1. Home
  2. Policy
  3. Information Management Policies
  4. Data Retention and Information Management Policy – Office 365

Data Retention and Information Management Policy – Office 365

This article outlines the data retention and information management policies for O365 applications. As part of the NHSmail Refresh all users will be assigned a nationally allocated O365 E3 restricted license. Any data that resides in O365, including personal data, is the responsibility of local organisations and is subject to local information governance and clinical safety practices. Local organisations must update transparency information to record how this data is captured and stored.

Important Note

For more information around which applications are enabled/disabled as default as part of the N365 license – please visit the guidance materials here

Note

There is a key change to the data retention capability as part of the migration to exchange online.

Data Retention is the continued storage of an organisation’s data for compliance or business reasons. Where applicable the default data retention period is 180 days from when it was created or edited.

Some applications have a different retention periods, which are set out in the table below.

For example, an email will be retained and available for forensic discovery in NHSmail for 180 days after it was received/sent or until it is deleted from the mailbox whichever is later.  If the email was deleted 181 days after it was received and was removed from Deleted Items folder, then this email wouldn’t be present in forensic discovery search results. However,  emails are not automatically deleted after 180 days unless a user has manually deleted them from their mailbox.

Further details on each capability can be found in the below table.

Note

Forensic Requests to access data held within the retention period can be actioned through the Helpdesk Self Service process. Further information on how this works can be found here.

The following table outlines where the specific application data is hosted[1] by Microsoft along with data retention information:

[1] Data residency and standard office recovery processes are based on the information provided by Microsoft as of November 2020. For the latest information on data residency please review the Microsoft website

 

Office 365 Applications – Data Location and Data retention Periods

Application Data Location 1 Data Retention 2
For Forensic Discovery:
From point of creation/modification.
Deleted Objects Recovery 3 Notes
Azure Active Directory European Union and United States n/a 30 days Audit data for changes to Azure AD Users is retained within the Portal for a period of 2 years. 4
Exchange Online United Kingdom Individual emails/calendar items 180 days  

Email – 30 days
Entire Mailbox – 30 days

 

Deleted mailboxes in Exchange Online can be restored within 30 days of deletion. All Exchange Online emails (including archived content) are retained for 180 days from the point of receipt/send (e.g. creation/modification) for forensic requests.

 

Note: The 180 days retention is for all Exchange Online user mailboxes. Application mailboxes do not retain deleted emails for forensic requests.

 

Note: Email tracking logs for user mailboxes are retained for 2 years. These include summary data on emails (i.e. sender, recipient, subject, timestamp) but not the email content.

 

Note: Deleted items are retained in the recycle bin in the mailbox.

Teams United Kingdom Chat History 180 days Teams & Channel (e.g. Chat)  – n/a

SharePoint Files – refer to SharePoint section

Team & Channel

Deleted Teams and Channels, including conversations, chat history and membership cannot be restored, however its content can be retrieved using the forensic requests process, if it is under the retention period of 180 days.

 

SharePoint

Content (e.g. Files) that are shared on the Teams channel are stored in SharePoint Online. Therefore, the retention period is as per the SharePoint online section of this document.

 

Teams Call Recordings:

Teams call recordings are available for 20 days in Teams. Recordings downloaded and saved to OneDrive or SharePoint will follow the standard retention and restoration processes for those applications. Deleted recordings cannot be recovered

 

Please visit this link for detailed guidance on managing a Teams group.

OneDrive for Business United Kingdom 180 days Files –up to 90 days

Accounts – 30 Days

For Active Accounts:

Deleted items are moved to the recycle bin, they can be restored by end users for up to 90 days or until they are removed from the recycle bin.

 

For Deleted Accounts:

If a user account is marked for deletion, then the OneDrive for Business can only be restored within 30 days. After 30 days, OneDrive for Business cannot be restored. Content is still included in forensic requests results for 180 days, for all provisioned and licensed users in the environment, from the point at which it was created or modified.

 

Please visit this link for detailed guidance on deleting a user’s OneDrive data.

SharePoint Online United Kingdom 180 days File – 90 days
Site – 30 days
Subsite – 90 days
Files:

Restoration is as per the OneDrive for Business section. Deleted items are moved to the recycle bin, they are be restored by site members for up to 90 days or until they are manually removed from the recycle bin.

 

Site Collection Recovery

SharePoint Online site owners can delete Site Collections. Site collections can be recovered for up to 30 days.  Recovery of site collections requires a service request to be raised with the NHSmail helpdesk.

 

Subsite Recovery

SharePoint Online site owners can delete a SharePoint subsite. Once a SharePoint online subsite is deleted, it is sent to the SharePoint Online site collection recycle bin (second stage). Site owners can recovery a subsite from the recycle bin for up to 90 days from the point of deletion. After 90 days subsites can’t be recovered.

 

Note: where sites have the default retention policy disabled the 180 day retention will not apply. 5

PowerApps European Union and UK n/a n/a For Microsoft PowerApps, there is no recycle bin. A PowerApp can be deleted by the PowerApps owner – once deleted it cannot be recovered.

