Can we include former employees' mailboxes?

Often, if they still exist. Microsoft 365 deletes a leaver’s mail 30 days after the license goes unless a hold was set; Google allows 20 days to restore a deleted user. Survivors can hold personal and HR mail nobody now at the company has read.

Do their mailboxes still exist?

That depends on what your admin did as each person left, and each system leaves a different trace. The rules are set out on the Microsoft 365 and Google Workspace pages; this is where to look, as of October 2026:

Where to look	What you will find	What it tells you
Microsoft 365: inactive mailboxes, listed in Microsoft Purview under Data Lifecycle Management, per Polyshares’ Outlook guide	Mailboxes of deleted accounts	A hold or retention policy was on the mailbox before the account was deleted
Microsoft 365: shared mailboxes named after a person	A leaver’s converted mailbox	Conversion keeps “all of the existing email and calendar information”
Google Workspace: users who are suspended or hold an Archived User license	Accounts with sign-in blocked	Google keeps the data; suspended accounts are billed at the full rate
Google Workspace: users deleted in the last 20 days	A deleted account that can still come back	The mail returns only if you restore the user

Anyone deleted earlier is gone from that system unless, in Microsoft 365, a hold or retention policy made the mailbox inactive. In Google Workspace a Vault hold does not keep a deleted user’s mail, because once the user is deleted “any retention rules or holds placed on the deleted user’s data no longer apply”. Their threads with people still at the company remain in those colleagues’ mailboxes, which Does my company’s data qualify? explains. Slack is different: deactivating a member does not delete their messages.

If the whole company is closing, My company is closing. Can I sell our data? covers the deadlines and approvals.

Why did this particular mailbox survive?

Because someone chose to keep it: a hold, a retention policy or a conversion to a shared mailbox in Microsoft 365, or a suspension or Archived User license in Google Workspace. For holds, the reason matters before you include it. Microsoft names the holds that make a mailbox inactive: a retention policy or retention label, an eDiscovery hold, or Litigation Hold. With Litigation Hold and no duration set, items are “held indefinitely or until the hold is removed”.

• If a company-wide retention policy kept every leaver’s mailbox, the survivors are an ordinary cross-section of former staff.
• If a mailbox sits under an eDiscovery hold, it was kept for an eDiscovery case. It can hold privileged mail and the details of a departure that went badly; Is it legal to sell company emails and records? explains why privileged mail stays out.
• If it sits under Litigation Hold, that can be a routine offboarding step or a response to a dispute, so ask which.

Ask whoever set each hold why, and leave it in place. Microsoft warns that if a hold tied to an eDiscovery case “is released or the eDiscovery case is closed (or deleted), the inactive mailbox is permanently deleted,” and a hold placed for a lawsuit is for your lawyer to lift.

What is in a departed person’s mailbox?

Their working mail, plus whatever else they used the account for. That can include medical appointments, family matters, a job search, and the paperwork of their own exit: a resignation, a performance warning, severance terms. Nobody may have opened the mailbox since they left, and the one person who could say what is personal is no longer there to ask.

Removing names does not settle it. In the Spirit Airlines bankruptcy, where the records came from an airline that had shut down, the Electronic Privacy Information Center told the court in a brief announced on October 2, 2026 that de-identification “is not a magic wand that addresses the privacy concerns around identifying employees through inferences”. In a small company, a thread about one person’s leave or dismissal points to that person with or without a name; What does “anonymized” mean? shows how.

Do buyers want former employees’ mail?

At least one program counts it. Polyshares’ Outlook guide says “Seats are licensed user mailboxes plus inactive mailboxes of former employees” and answers yes to exporting email from people who left, if their mailboxes became inactive mailboxes (as of October 2026). Several providers ask how many years your records cover (Does my company’s data qualify? lists them), and a long-serving leaver’s mailbox may be the only record of the years before current staff joined.

Much of the rest is duplicated. A leaver’s threads with colleagues who stayed also sit in those colleagues’ mailboxes, so what only their mailbox holds is their correspondence with customers, suppliers and colleagues who have also left. That is the part to weigh against the review work.

What should we check before including them?

For each surviving mailbox, or each group of them:

1. Why it exists. The hold type and, for a case hold, the matter it belongs to.
2. Any agreement with the person. A separation, severance or settlement agreement, read for confidentiality terms, and any open claim. Both go to your lawyer.
3. What staff were told. Your handbook or email policy on personal use, and any privacy notice to employees, as they read while the person worked there.
4. Where the person lived. For companies that meet its thresholds, California’s privacy law has covered employee information since its exemptions expired on December 31, 2022; Is it legal? covers that and union contracts.
5. Their role. Polyshares notes “legal, HR or board mailboxes never need to be included” in an eDiscovery search; leave out HR, payroll, legal and executive mailboxes whole.
6. Personal threads. Search for words such as resign, severance, attorney, medical and benefits, and for personal webmail addresses, then read what comes back. Customers may use webmail too, so read before removing.

What are our options?

Three, each with a different trade-off:

Option	What goes to the buyer	What you give up or take on
Include surviving mailboxes, with exclusions	Their mail, minus the categories and threads you remove	The most review, and the risk of anything your rules miss
Leave their mailboxes out	Their part of threads with current staff, through colleagues’ mailboxes	Their correspondence with customers and suppliers
Leave out everything they wrote	Nothing from them anywhere	A rule by email address across every mailbox, and the most value

Can I leave out certain customers, people or folders? shows how to put each into the license scope.

What do we do next?

1. Keep the next leaver’s mailbox. Convert it to a shared mailbox or set a hold in Microsoft 365 (on Business Basic and Standard a hold needs an add-on; the Microsoft 365 page explains), or give it an Archived User license in Google Workspace. Keeping it does not commit you to licensing it.
2. List the survivors with the reason each exists, and set aside any tied to a legal matter.
3. Export one and read a sample before deciding on the rest.
4. Choose an option and write it into the scope.
5. Record the count of former-employee mailboxes and the years they cover in your data inventory.