1. Home
  2. Policy
  3. Information Management Policies
  4. Data Retention and Information Management Policy – Office 365

Data Retention and Information Management Policy – Office 365

This article outlines the data retention and information management policies for O365 applications. All users will be assigned a nationally allocated O365 E3 restricted licence. Any data that resides in O365, including personal data, is the responsibility of local organisations and is subject to local information governance and clinical safety practices. Local organisations must update transparency information to record how this data is captured and stored.

Important Note

For more information around which applications are enabled/disabled as default as part of the N365 licence – please visit the O365 NHSmail portal management getting started guide

Note

There is a key change to the data retention capability as part of the migration to exchange online.

Some applications have  different retention periods, which are set out in the table below.

For example, an email will be retained and available for forensic discovery in NHSmail for 2 years after it was received/sent or until it is deleted from the mailbox whichever is later.  If the email was deleted beyond 2 years after it was received and was removed from Deleted Items folder, then this email wouldn’t be present in forensic discovery search results. However, emails are not automatically deleted after 2 years unless a user has manually deleted them from their mailbox.

Further details on each capability can be found in the below table 

Note

Forensic Requests to access data held within the retention period can be actioned through the Helpdesk Self Service process. Further information on how this works guidance can be found on the Access Helpdesk Self-Service support pages.

The following table outlines where the specific application data is hosted[1] by Microsoft along with data retention information:

[1] Data residency and standard office recovery processes are based on the information provided by Microsoft as of November 2020. For the latest information on data residency please review the Microsoft website

 

Application

Data Location 1 Data Retention 2
For Forensic Discovery:
From point of creation/modification.
Deleted Objects Recovery 3

Notes

Azure Active Directory

European Union and United States n/a

30 days

Audit data for changes to Azure AD Users is retained within the Portal for a period of 2 years. 4

Exchange Online

United Kingdom Individual emails/calendar items 2 years

Email – 30 days
Entire Mailbox – 30 days

 

Deleted mailboxes in Exchange Online can be restored within 30 days of deletion. All Exchange Online emails (including archived content) are retained for 2 years from the point of receipt/send (e.g. creation/modification) for forensic requests.

Note: The 2 year retention is for all Exchange Online user mailboxes. Application mailboxes do not retain deleted emails for forensic requests.

Note: Deleted items are retained in the recycle bin in the mailbox.

Teams

United Kingdom

 

 

Europe (Dataverse for Teams)

Chat History 180 days

Teams & Channel (e.g. Chat)  – n/a

SharePoint Files – refer to SharePoint section

Team & Channel

Deleted Teams and Channels can be recovered for up to 30 days. Recovery of Deleted Teams and Channels requires a service request to be raised with the NHSmail helpdesk. Post 30 days it cannot be restored. However, its content can be retrieved using the forensic requests process, if it is under the retention period of 180 days.

SharePoint

Content (e.g. Files) that are shared on the Teams channel are stored in SharePoint Online. Therefore, the retention period is as per the SharePoint online section of this document.

Teams Call Recordings:

Teams call recordings are available for 20 days in Teams. Recordings downloaded and saved to OneDrive or SharePoint will follow the standard retention and restoration processes for those applications. Deleted recordings cannot be recovered.

Please visit this link for detailed guidance on managing a Teams group.

Dataverse for Teams

Dataverse for Teams environments created for Power Platform resources (apps, flows) can be recovered by submitting a Power Platform Service Request. Note recovery of an environment and its contents is only available for 7 days from the date of deletion. A Power Automate Flow or App can be deleted by the owner or Power Platform Admin and once deleted it cannot be recovered.

System backups are available for Dataverse for Teams environments.

OneDrive for Business

United Kingdom 180 days

Files –up to 90 days

Accounts – 30 Days

For Active Accounts:

Deleted items are moved to the recycle bin, they can be restored by end users for up to 90 days or until they are removed from the recycle bin.

For Deleted Accounts:

If a user account is marked for deletion, then the OneDrive for Business can only be restored within 30 days. After 30 days, OneDrive for Business cannot be restored. Content is still included in forensic requests results for 180 days, for all provisioned and licenced users in the environment, from the point at which it was created or modified.