Note: In order to have a backup capability, users can export a copy of the PowerApp and save to OneDrive or SharePoint.

Power Automate European Union and UK n/a n/a For Microsoft Power Automate, there is no recycle bin. A Power Automate can be deleted by the owner and once deleted it cannot be recovered

 

Note: In order to have a backup capability, users can export a copy of the Power Automate (Flow) and save to OneDrive or SharePoint.

.

Microsoft Forms European Union n/a Indefinitely Once a Form is deleted and in the recycle bin, it will remain there indefinitely unless a user deletes it from the recycle bin. Microsoft Forms does not support retention or forensic requests.

 

A Form does not consume personalised storage, however responses exported to Excel will consume OneDrive or SharePoint storage depending on where it is saved.

Planner European Union 180 days Plan – 30 days Microsoft Planner relies on Office 365 groups. If a user deletes a plan, it also deletes the group and associated data. It can be recovered through a service request to the NHSmail helpdesk within 30 days. After 30 days, an Office 365 group (plan) cannot be restored.

 

 

Stream United Kingdom n/a 30 days If a user deletes a Stream video, it goes to the Stream recycle bin where it can be recovered by the user within 30 days. After 30 days, the video is deleted from the recycle bin and it cannot be restored. If during the 30 days the video is deleted from the recycle bin it cannot be restored. Microsoft Stream doesn’t support forensic requests.

 

Note: This capability is currently restricted within the NHSmail tenant.

 

Sway United States n/a 30 days If a user deletes a Sway built using the Sway web application, Sway for Windows 10 or Sway for iPhone and iPad, it goes to the Sway recycle bin where it can be recovered by the user within 30 days.

 

After 30 days, the video is deleted from the recycle bin and it cannot be restored.

If during the 30 days, the Sway is deleted from the recycle bin it cannot be restored. Microsoft Sway does not support forensic requests.

Power BI United Kingdom n/a Report/Dashboard/Associated O365 Group – 30 days If a PowerBI Pro user deletes a Power BI report or dashboard or associated Office 365 group, it can be restored through a Service Request to the NHSmail helpdesk within 30 days. After 30 days, the Power BI report or dashboard or associated Office 365 group is deleted from the recycle bin and it cannot be restored. Microsoft Power BI does not support retention or forensic requests.

 

OneNote Services United Kingdom n/a* OneNote Desktop – 60 days

OneNote Browser – 60 days

OneNote SharePoint – 90 days

OneNote OneDrive – 90 days

 

A notebook page or section deleted using the desktop OneNote app can be recovered by a user within 60 days from the OneNote recycle bin. After 60 days, a deleted OneNote note page or section cannot recovered.

When sections of a notebook are deleted whilst accessing through a web browser, the delete is permanent and deleted sections cannot be recovered.

When pages of a notebook are deleted whilst accessing through a web browser, the deleted pages can be recovered by a user within 60 days from the OneNote recycle bin.

Notebooks in a SharePoint Online Site or in OneDrive for Business, if deleted from a web browser can be recovered from the SharePoint site Recycle Bin. Notebooks will follow the same retention as other documents held in OneDrive for Business and SharePoint Online.

Project Online United Kingdom n/a* n/a

Project Web App (PWA) – 30 days

For Microsoft Projects, there is no recycle bin. Once a project is deleted, it cannot be restored. If a Project Web App site is deleted, it can be restored as per the SharePoint Online site recovery process listed in the above
Visio Online United Kingdom n/a* n/a Microsoft Visio files can be saved locally or in OneDrive for Business. If the Visio files are saved in OneDrive for Business, they will follow the same retention and recovery process as any other content in OneDrive for Business.
Delve European Union and United States n/a n/a Delve itself doesn’t hold any data for retention or forensic requests as it is purely a search tool
Yammer European Union n/a n/a  

Once deleted, data (posts, groups) deleted in Yammer cannot be restored. Yammer does not support forensic requests .

1 Please note this document is accurate at the time of writing, please check Where your Microsoft 365 customer data is stored for any updates to data location.

2 How long data is retained for forensic Discovery. The numbers of days measured from the date the data was created or last edited (i.e. for an email 180 days from when it was received or 180 days since a file was uploaded in OneDrive).

3 The period during which an object can be restored if it has been deleted, this is measured from when the object is deleted.

4  Any modifications for users/permissions etc completed through the portal are audited and retained in the portal for 2 years.

5  Disabling of the SharePoint default retention policy can be requested via the service desk if the default retention policy is impacting an organisations adoption and use of SharePoint.  Organisations would have to request this and confirm their acceptance and understanding of the implications of disabling the default retention policy.  When the default retention policy is disabled,  that specific SharePoint site would go back to having the standard behaviour i.e. items retained in the 1st and 2nd level recycle bins for up to 90 days each assuming they didn’t manually purge them. Similarly version control would remain in place but Organisations would have the ability to manually delete old versions or change the version policy on that site if required.

Updated on 20/11/2020

Related Articles

Need Support?
Can’t find the answer you’re looking for? Don’t worry we’re here to help!
Contact Support
back to top