Email archiving compliance means meeting two obligations at once: keeping commercial correspondence available for as long as the law requires, and deleting personal data once its retention period has passed or its purpose has ended. A properly run archive gives every category of email a retention period, every mailbox a defined set of authorised users, and every access a record.
Neither "keep everything forever" nor "just delete the old stuff" is a compliant policy on its own.
Why your mail server is a personal data store
For most companies, the mail server is one of the largest stores of personal data they hold, often without realising it. Customers' names, phone numbers and addresses sit in signatures; an employee's medical certificate sits in an attachment sent to HR; a candidate's CV sits in the hr@ mailbox; a supplier contact's ID copy sits in a contract thread. In Türkiye, all of this is personal data under Law No. 6698 on the Protection of Personal Data, known as KVKK (Türkiye's counterpart to the GDPR), and some of it is special category data. Moving attachments that carry personal data out of mailboxes into a permission-controlled document area is covered in saving email attachments to document storage.
The picture we see most often in the field looks like this:
- Unlimited accumulation. Mailboxes have not been cleaned for a decade, and leavers' mailboxes stay open "just in case".
- Scattered copies. The same thread exists on the server, in a local file on an employee's laptop and on their personal phone.
- Unclear access. Several people know the password to each shared mailbox, and nobody knows who opened which message.
- Rules that never mention email. There is a written personal data retention and disposal policy, but it says nothing about email.
The risk runs both ways: data kept too long increases what can leak in a breach, while unplanned deletion removes correspondence you will need in a dispute. Firms that correspond on behalf of clients face a sharper version of this balance: for case files and client correspondence see law firm document management, and for how long client correspondence is kept see accounting firm document management.
Email archiving compliance: the duty to keep and the duty to delete
Two groups of rules set the balance for email archiving in Türkiye:
- The duty to retain. The Turkish Commercial Code requires merchants to keep commercial letters they send and receive for ten years, and commercial correspondence conducted by email is generally regarded as falling within that scope. The Tax Procedure Law sets its own retention periods for books and records. Orders, invoices, quotes and contract correspondence cannot be deleted at will.
- The duty to delete. KVKK requires personal data to be relevant, limited and proportionate to the purpose for which it is processed, and kept only for the period set by the relevant legislation or required by that purpose. When the period ends, the data must be erased, destroyed or anonymised. Data controllers obliged to have a retention and disposal policy carry this out on a periodic disposal schedule.
The two obligations complement each other: correspondence is protected for its period, then disposed of. The real problem is that most organisations do not classify email in a way that makes this possible. We cover the wider framework in our data retention and disposal policy guide. If the archive sits on a server abroad, factor in the KVKK cross-border transfer rules as well.
What a disorganised archive costs
According to the KVKK 2025 Annual Report, Türkiye's Personal Data Protection Authority received 328 data breach notifications and 12,512 complaints and reports in 2025. Under Board Decision 2019/10, a data controller must notify the Board of a breach within 72 hours at the latest after becoming aware of it. Answering "which mailbox held whose personal data?" within 72 hours is close to impossible in an unstructured archive. The notification steps are set out in the KVKK 72-hour breach rule.
According to IBM's Cost of a Data Breach Report 2026, the global average cost of a data breach rose 12% to a record $4.99 million. (IBM Cost of a Data Breach Report 2026)
Another finding from the same research, published in IBM's press release, matters for archives in particular: only 37% of breached organisations said they encrypt sensitive data both at rest and in transit. Years of accumulated email is precisely that kind of sensitive data at rest.
Volume makes it worse every day. According to Microsoft's 2025 Work Trend Index special report, the average worker receives 117 emails a day; without rules, all of them pile up in the same place, with the same access.
An email archiving policy in six steps
- Classify your email. Commercial correspondence (orders, invoices, quotes, contracts), HR correspondence (CVs, leave, medical certificates), customer communication, marketing and newsletters, personal messages. Each class has a different reason to be kept.
- Assign a retention period to each class. Base it on the relevant legislation and the processing purpose, and record the reasoning in the policy. There is no reason, for example, to keep an unsuccessful candidate's CV as long as commercial correspondence.
- Limit access to need. Define who can access each shared mailbox, and with which rights. Not everyone who can read should be able to delete.
- Put leavers' mailboxes under a rule. Is the mailbox closed, handed to a manager, and for how long does it stay open? That decision should follow a written rule, not the individual case. We go into detail in our guide to email access when employees leave.
