A brief overview
Compliance regulations play an important role in various processes when dealing with e-mail communication and archiving in particular.
- Which mails should/must be archived at all?
- How long do they have to be kept?
- Which e-mails, in contrast, may explicitly not be archived for longer than a certain period of time (this applies to application documents, for example)?
- How does the company deal with the challenge of “private e-mails”? Is private e-mail traffic permitted or prohibited? If permitted: How can these e-mails be cleanly separated from business archiving?
- What happens to emails from works councils – where are there conflicts with data protection and how can these be resolved?
In order to comply with data protection guidelines, sensitive information must not only be protected against unauthorized access from outside, but also with regard to internal accessibility. For example, it goes without saying that not every employee has uncontrolled access to all of the company’s emails.
REDDOXX MailDepot email archiving also offers an innovative 4-eye or multiple-eye principle for internal regulation. For certain processes and assignments, it is possible to specify that at least one or more persons from certain user groups must approve an action. These can be data protection officers or works council members, for example.
The multiple-eyes principle can also be used for security purposes, particularly in the context of special audit access for auditors. Access by authorized users is also documented in the compliance log in detail and in accordance with the law.
- Safeguarding important processes through additional control
- Protection against manipulation by individual users
- Flexible definition of one or more persons from certain groups
REDDOXX Compliance Framework at a glance
- Automatic classification of e-mails
- Manual addition by user (with appropriate rights)
- Allocation of individual storage times
- Deletion of information relevant to data protection
- Delete unimportant e-mails (e.g. newsletters)
- Deletion including the human factor (see application example)
- Audit access for financial audit
- Offline check
- Audit with dual control principle for internal audits
- Compliance log
Workflows can be used to define different retention periods, for example. In this way, tax-relevant data is stored for a sufficiently long time, while other information is deleted in a timely manner if required by data protection regulations.
Create project categories that enable easy team collaboration. For example, individual employees from sales, accounting or technical support can access the emails relevant to them, even if they were not the original sender or addressee. This means that employee absences due to vacation or illness no longer lead to delays.
Specify which users and groups have access to which emails.
Of course, all changes in the archive are documented in a tamper-proof and permanent manner. Even if the email in question no longer exists. This means that all processes can be clearly traced and documented at any time if required.
Not all processes can be fully automated. For example, no email archiving system can “know” that an application process is still pending and that documents therefore need to be stored for longer than usual. For this reason, the REDDOXX Compliance Framework allows the integration of corresponding approval workflows. In the example, the head of the HR department could automatically receive a corresponding report from the system before the deadline expires and decide on this basis whether an application should be deleted or not. All changes are documented in an audit-proof manner via the compliance log.
GDPR-compliant email archiving
Quick guide
DSGVO: Delete emails
REDDOXX has had a comprehensive compliance framework in place since 2011 to implement the current BDSG. In our screencast, we show you how you can remove emails from the archive in compliance with data protection regulations.
Contents:
- Administratively delete a person’s emails
- Manual deletion of emails by the user – using the example of an application
- Secure manual deletion with the multiple-eye principle
- Logging and evaluation of actions