Please visit this link for detailed guidance on deleting a user’s OneDrive data.

Audit data for changes to OneDrive is retained for a period of 90 days and can be requested via Forensic discovery request.

SharePoint Online

United Kingdom 180 days

File – 90 days
Site – 30 days
Subsite – 90 days

Files:

Restoration is as per the OneDrive for Business section. Deleted items are moved to the recycle bin, they are be restored by site members for up to 90 days or until they are manually removed from the recycle bin.

Site Collection Recovery

SharePoint Online site owners can delete Site Collections. Site collections can be recovered for up to 30 days.  Recovery of site collections requires a service request to be raised with the NHSmail helpdesk.

 Subsite Recovery

SharePoint Online site owners can delete a SharePoint subsite. Once a SharePoint online subsite is deleted, it is sent to the SharePoint Online site collection recycle bin (second stage). Site owners can recovery a subsite from the recycle bin for up to 90 days from the point of deletion. After 90 days subsites can’t be recovered.

Note: where sites have the default retention policy disabled the 180 day retention will not apply. 5

Audit data for changes to SharePoint sites is retained for a period of 90 days and can be requested via Forensic discovery request.

Dedicated Power Platform Environments

United Kingdom

n/a

Dedicated Production and Sandbox environments with Dataverse enabled for Power Apps.

 

Power Platform Dedicated Environments
If a dedicated environment is deleted, it can be recovered by submitting a Power Platform Service Request. Note recovery of an environment and its contents is only available for 7 days from the date of deletion.Production and Sandbox environments with Apps can be restored from System and Manual backups in Power Platform Admin Center. Note Power Automate Flows are unlikely to be recovered.
System backups are automatic, and environments can be restored to a Sandbox environment from a system/manual backup for the last 7 days (or 28 days for environments with model-driven apps).If backups are required beyond 7 days, a system backup can be taken and restored to a Sandbox environment.Note: System and manual backups are not available for the Default environment or Trial environments.

PowerApps

European Union and UK n/a

Power Apps deleted from the default environment cannot be recovered once deleted. Power Apps deleted from a dedicated environment may be recoverable*.

For Microsoft PowerApps, there is no recycle bin. A Power App can be deleted by the owner of the App or the Power Platform Admin and once deleted it may be recoverable.

In order to have a backup capability, users can export a copy of the Power App and save to OneDrive or SharePoint.

*Note: It may be possible to restore a backup of the dedicated environment to retrieve the Power App. Note environment backups are only available for 7 or 28 days. Please submit a Power Platform Service Request.

Audit data for changes to Power Apps is retained for a period of 90 days and can be requested via Forensic discovery request.

Power Automate

European Union and UK n/a

Power Automate Flows whether deleted from a dedicated environment or the default environment cannot be recovered once deleted.

For Microsoft Power Automate, there is no recycle bin. A Power Automate Flow can be deleted by the owner of the Flow or Power Platform Admin and once deleted it cannot be recovered

In order to have a backup capability, users can export a copy of the Power Automate Flow and save to OneDrive or SharePoint.

Audit data for changes to Power Automate is retained for a period of 90 days and can be requested via Forensic discovery request.

Microsoft Forms European Union n/a

Indefinitely

Once a Form is deleted and in the recycle bin, it will remain there indefinitely unless a user deletes it from the recycle bin. Microsoft Forms does not support retention or forensic requests.

A Form does not consume personalised storage, however responses exported to Excel will consume OneDrive or SharePoint storage depending on where it is saved.

Planner

European Union 180 days

Plan – 30 days

Microsoft Planner relies on Office 365 groups. If a user deletes a plan, it also deletes the group and associated data. It can be recovered through a service request to the NHSmail helpdesk within 30 days. After 30 days, an Office 365 group (plan) cannot be restored.

Stream

United Kingdom n/a

30 days

If a user deletes a Stream video, it goes to the Stream recycle bin where it can be recovered by the user within 30 days. After 30 days, the video is deleted from the recycle bin and it cannot be restored. If during the 30 days the video is deleted from the recycle bin it cannot be restored. Microsoft Stream doesn’t support forensic requests.

Note: This capability is currently restricted within the NHSmail tenant.

