Google Vault Retention: Keeping Deleted Mail for Australian Businesses
▶ Watch the short explainer for this tip
Even after your staff hit delete, you might still need to find old emails for legal, compliance, or security reasons. For Australian businesses, this isn't just good practice; it can be a regulatory requirement. Today's tech tip shows you how to enable Google Vault retention for Australian businesses, ensuring deleted mail remains accessible for investigations.
What is Google Vault Retention and Why Does it Matter?
Google Vault retention is a setting that keeps copies of your organisation's emails even after users delete them from their inboxes. This means that if an employee deletes an email, or even empties their trash, a copy can still be searched and retrieved by authorised personnel in Google Vault. It's a critical tool for maintaining a complete record of communications for e-discovery and compliance.
Why You Need Google Vault Retention for Email Security
Turning on Google Vault retention provides a vital safety net for your email security. It ensures that if a data breach or an internal investigation occurs, you have access to all relevant communications, regardless of whether they were intentionally or accidentally deleted. This capability is essential for responding effectively to incidents and fulfilling legal discovery obligations, protecting your business from potential penalties.
What Happens Without Google Vault Retention?
If you don't enable Google Vault retention, deleted emails are permanently gone after the user's bin is emptied, making them impossible to recover. This can lead to significant financial penalties and legal complications during e-discovery requests or data breach investigations. Without these records, your business might struggle to prove compliance, face higher insurance costs, and potentially be found liable in legal disputes, impacting both your reputation and bottom line. Your ability to investigate incidents thoroughly is severely hampered, increasing risk.
How to Turn On Google Vault Retention: Step-by-Step Guide
Implementing Google Vault retention for Australian businesses is straightforward with these steps: 1. Sign in to vault.google.com with an account holding Vault privileges. 2. Go to Retention > Default rules and select Gmail. 3. Set a retention duration that matches your record-keeping obligations (many Australian businesses use seven years), and choose to keep messages even after users delete them. 4. Save, then add Custom rules under Retention > Custom rules for the organisational units or accounts that need longer holds.
Verifying Retention and Potential Pitfalls
To check it worked, delete a test message and empty the bin, then search for it in Vault > Matters — it should still appear. Be aware that Google Vault requires a Business Plus, Enterprise, or Education licence. Retention rules delete data at the end of the period, so set the duration carefully as it is not reversible. You should warn staff that even deleted emails may be retained for business purposes. If you'd like to discuss how this fits into your overall Google Workspace security, feel free to book a complimentary 15-minute chat with Neil.
Important Disclaimer
These steps are accurate at the time of publishing, but email platform menus and defaults can change. If you're not confident, please don't change settings yourself, as incorrect modifications can disrupt email service. SecureMyEmail accepts no responsibility for loss or damage caused by changes made without our direct involvement.
Enabling Google Vault retention is a non-negotiable security and compliance measure for Australian businesses. It ensures critical email data is always available for investigations, protecting your business from legal risks and data loss.
Disclaimer: These steps are accurate at the time of publishing, but email platform menus and defaults can change. If you're not confident, please don't change settings yourself, as incorrect modifications can disrupt email service. SecureMyEmail accepts no responsibility for loss or damage caused by changes made without our direct involvement.
Frequently asked questions
- What is Google Vault?
- Google Vault is a tool for Google Workspace that allows organisations to retain, hold, search, and export data for e-discovery and compliance needs. It covers Gmail, Google Drive, Google Chat, and other Google Workspace services.
- How long should my business retain emails in Google Vault?
- The retention period depends on your industry, legal obligations, and internal policies, but many Australian businesses choose seven years to align with tax and corporate record-keeping requirements. It's important to consult with legal or compliance professionals to determine the appropriate duration for your specific business.
- Does Google Vault retention cost extra?
- Yes, Google Vault is typically included with Google Workspace Business Plus, Enterprise, and Education editions. If your business uses a lower-tier Google Workspace plan, you may need to upgrade your subscription to access Google Vault features.
- Can I recover emails deleted before I turned on Google Vault retention?
- No, Google Vault only retains data from the point retention rules are applied. It cannot recover emails that were deleted and purged from the system before your retention policies were active.
- What happens when the retention period ends in Google Vault?
- Once the specified retention period ends, Google Vault automatically purges the data that is no longer subject to any holds or retention rules. This data is then permanently deleted and cannot be recovered.
Sources
Every reference below was link-checked when this article was published.
- 1.Data breach preparation and responseOffice of the Australian Information Commissioner
- 2.Notifiable Data Breaches schemeOffice of the Australian Information Commissioner
Want to know where your own tenant stands?
The audit answers these questions with a dated report on your actual settings — a few questions to start, under a minute.
