Prop ReportVisit Website →
← Back to blog

Use the Limitation Act: GDPR Email Retention for UK Property Managers

September 1, 2026
Use the Limitation Act: GDPR Email Retention for UK Property Managers

UK GDPR sets no fixed time limit for keeping emails. The storage limitation principle in Article 5(1)(e) requires you to justify retention by purpose and document it in a retention schedule. For property management specifically, the Limitation Act 1980 gives you a defensible anchor: six years for most contract claims, twelve for deeds.

TL;DR:

  • Retention periods must be justified by purpose, anchored in the Limitation Act 1980, with six years for contracts and twelve for deeds.
  • A proper retention schedule requires classifying emails by purpose, lawful basis, location, and setting clear review and deletion rules, especially for high-value evidence.
  • Automatic enforcement through centralized communication hubs, with audit logs and legal hold capabilities, is essential to turn policies into daily practice.
  • Erasure requests should be evaluated based on ongoing legal or contractual needs, with thorough search and documented reasoning for each decision.
  • Most policies fail due to untested practices and scattered communication; centralization and automation improve compliance and enforcement.

Table of Contents

What UK GDPR email retention actually requires

Storage limitation is not a suggestion. Article 5(1)(e) of the UK GDPR states that personal data must be kept "in a form which permits identification of data subjects for no longer than is necessary" for the purposes it was collected. The ICO's guidance translates that into something workable: set standard retention periods where you can, and review them regularly rather than letting inboxes accumulate indefinitely.

The lawful basis you rely on shapes how long you can justify keeping an email. Three bases come up constantly in property management:

  • Contract: correspondence tied to an active tenancy or management agreement, retained for the life of that agreement plus a defined tail.
  • Legal obligation: emails needed to demonstrate compliance with safety, deposit protection, or licensing rules.
  • Legitimate interests: internal notes or communications kept to defend against a plausible future dispute, balanced against the sender's and recipient's privacy expectations.

None of these bases grants indefinite retention. The ICO expects a documented retention schedule, a named owner for each category, and periodic review. If an inspector asked you tomorrow why a five-year-old email about a boiler complaint still sits in a shared mailbox, "we've always kept everything" is not an answer that survives scrutiny. "It falls under our maintenance category, reviewed annually, with a six-year retention tied to contract limitation" is.

Retention anchors that actually hold up under scrutiny

The most common mistake in this sector is treating "seven years" as a magic number borrowed from accountancy convention. It isn't one, and the GDPR Course's analysis is blunt about it: there is no universal statutory retention period under UK GDPR, and applying a blanket figure without justification is itself a compliance gap.

What does hold up is the Limitation Act 1980, which sets the timeframes within which someone can bring a legal claim. Property managers commonly use these as retention anchors because they map directly to the risk you're managing:

  • Six years for most contract-based claims, covering tenancy disputes, service charge disagreements, and general correspondence that could form evidence in a breach-of-contract action.
  • Twelve years for deeds and certain lease documents, reflecting the longer limitation period that applies to contracts executed as deeds.
  • Shorter periods for routine operational emails, such as scheduling confirmations or internal logistics, which carry little evidential value once the task they relate to is complete.

The Property Institute frames this well in its guidance on filing and retention: think of retention as "archive for" a defensible duration, not simply "delete by" an arbitrary date. That distinction changes how you write the policy. You're not setting a countdown timer; you're stating why a category of email needs to survive a certain length of time, and what happens to it afterwards.

How to build a retention schedule for email, step by step

A workable policy starts with knowing where your emails actually live, not just what your inbox looks like. Shared mailboxes, CRM sync fields, ticketing attachments, and forwarded copies in personal folders all count, and most retention failures happen in those forgotten corners rather than the main inbox.

  1. Map every location. List inboxes, shared mailboxes, CRM email logs, helpdesk attachments, and any downstream exports or forwarded copies.
  2. Classify by purpose and lawful basis. Group emails into categories such as tenancy correspondence, maintenance records, financial communications, and internal operational notes.
  3. Set a retention period and review point for each category. Anchor high-value categories to Limitation Act timescales; set shorter windows for low-value operational traffic.
  4. Define the end-of-life action. Decide whether each category gets deleted, anonymised, or moved to restricted archive storage once its retention period ends.
  5. Build exception rules. Legal holds and active disputes must be able to override the standard schedule without breaking it entirely.
  6. Log everything. Automated deletion rules should generate an audit trail showing what was removed, when, and under which policy clause.

Sprintlaw's guidance for property management companies makes a point worth repeating here: separate high-value evidence from casual notes early, because trying to sort six years of mixed correspondence retroactively is far harder than classifying it at the point of creation.

Pro Tip: Don't try to retain entire mailbox histories "just in case". Identify the specific message threads that form an evidential chain, such as repair promises, rent acknowledgements, or agreed contract variations, and apply longer retention only to those. Treat everything else as routine operational data with a much shorter shelf life.

