On Monday, the Chief Information Officer (CIO) of a state agency received an e-discovery request for the release of all emails sent and received by the agency board of directors for the past five…

A data retention policy defines how long data such as emails is stored before being deleted, making it the foundational control that determines whether five-year-old emails still exist. If the policy only retains emails for two years, no backup software, recovery procedure, or decryption capability can restore data that was intentionally purged per policy. The retention policy is therefore the greatest single constraint on the ability to fulfill an e-discovery request spanning a multi-year period.

Backup software and hardware affect the ability to restore data that was retained, but they are irrelevant if the retention policy never preserved the emails in the first place.

Email encryption software may complicate retrieval if keys are unavailable, but emails that were retained can still be identified and potentially decrypted; retention policy is a more fundamental barrier.

Data recovery procedures describe the process of restoring retained or backed-up data and are only relevant after confirming the data was actually stored, making them secondary to the retention policy.