Email Archiving and Compliance for UK Businesses

It sits at the heart of a properly run email security programme and underpins the wider managed cybersecurity service we deliver to over 1,200 UK businesses.

What is email archiving and what does it include?

Email archiving copies every message flowing through your system into immutable, searchable storage governed by retention rules. Unlike a mailbox, an archive cannot be edited or quietly deleted by a user, which is exactly what regulators and courts expect. AMVIA builds the archive on Microsoft 365.

A complete archive covers:

• Capture — every sent and received email journaled at gateway or server level, transparently, with no impact on delivery.
• Retention — policies that match each sector's legal minimum, from three years to indefinite legal holds.
• Search and eDiscovery — self-service search for staff plus Microsoft Purview eDiscovery for compliance and legal teams.
• Tamper-proofing — immutable storage so records cannot be altered after capture.
• Historical import — existing mail imported so coverage starts from day one, not just from go-live.

Microsoft 365 includes in-place archiving for Exchange Online mailboxes — the archive appears as a separate Outlook folder, and retention policies automatically move older mail into it. In-place archiving is included with Exchange Online Plan 2, per Microsoft's documentation.

Why do UK SMEs need email archiving?

Most UK businesses are legally required to retain certain email but have no reliable way to produce it on demand. With 43% of UK businesses experiencing a cyber breach in 2025 and around 19,000 hit by ransomware in the past year (Cyber Security Breaches Survey 2025), a deleted or encrypted mailbox can wipe out records you are obliged to keep.

An archive separates retention from the mailbox, so a ransomware event, an accidental deletion or a departing employee cannot destroy regulated records. The average cost of a disruptive breach for UK businesses is £3,550 (Cyber Security Breaches Survey 2025), and the inability to evidence compliance compounds that cost with regulatory and legal exposure.

What are the UK email retention requirements?

Retention depends on sector and email type — there is no single blanket period. The table below summarises the common UK obligations AMVIA designs archive policies around. Personal data in email must also obey UK GDPR's storage limitation principle: keep it no longer than necessary, as the ICO sets out.

AMVIA advises on sector-specific requirements during archiving setup. The Companies Act 2006 requires certain business records — including financial records — be retained for three years (private companies) or six years (public companies); financial instructions, purchase orders and invoices sent by email are in scope. MiFID II requires investment firms retain records of all client order and transaction communications for five years.

Is email archiving the same as email backup?

No. Backup captures point-in-time mailbox copies for restoration after deletion or data loss. Archiving captures every email as it flows, retains it in indexed, immutable storage for defined periods, and provides eDiscovery for legal and compliance needs. They solve different problems and you need both.

If your priority is recoverability after data loss, pair archiving with Microsoft 365 backup. For compliance evidence and legal hold, you need an archive.

How does AMVIA set up your email archive?

AMVIA runs a four-step setup that starts with your legal obligations, not the technology, so retention policies are correct from day one rather than retro-fitted later.

1. Compliance review — assess regulatory obligations (FCA, UK GDPR, legal hold) and design retention policies to match. 2. Archive configuration — configure the archive with retention rules, journaling and tamper-proof storage. 3. Historical import — import existing email so coverage is complete from day one. 4. Search and compliance — give staff self-service search and enable compliance officers to run eDiscovery searches and legal holds.

Because we are also your Microsoft 365 managed service and GDPR-aligned cybersecurity provider, archiving is configured as part of one accountable security stack — not bolted on by a separate vendor.

Why choose AMVIA for email archiving?

AMVIA is a Sheffield-based security partner managing IT and security for over 1,200 UK businesses across legal, finance, healthcare and professional-services sectors. We hold Cyber Essentials Plus certification and Microsoft Solutions Partner status, and respond to critical issues within one hour.

• UK-focused — engineering and support run from Sheffield, with first-hand knowledge of UK compliance.
• Certified — Cyber Essentials Plus and Microsoft Solutions Partner (Modern Work, Security, Infrastructure).
• Proven — 1,200+ UK businesses protected, rated 4.8/5.
• Responsive — critical issues answered within one hour by phone, email and portal.

How much does email archiving cost?

Cost depends on user count, retention length and whether historical import is required. For most SMEs already on Microsoft 365, in-place archiving is included with Exchange Online Plan 2, so the cost is the setup and ongoing policy management rather than new per-mailbox licensing. AMVIA scopes this against your retention obligations during the compliance review and quotes a fixed monthly price.