Should companies delete old emails, or assess the archive first?

The short answer: delete by policy, never by default

Companies should delete old emails only when a written retention policy calls for it, and only after legal holds, record-keeping rules and privacy commitments have been checked. One more step belongs before any auto-delete rule runs: at a company with 50+ full-time employees at peak (contractors excluded), years of email can be a licensable record of how the business really operates, and deletion is permanent.

Discarding mail you no longer need, and may lawfully discard, reduces privacy exposure. Deleting it blindly, before anyone asks what must be kept or what it is worth, is the mistake.

What has to be settled before any deletion?

Take four questions in order. An earlier answer always overrides a later one.

1. Is anything on hold? If litigation, a government inquiry or an audit is pending or reasonably expected, counsel decides which custodians and date ranges to preserve, and auto-delete rules must exclude them until counsel lifts the hold.
2. What must be kept? Tax, employment, contract and industry rules set retention periods for some records, many of which sit in mailboxes. Periods differ by record type, industry and state, so the list should come from counsel and your accountant, not a software default.
3. What did you promise about personal data? California's privacy statute requires covered businesses to disclose retention periods at collection and to keep personal information only as long as is reasonably necessary and proportionate (Cal. Civ. Code 1798.100 et seq.), and it gives consumers a right to request deletion (California Attorney General CCPA overview). If you deal with people in the EU, the GDPR can reach a US company that offers them goods or services (GDPR text on EUR-Lex).
4. What is the archive worth? Business value enters only after the first three answers, and today that value includes licensing.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before changing a retention policy or deleting records.

Why are old emails worth a look before they go?

AI developers are moving from systems that answer questions to agents that complete tasks, and training agents takes records of multi-step work: requests, decisions, exceptions and outcomes. Researchers at Epoch AI project that language models could fully use the stock of public human-written text between 2026 and 2032 if trends hold, a forecast with wide uncertainty (Epoch AI). Permissioned business records are one answer to that limit, and email is where much of a company's working history is written down.

Who owns what sits in the mailbox?

The company generally owns what its employees write on the job, not everything it receives. The Copyright Office explains that a work an employee prepares within the scope of employment is a work made for hire owned by the employer, while contractor material may not belong to the company unless the rights were assigned in a signed writing (Copyright Office Circular 30). Inbound mail from customers, vendors and candidates raises separate questions, and the guide to customer contract data use restrictions lists the clauses to check. What gets masked or removed is settled with the company in writing before anyone prepares a file.

What should you say when someone proposes switching on auto-delete?

The idea can arrive as housekeeping: an IT lead trimming storage or a mail platform migration. Answer with a sequence, not a yes or no.

The martech audit checklist includes a records and data asset section, and the data inventory builder helps you list each system and how many years it holds, without sharing contents.

When is deleting old email the right call?

When an archive fails on rights or substance, delete it under your policy and document the decision.

Before any auto-delete rule goes live:

• Counsel has confirmed which mailboxes and date ranges are on hold.
• Minimum retention periods for contracts, invoices and HR matters are written down.
• Privacy notices and customer contracts have been checked for retention and use promises.
• A complete export exists for any system being retired.
• The owner, CEO or CFO has signed off on what will be deleted and when.

How does a licensing assessment work without exposing the mailbox?

The early stages run on descriptions of your systems, not on their contents.

1. You apply directly, or an adviser introduces you with a referral link or the referral form.
2. SourceX checks headcount at peak, years of documented operations, how many systems hold records, and whether you have the rights to license them.
3. You complete a data inventory listing systems, date ranges and export options, with no messages attached.
4. You agree one all-in price and the license terms; nothing binds until you sign.
5. AI labs and data buyers review the opportunity; once a company is deal-ready, buyers typically respond within about two weeks.
6. After an executed agreement and your authorization, data is prepared under the redaction rules you approved and delivered, and you receive a single payment, usually about 60 days after invoicing once the buyer has chosen the data.

Skeptical? The page on whether AI data licensing is legit gives five tests for any offer. Advisers who raise this with owners, such as EOS implementers and chambers of commerce, have their own guides; any adviser reward comes from SourceX's fee, never from what the company receives.

Next step

Take the four questions to counsel before the next retention change, then check who qualifies or apply at sourcex.si/apply. If you advise owners rather than run a company, register as a partner to make introductions.