# Email retention policies are configured
Without retention policies, emails persist indefinitely in user mailboxes, creating liability for regulatory violations (GDPR, HIPAA, SOX), increased…
Source: https://maester.dev/docs/tests/ZTA.35028
## Overview
Without retention policies, emails persist indefinitely in user mailboxes, creating liability for regulatory violations (GDPR, HIPAA, SOX), increased eDiscovery costs, and uncontrolled storage expenses.
Retention policies automatically manage email lifecycle by deleting or preserving messages based on compliance requirements, reducing legal risk, and ensuring regulatory record-keeping obligations are met.
## Remediation
- [Create and manage retention policies](https://learn.microsoft.com/purview/create-retention-policies?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Data |
| Category | Information Protection |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Data lifecycle management |
| Area | Data protection |
| Licence | RMS_S_PREMIUM, Microsoft 365 E3 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.