- Log every action. Who opened, moved or deleted which message, and who was granted which right when? This log is the first place you will look during a breach notification or a data subject request.
- Schedule periodic disposal. Records whose period has expired should be reviewed and disposed of at set intervals, and the disposal itself should be documented.
How long should each type of email be kept? A sample table
| Email class | Reason to retain | Typical access | Disposal approach |
|---|---|---|---|
| Orders, invoices, contract correspondence | Commercial legislation | Finance, purchasing | When the statutory period ends |
| Unsuccessful candidate CVs | Assessing the application | HR | When the purpose has ended |
| Personnel file correspondence | Employment relationship and legislation | HR, restricted | Per the period in your policy |
| Customer support correspondence | Service and disputes | Support team | Per the period in your policy |
| Newsletters, promotions | None | Recipient | Short term |
This is a starting example, not legal advice; confirm the periods with your legal adviser.
What to check on the technical side
For the policy to work in practice, each of these questions about your email platform should get a "yes". We can assess each point for your current setup as part of our cyber security consultancy. If you are choosing a new platform, our guide to choosing a business email service sets out the criteria:
- Is access individual? Do people open shared mailboxes with their own identity rather than a shared password?
- Are permissions granular? Can viewing, sending and deleting be granted separately?
- Is there an audit trail? Can you see who did what, per message and per mailbox?
- Is your data segregated? Is your organisation's data stored separately from other customers' data? If you are moving an archive from an old server to the cloud, the cloud migration and infrastructure consultancy stage is the cheapest point to ask.
- Can sessions be managed? Can a session on a lost phone be closed remotely?
We explain how to protect sensitive correspondence in transit and at rest in our business email encryption guide. For official deliveries that need legal proof, see registered electronic mail (KEP).
How we approach this at Digital Bridge
Email archiving starts with an inventory, not with choosing software. We work with organisations in this order:
- Inventory and risk map: We identify which categories of personal data live in which mailboxes, who has access, and the state of leavers' mailboxes. The same inventory underpins your VERBIS registration.
- Policy and retention design: As part of our data protection compliance consultancy, we tie email classes to your retention and disposal policy and put the access matrix and disposal schedule in writing.
- Adapting the platform: We build the permission structure that enforces the policy, either on our own product Smart360 or on your existing infrastructure.
- Written proposal: Scope, phases and fees are set out in writing; we do not sell off-the-shelf packages.
What SmartMail and Smart360 make easier
Smart360 is our own product family that brings SmartMail (business email), SmartFiles (business document management), the SmartOperator AI website agent and the SmartPass access control product together under one panel and one identity, SmartID. Here is how the archiving policy maps onto its email and document side:
- Raw archive with an integrity record. SmartMail archives every message in its raw form with its attachments; each one is stored with a SHA-256 digest so you can re-verify that it has not changed. Old messages verified against the archive can be removed from the mail server and still remain visible in SmartMail, where they can be restored one by one.
- Your data is kept separate. Each organisation's data is held in a separate database for each product, and documents and the mail archive are stored in S3-compatible object storage. Even when you manage several companies from one account, none of them can see another's data.
- Nine permissions per mailbox. Viewing, writing and sending, deleting, labelling, quarantine, AI re-assessment, AI chat, notes and flagging for attention are granted separately. Delete and quarantine management are off by default on new assignments, so "anyone who can read can delete" is ruled out from the start.
- Audit log and per-message history. An audit log is kept per mailbox, and every message shows its own action history.
- No passwords handed out. Mailbox passwords are generated by the system and stored encrypted with AES-256-GCM; they are never distributed to staff. Sessions are listed with device details and can be ended remotely.
- Leavers removed in one step. A leaver's entire Smart360 access is closed in a single action, and someone who leaves a department automatically loses access to that department's mailboxes.
A concrete scenario: an HR specialist leaves. The administrator closes their SmartMail and SmartFiles access in one action, while hr@ stays open to the rest of the team through department membership. Candidate CVs were saved from SmartMail to the HR area in SmartFiles with one click, so the team works from one place rather than from copies downloaded to individual computers, and the audit log shows who opened what.
Next step
Answer two questions this week: how old is the oldest email on your server, and how many leavers still have an open mailbox? If the answers make you uneasy, start with the inventory, then the policy, and only then the tools. For order in shared mailboxes, read our shared mailbox management guide, and if you would like to build your archiving policy with us, from inventory to disposal schedule, get in touch via our contact page. The other topics in email and document management are gathered in our Business Email & Documents guide.