Records & POPIA
Email Records Retention
Application of retention and disposal rules to email as an official record under archives legislation.
Email is an official record, not just correspondence
Email frequently constitutes an official record under the National Archives and Records Service Act, meaning it is subject to defined retention and disposal schedules, yet it is commonly left to individual mailboxes with no governance. Both over-retention and premature deletion create legal and POPIA exposure. AuditPro Core tracks how retention and disposal rules are applied to email so that records are kept for their required period and disposed of lawfully rather than at random.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Mailboxes governed
68%
▲ 14 pts
Mail beyond schedule
2.1 TB
No retention applied
1 940
mailboxes
Legal-hold mailboxes
212
Over-retained email volume
Retention coverage by department
| Department | Mailboxes | Governed % | Over-retained |
|---|---|---|---|
| Corporate services | 1840 | 74 | 0.6 TB |
| Finance | 1210 | 81 | 0.4 TB |
| Service delivery | 2960 | 58 | 1.1 TB |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Email can be a record of decision
Where an email documents a decision, transaction or instruction, it is an official record regardless of its informal tone, and it must be retained according to the relevant disposal authority.
Over-retention is also a breach
POPIA requires personal information not to be kept longer than necessary, so indefinitely hoarded email is a compliance failure, not a safe default. Disposal at the correct time is part of the control.
Defensible disposal
Deletion of records must follow an approved disposal authority and be documented. Ad hoc deletion by individuals risks destroying records still required for audit, litigation or access requests.
Mailbox is not a records system
Leaving records in personal mailboxes ties their survival to one employee's account and mailbox limits. Official records need to be captured into a governed repository with retention rules applied.
How AuditPro Core Bridges the Gap
- Retention application: email records are assessed against the applicable retention and disposal schedules.
- Exception workflow: over-retained or prematurely disposed records are flagged for correction.
- Continuous monitoring: retention status is tracked so records reaching disposal dates are handled on time.
- Audit-ready export: retention and disposal evidence exports to demonstrate compliance with archives and POPIA obligations.
Key Takeaways
- Email documenting decisions or transactions is an official record subject to schedules.
- Over-retention breaches POPIA; timely disposal is part of compliance.
- Disposal must follow an approved authority and be documented, never ad hoc.
- Capture official email into a governed repository, not individual mailboxes.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.