GDPR Fines Hit €6.11 Billion — Is "Keep Everything Forever" a Compliance Risk?

As of March 2026, cumulative GDPR fines across the EU have reached roughly €6.11 billion, covering 2,685 fines with recorded amounts and dates, according to the CMS GDPR Enforcement Tracker Report for 2025/2026. The report records 3,062 cases when entries with incomplete information are included. Individual cases in that dataset run as high as €1.2 billion. Whatever your organization's risk model looked like when GDPR was new in 2018, the enforcement pattern eight years in is not theoretical anymore — it's a steady, well-documented cost center for companies that get their data handling wrong.

Most email retention advice focuses on the wrong failure mode. It tells you how long to keep categories of email for compliance — seven years of finance records, two years of support tickets — as if the risk is always deleting something too early. That risk is real. But regulators are increasingly clear that the opposite mistake, keeping everything indefinitely because deleting anything feels risky, is a violation in its own right.

The Principle Most Retention Policies Skip

GDPR does not hand you a fixed retention period for email, and that ambiguity is exactly why so many organizations default to "never delete anything, just in case." But Article 5(1)(e), the storage-limitation principle, requires personal data to be kept "for no longer than is necessary" for the purposes it was collected for — and Article 5(1)(c), data minimization, sits right alongside it. Indefinite retention isn't a safe default under either principle. It's the thing they were written to prohibit.

In practice, this means an organization has to be able to answer, for every category of email it holds: why is this being kept, and for how much longer. "We might need it someday" is not an answer regulators accept, no matter how understandable the instinct behind it is.

Regulators Now Want Proof, Not a Policy Document

The other shift worth noting: a written retention policy sitting in a compliance folder no longer satisfies enforcement expectations on its own. What regulators are asking for is auditable evidence that the policy is actually enforced — documented deletion workflows, retention schedules applied at the server level rather than left to individual employee discretion, and legal-hold procedures that correctly override routine purging when litigation is reasonably anticipated.

This is also visible in adjacent enforcement. France's CNIL and Italy's Garante both issued formal guidance in April 2026 treating an inbox as an extension of a person's private life — their guidance generally requires consent for tracking pixels, with defined exemptions and transitional arrangements. Check the applicable regulator’s rules for the particular use. It's a different mechanism than retention enforcement, but the underlying posture is the same: regulators are looking specifically at what companies do with the contents of email, not just whether a policy document exists somewhere.

A Retention Schedule That Actually Holds Up

None of this requires exotic tooling. A defensible structure looks like a small number of categories, each with a documented reason and a duration:

Routine operational mail — internal coordination, scheduling, day-to-day correspondence with no independent legal or financial significance. Commonly retained around a year, then purged.

Customer support correspondence — typically kept longer, often two years, to cover warranty and dispute windows.

Finance and tax-relevant records — governed by whatever your jurisdiction's tax and audit rules require, frequently seven years.

Anything under active legal hold — retained regardless of category until the hold is lifted, overriding every other schedule.

The specific numbers vary by industry and geography — GDPR doesn't set them, your regulator or your own documented justification does. What matters is that every category has a number attached to it, and the number is actually enforced instead of aspirational.

Where a Personal Archive Fits Into This

A local archive changes where a record lives; it does not remove retention obligations. For business mail containing personal data, define why each category must be retained, who can access it, and when it must be deleted. Apply that policy to server mail, local archives and backup copies. Continued retention needs a valid purpose or legal obligation; moving mail off the server cannot create one. See CNIL’s retention guidance.

MailVault archives every folder from your IMAP or OAuth account as individual .eml files on your own disk, independent of your provider's mailbox at all. Use that local copy only for records you are entitled to retain, and include it in your access controls and deletion schedule. MailVault does not provide centrally enforced retention policies, legal holds or compliance certification. Manual backups are free and unlimited; scheduled backups that keep the archive current automatically are a $4/month or $25/year premium feature, with a 14-day trial on the yearly plan. These file-layout instructions use the default Maildir format. Settings → Storage also offers JMAP storage, which keeps original message bytes with JSON records and deduplicates identical messages.

Related reading: how to delete thousands of old emails safely, email archiving for freelancers, and how to keep emails after deleting them from the server.