Email archives from acquired companies: retain, migrate or license?

Retain, migrate or license: which comes first?#

Retention comes first for an acquired company's email archive, because legal holds and the retention schedule decide what must be kept before anyone decides what to move or license. Migration follows for mailboxes the business still needs. Licensing, if it happens at all, applies only to a prepared subset after privilege and personal data review.

Most archives end up split across several of these outcomes rather than one. The table sets out when each fits and what it requires.

Step 1: place legal holds before touching any mailbox#

A legal hold preserves the mailboxes of custodians connected to pending or reasonably anticipated litigation, investigations or audits. The acquirer's counsel should ask the seller for open disputes, demand letters, warranty claims and regulatory inquiries, then name custodians and date ranges before integration work begins.

Holds are fragile during an acquisition because the old tenant is often scheduled for cancellation. Microsoft describes a business subscription lifecycle in which an expired subscription becomes disabled, with only admins able to access and back up data, and data might be deleted after 90 days and will be deleted no later than 180 days after cancellation. Google warns that Workspace data is deleted on cancellation and cannot be restored, and that deletion can take up to 90 days.

Keep the subscription active, or export held mailboxes to a preserved store, until counsel releases each hold.

Step 2: apply the retention schedule#

The retention schedule decides which email is kept, and for how long, once holds are in place. Email carries many record types at once, including contracts, customer correspondence, HR matters, finance approvals and tax support, and each may carry its own retention period under tax, employment or contract rules.

If the acquired company never had a schedule, adopt the acquirer's and map the old mailboxes to it. Record each deletion with the date, the category and the approver, so the company can later show that deletion followed policy rather than convenience.

Email also lives outside the mail server: PST files on laptops, journaling archives kept by a third-party service, and messages stored inside the CRM or help desk. Bring them under the same schedule, or they survive by accident and surface later in a dispute or in a buyer's diligence.

Step 3: migrate what the business still uses#

Migration should move only the mail that active work depends on: current employees' mailboxes, shared inboxes for orders or support, and threads with live customers and suppliers. Former employee mailboxes usually go to a read-only archive instead, with access limited to named roles.

Export tools have deadlines of their own. Microsoft states that Purview eDiscovery search exports expire 14 days after creation, so packages must be downloaded promptly. Google says its Workspace Data Export does not include deleted data unless Vault retained or held it.

• 1Inventory every mailbox, shared mailbox, group alias and existing archive, including former employees.
• 2Confirm who holds super admin or global admin rights in the old tenant.
• 3Export held and archived mailboxes in a standard format and check that they open.
• 4Keep the old domain and forwarding rules until customers and suppliers have moved.
• 5Record where each archive lives, its owner and its retention end date.

Step 4: what must happen before any email license#

Email is one of the hardest record types to license because it mixes business decisions with privileged advice, personal matters and other parties' confidential information. A license is possible only for a carefully scoped subset after review, and some archives have no licensable subset at all.

Public deals show buyers drawing the same lines. Reporting on the 2026 bankruptcy sale of Spirit Airlines' internal business data said the deal excluded privileged legal materials and passenger profiles, that a third party would strip personally identifiable information before the buyer received the data, and that the agreement barred attempts to re-identify individuals.

Employee and business-contact details count as personal data too. The CCPA's exemptions for employee and business-to-business personal information expired on January 1, 2023, so staff and contact details in mailboxes may fall under that law for covered businesses. Which laws apply is assessed deal by deal with counsel.

Illustrative: a mechanical contractor's mailboxes after an add-on deal#

Illustrative: a fictional buy-and-build platform acquires a commercial mechanical contractor that runs Google Workspace, Procore for projects and a separate accounting system. The founder is retiring, several project managers left during the sale process, and the integration plan moves remaining staff to the platform's Microsoft 365 tenant.

The seller discloses an open warranty dispute on a school renovation. Counsel places holds on the mailboxes of the project manager and estimator involved before any change, then keeps the Workspace subscription active while those mailboxes and the former employees' mail are exported and checked. Active staff and the shared bids inbox migrate; everything else becomes a read-only archive under the platform's retention schedule.

Once integration settles, the platform considers licensing. The founder's mailbox and all HR and legal threads are excluded. Only bid, RFI and change order threads are described for a metadata-only fit check, with names and contact details to be removed during any preparation.

How SourceX treats email from an acquired company#

SourceX treats email as a high-preparation record type. Under the SourceX Enterprise Data Value Framework, human-generated signal and domain expertise can make business email useful, while privacy burden and preparation cost reduce its net value, so any scope is narrow and defined in writing.

Nothing is shared during the fit check, which uses metadata such as mailbox roles, date ranges and topics. If a subset proceeds through the SourceX five-step transaction, the SourceX Evidence Packet records the exclusions, the privacy record and the release authorization signed by the company.