes#
- Deleting consent records that you need to defend a complaint.
- No process for AI tools that have processed mailbox content.
Frequently asked questions#
How long can I keep unsubscribed contacts?
Keep the suppression record indefinitely (email only) so you never re-mail them; delete profile data per your retention schedule.