Regimes · European Union
An email archive you can erase from
Commercial law requires that nothing disappears. The GDPR requires that personal data disappears once it is no longer needed. An archive has to do both, and neither may damage the other.
Keeping and erasing at once
Emails almost always contain personal data: names, addresses, content. The GDPR requires that it is stored only as long as the purpose requires (Art. 5(1)(e)) and gives people a right to erasure (Art. 17).
That right has limits, written into the article itself. Under Art. 17(3) GDPR it does not apply where processing is necessary to comply with a legal obligation (point b) or for the establishment, exercise or defence of legal claims (point e). An email the Swiss CO or the German GoBD require to be kept is therefore not erased on request. Once its period has run out, it is.
Why erasing from an archive is hard
An archive is built so that nothing changes: messages sit in finished files locked against writing, and a hash chain makes sure every change is noticed. Cutting a message out of such a file would mean rewriting the file, and the integrity proof would rightly report that as tampering.
The answer: destroy the key
With GDPR erasure switched on, MailVault encrypts the content of every message under its own key (AES-256-GCM). Erasing means destroying that one key:
- The pack files are left alone, and the integrity proof stays valid.
- The content can no longer be read, because no key is left to open it.
- The erasure itself becomes an entry in the audit journal: who, when, which message and why.
- An attachment shared by several messages stays readable until the last message holding it has been erased.
Because a key can only be destroyed for a message that was stored on its own, an archive with GDPR erasure stores every message individually, whatever compression is chosen.
Decide when you create the archiveOnly what was stored encrypted can be erased. If you need the GDPR, choose it when creating the archive. An archive without the setting refuses an erasure request rather than quietly doing nothing.
How an erasure request runs
- MailVault gathers what the archive holds about the person, across every address they have used.
- The overview shows what is under a legal hold and how many messages are still inside their statutory retention period.
- Messages under a hold are not erased; Art. 17(3) GDPR provides for that.
- A person carries out the erasure, with their name, a reason and a confirmation typed by hand. Overriding a statutory period is their decision, not the software's.
Access requests under Art. 15
The same overview answers a subject access request: what does the archive hold about this person? The messages can be handed over as a portable package or as .eml with an index.
mailvault request "Archive.mailvault" --participant anna@example.comAnd in Switzerland?
The Swiss Federal Act on Data Protection follows the same principle: personal data is destroyed or anonymised as soon as it is no longer needed for the purpose of processing. A Swiss company with customers or staff in the EU is often subject to the GDPR itself as well.
Questions
Do I have to erase emails on request?
Not while a statutory retention duty applies or they are needed for legal claims (Art. 17(3)(b) and (e) GDPR). After that, yes.
Does an erasure break the integrity proof?
No. What is destroyed is the message's key, not the file it sits in. The chain stays valid, and the erasure becomes an entry in it.
How do I answer a subject access request?
MailVault gathers what the archive holds about a person, across all their addresses, and hands it over as a portable package or as EML with an index.
Not legal advice. This page describes how the software works. Whether an organisation complies depends on its organisation, processes and documentation as well; for your own case, involve your auditor or legal adviser.
Try it on your own mailboxes.
Thirty days with everything open, no sign-up. Or we set up the first archive with you.