Former employees' mailboxes: what to keep, archive or delete

What should happen to a departed employee's email?#

A departed employee's email should get a deliberate decision, made in a set order, rather than lingering on a paid license or disappearing when the account is removed. The order matters: legal holds first, retention requirements second, business need third, and deletion only when all three are cleared.

In many companies nobody owns that decision. HR closes the employee record, IT disables the sign-in, and the mailbox sits in a default state that may remove it after a platform grace period or keep it indefinitely on a paid seat. Both outcomes can be wrong: one destroys records you may need, the other keeps sensitive content with no purpose and no owner.

Microsoft 365 and Google Workspace both offer ways to keep mail after someone leaves, such as shared or delegated access, holds, retention policies and archive exports. The mechanics that most often catch IT teams out are summarized in the platform table below; vendors change options, license rules and limits over time, so confirm current behavior in your admin documentation before setting policy.

Keep, archive or delete: a decision table#

The keep, archive or delete decision depends on the mailbox's legal status and its role in the business. Use the table as a starting rule set and adapt it to your own retention schedule.

Why legal holds come before everything else#

Legal holds come first because deleting or altering a mailbox after a dispute is reasonably anticipated can create serious problems in litigation. If a departed employee was involved in a customer complaint, an employment claim, a contract disagreement or a regulatory inquiry, preserve the mailbox before anything else happens to the account.

Coordinate scope and duration with counsel. A hold usually needs to reach beyond the mailbox to related chat history, file storage and managed mobile devices. Record who placed the hold, when and on whose instruction, and do not release it until counsel confirms.

Preservation duties depend on the facts and the jurisdiction, so the scope of any hold is counsel's call; IT's job is to apply it completely and to record it.

Shared mailbox, hold, export or third-party archive?#

Converting to a shared mailbox, placing a hold, exporting to an archive file and moving to a third-party archive solve different problems. Mixing them up is how companies end up with mailboxes that are neither searchable nor protected.

Whichever option you choose, write it down. A register entry naming the mailbox, the option used, the owner and the review or deletion date is what lets the next IT director understand decisions made years earlier.

Platform details to confirm before removing a license#

Platform details decide whether a former employee's mail survives offboarding, and Microsoft, Google and Slack each document behavior that is easy to miss. The points below reflect vendor documentation at the time of writing; plans and editions differ, so check your own tenant before relying on them.

The common thread is timing. Retention policies and holds protect content only if they are in place before the account or mailbox is deleted, and export packages are temporary, so the download and the register entry need a named owner on the day the export runs.

An offboarding checklist for mailboxes#

An offboarding checklist for mailboxes turns a one-off judgment into a routine step that HR and IT complete together when someone leaves.

Avoid open-ended forwarding of a former employee's address into a manager's own inbox. Forwarding mixes records, makes later retrieval harder, and keeps a channel alive that customers may use for sensitive matters long after the person has gone.

• 1Confirm with HR and counsel whether any hold or dispute applies.
• 2Classify the mailbox: individual, role-based, executive or relationship owner.
• 3Set an automatic reply that names a current contact, with an end date.
• 4Grant delegated access to the manager or successor, with a review date.
• 5Apply the hold, retention label or archive that the decision table calls for.
• 6Record the mailbox, decision, owner and review or deletion date in your records register.
• 7Remove the license only after content is preserved where required.
• 8Delete on schedule, and log the deletion.

Who may open a former employee's mailbox?#

Only people with a documented business reason should open a former employee's mailbox, because work accounts mix business threads with mail that has nothing to do with the job. Anything touching health, benefits, family matters or a dispute with the company is sensitive even when it sits in a company system.

For California employees, the CCPA's temporary exemptions for employee and business-to-business personal information expired on January 1, 2023, so a covered business's records about former staff can fall within the law. Other state privacy and employment laws may apply depending on where the person worked, and counsel decides which ones do.

IT can make the policy enforceable. Grant access through a ticket that names the requester, the business reason and an end date; prefer exporting specific threads to a successor over full-mailbox access; and keep the access log next to the records register entry for that mailbox.

Illustrative: an engineering firm handles a retiring principal's mailbox#

Illustrative: a fictional civil engineering firm on Microsoft 365 has a founding principal retiring after a long career. Her mailbox holds client negotiations, RFI correspondence with contractors, internal design review threads and some personal mail.

IT confirms with counsel that one project is in dispute, so threads for that project go under hold. The rest of the mailbox is archived with access restricted to the managing principal and the records manager, and a successor receives delegated access for active projects for a defined period.

The firm logs the archive in its data inventory with date range, project list and record types. Months later, when leadership wants to know whether its project correspondence could support an AI licensing conversation, it answers from that metadata without opening a single email.

Why business-purpose threads may have licensing value#

Business-purpose threads in retained mailboxes may have licensing value because they record how work was negotiated, coordinated and resolved: quotes and counteroffers, vendor exception threads, project coordination with clients, and escalations with their eventual answer. Developers building email and workflow agents need examples of that kind of real correspondence.

What makes such an archive usable is clear rights and careful preparation, not the number of messages in it. Licensing would require reviewing customer contracts and employee notices, removing personal and confidential details, and excluding privileged and HR material. A possible licensing use is not a reason to keep mail your retention policy says to delete, but it is a reason to note which archives exist before you delete them.

SourceX starts from metadata only: which mailboxes are archived, their date ranges and the record types they contain. Nothing is opened or shared during the fit check. If the company later proceeds, the SourceX five-step transaction handles employee and customer content during Rights and Preparation, well before the company is asked to approve a package.