Sway

United States n/a

30 days

If a user deletes a Sway built using the Sway web application, Sway for Windows 10 or Sway for iPhone and iPad, it goes to the Sway recycle bin where it can be recovered by the user within 30 days.

After 30 days, the video is deleted from the recycle bin and it cannot be restored.

If during the 30 days, the Sway is deleted from the recycle bin it cannot be restored. Microsoft Sway does not support forensic requests.

Power BI United Kingdom n/a

Report/Dashboard/Associated O365 Group – 30 days

If a PowerBI Pro user deletes a Power BI report or dashboard or associated Office 365 group, it can be restored through a Service Request to the NHSmail helpdesk within 30 days. After 30 days, the Power BI report or dashboard or associated Office 365 group is deleted from the recycle bin and it cannot be restored. Microsoft Power BI does not support retention or forensic requests.

Audit data for changes to Power BI workspaces is retained for a period of 90 days and can be requested via Forensic discovery request.

OneNote Services

United Kingdom

n/a*

OneNote Desktop – 60 days

OneNote Browser – 60 days

OneNote SharePoint – 90 days

OneNote OneDrive – 90 days

 

A notebook page or section deleted using the desktop OneNote app can be recovered by a user within 60 days from the OneNote recycle bin. After 60 days, a deleted OneNote note page or section cannot recovered.

When sections of a notebook are deleted whilst accessing through a web browser, the delete is permanent and deleted sections cannot be recovered.

When pages of a notebook are deleted whilst accessing through a web browser, the deleted pages can be recovered by a user within 60 days from the OneNote recycle bin.

Notebooks in a SharePoint Online Site or in OneDrive for Business, if deleted from a web browser can be recovered from the SharePoint site Recycle Bin. Notebooks will follow the same retention as other documents held in OneDrive for Business and SharePoint Online.

Project Online

 

*Also referred to as Project Web App (PWA)

United Kingdom n/a*

Project Online – n/a

Project Online site– 30 days

 

For Project Online, there is no recycle bin. Once a project is deleted, it cannot be restored.

If a Project Online site is deleted, it can be restored as per the SharePoint Online site recovery process listed in the SharePoint Online section above.

Project for the Web

European Union and United Kingdom n/a

n/a

For Project for the Web, Projects are stored on the Power Platform default environment for which there is no recycle bin. A project can be deleted in Project for the Web by the owner – once deleted it cannot be recovered.

Note: In order to have a backup capability, users can export a copy of the Project and save to OneDrive or SharePoint.

Visio Online

United Kingdom n/a*

n/a

Microsoft Visio files can be saved locally or in OneDrive for Business. If the Visio files are saved in OneDrive for Business, they will follow the same retention and recovery process as any other content in OneDrive for Business.

Delve

European Union and United States n/a

n/a

Delve itself doesn’t hold any data for retention or forensic requests as it is purely a search tool

Yammer

European Union n/a

n/a

Once deleted, data (posts, groups) deleted in Yammer cannot be restored. Yammer does not support forensic requests.

Intune

European Union n/a

30 days

180 days for EUII (End User Identifiable Information)

1 Please note this document is accurate at the time of writing, please check Where your Microsoft 365 customer data is stored for any updates to data location.

How long data is retained for forensic discovery. The numbers of days measured from the date the data was created or last edited (i.e. for an email 2 years from when it was received or 180 days since a file was uploaded in OneDrive).

The period during which an object can be restored if it has been deleted, this is measured from when the object is deleted.

 Any modifications for users/permissions etc completed through the portal are audited and retained in the portal for 2 years.

 Disabling of the SharePoint default retention policy can be requested via the service desk if the default retention policy is impacting an organisations adoption and use of SharePoint.  Organisations would have to request this and confirm their acceptance and understanding of the implications of disabling the default retention policy.  When the default retention policy is disabled, that specific SharePoint site would go back to having the standard behaviour i.e. items retained in the 1st and 2nd level recycle bins for up to 90 days each assuming they didn’t manually purge them. Similarly, version control would remain in place but organisations would have the ability to manually delete old versions or change the version policy on that site if required.

Updated on 28/10/2021

Related Articles

Need Support?
Can’t find the answer you’re looking for? Don’t worry we’re here to help!
Contact Support
back to top