Handling erasure requests without breaking your evidence trail

A tenant's right to erasure under UK GDPR is not absolute, and property managers get this wrong in both directions. Some refuse every request outright; others delete everything the moment they're asked, including records they were legally obliged to keep.

The correct approach depends on what the email actually is:

  • Accept erasure where the email holds no ongoing legal or contractual purpose and no exemption applies.
  • Refuse or partially refuse where retention is necessary for compliance with a legal obligation, or for the establishment, exercise, or defence of legal claims, such as an ongoing deposit dispute.
  • Search comprehensively across live mailboxes, shared folders, backups within reach, and any processor holding copies on your behalf, such as an outsourced IT provider.
  • Document your reasoning for every decision, whether you erase or refuse, so you can show your working if the ICO ever asks.
  • Apply a legal hold the moment litigation becomes reasonably foreseeable, restricting access and suspending routine deletion for the affected records only.

Where a legal hold exists, make sure backup restore procedures won't inadvertently reintroduce deleted material elsewhere or, worse, delete held material through an automated cycle running in parallel.

Archives, backups, and proving you actually deleted something

Illustration of archive backup deletion process

Deletion and archiving are not the same action, and treating them as interchangeable is where most technical failures start. An archive keeps data accessible under restricted conditions; deletion removes it, or renders it permanently inaccessible, from every system you control. The National Archives' records management code recommends that anything moved to long-term storage be pseudonymised where practicable, reducing risk even while the record is retained for evidential value.

Backups create a particular headache. You cannot always delete a single email from a nightly backup without restoring the entire set, so the practical answer is taking data "beyond use": restricting access, documenting the overwrite cycle, and ensuring any future restore process checks against your deletion log before data goes live again.

  • Set documented overwrite schedules for backup systems rather than retaining indefinite rolling copies.
  • Check platform admin settings. Tools such as Microsoft Purview and Google Vault let you configure retention rules and legal holds directly, but you still need a documented process for how restores interact with them.
  • Review vendor contracts for data processing terms covering deletion timescales and sub-processor obligations.

Nearly six in ten organisations still lack a documented retention schedule for personal data of any kind, according to ICO guidance on the storage limitation principle, which is precisely the gap regulators flag first in an audit.

Turning the policy into daily practice

A retention schedule that lives in a PDF nobody reads achieves nothing. The gap between policy and practice closes through automation, training, and scheduled review, in that order.

  • Automate retention rules in your email platform so deletion and archiving happen on schedule rather than depending on someone remembering.
  • Build exception workflows so a legal hold can pause automated deletion for specific threads without disabling the whole system.
  • Train staff to keep records centralised, discouraging local downloads, personal folder copies, or forwarding to private accounts, all of which create untracked copies outside your retention controls.
  • Set mailbox hygiene rules, including guidance on what belongs in a shared mailbox versus a personal one.
  • Schedule periodic reviews, at minimum annually, and log the outcome of each review, even when the outcome is "no change needed".
  • Align your privacy notice with the actual retention criteria you apply, since a mismatch between what you tell tenants and what you actually do is its own compliance risk.

Pro Tip: When you run your first retention audit, expect to find far more forgotten copies in personal folders and old CRM exports than in the mailboxes you actively monitor. Budget extra time for that discovery phase rather than assuming your live inboxes tell the whole story.

Quick reference: retention categories at a glance

Test your automated deletion rules twice a year against a sample category, and run a mock legal hold to confirm it actually suspends the correct workflow before you need it for real.

Retention rule testing and legal hold workflow

Why most retention policies fail before they're tested

Most retention policies read well and survive nothing. The document sits in a compliance folder, cites the right principles, and gets updated once a year with a new date on the cover. What it rarely gets is a genuine test: can someone actually produce a deletion log for a specific email thread on demand, or does the policy just describe intentions nobody's checked against reality?

Property management makes this worse because communication volume is relentless. A portfolio of thirty properties generates thousands of email threads a year across maintenance, tenancy queries, and supplier coordination, and almost none of that traffic gets classified at the point of creation. It sits in a general inbox until someone, usually under audit pressure, tries to work out retroactively what needs keeping and what should have gone years ago.

The fix isn't a stricter policy. It's better infrastructure that classifies communication as it happens, so retention decisions get made once, correctly, rather than reconstructed under pressure. Centralising communication through a dedicated hub rather than scattering it across personal inboxes is what actually makes a retention schedule enforceable, not just documented.

— James

Making retention manageable with Prop Report

Retention only works when it's built into how you communicate day to day, not bolted on afterwards. Prop Report centralises email, SMS, and WhatsApp into a single communications hub, so nothing important sits forgotten in a personal inbox outside your retention schedule's reach.

Propreport

The platform's automated archiving applies category logic as messages arrive, rather than leaving classification to a rushed annual review. Every action generates an audit log, giving you demonstrable proof of what was retained, archived, or deleted, and when. ISO 27001 certification underpins the whole system, reflecting the same data security discipline your retention obligations demand.

If your team is still managing this manually across separate inboxes and spreadsheets, book a look at Arthur to see how automated communication and reporting can turn your retention policy from a document into a working system.

Sources