Collaboration platforms were sold as conversation and became records. That transition happened without anyone deciding it, and by the middle of the 2010s most organisations were holding a searchable archive of every internal discussion, every file shared informally, and every direct message their employees had sent for as long as the platform had existed — with no retention policy, no disposal schedule, and no clear view of what would happen if a regulator or an opposing party asked for it. The email equivalent of this problem had been fought over for a decade. Financial regulators had established that business communications must be retained, supervised and producible; litigation practice had established that anything discoverable must be preserved once litigation is reasonably anticipated. Email systems had grown journaling, archiving, legal hold and eDiscovery capability in response. Chat arrived with none of that, got adopted from the bottom up, and quietly accumulated the same liability.
Why retention is a two-sided problem
The instinctive approach — keep everything, storage is cheap — is the wrong answer, and so is its opposite. Keeping everything creates discoverable material. Every candid remark about a customer, every speculative comment about a competitor, every frustrated message about a colleague, every informal discussion of a decision that was later formalised differently. In litigation or a regulatory examination, all of it is producible, and the cost of reviewing years of unstructured chat for privilege and relevance is substantial. Organisations that have been through this describe the review cost as exceeding the value of anything the archive contained. Deleting aggressively creates a different exposure. Regulated firms have retention obligations measured in years. Employment disputes, warranty claims and contract arguments frequently turn on what was said and when. And deletion of material after litigation is reasonably anticipated is a serious problem in itself, regardless of intent — the appearance of spoliation is often more damaging than the content would have been. The defensible position is a documented policy, applied consistently, with a reliable mechanism to suspend it when a hold is required. What makes a retention practice defensible is not the length of the period; it is that the period was set deliberately, applied uniformly, and can be evidenced.
The parts organisations get wrong
Direct messages. Most policies are written for channels and silently ignore private messages, which is where the sensitive material actually sits. Retention, export and hold capability for direct messages is the first thing to check and frequently differs by platform tier. Files. Documents shared in a conversation live in the collaboration platform's storage, outside the document management system, outside the retention schedule, and outside whatever access review the organisation runs. A spreadsheet of salary data posted in a channel three years ago is still there. Departed employees. What happens to an ex-employee's messages when their account is deactivated varies by platform and by configuration, and the default is frequently not what the organisation would choose. Losing a departed employee's history can destroy the evidence you need; retaining it indefinitely extends the discoverable set. Integrations and bots. Automated content carries the same retention status as anything else and is almost never considered. Approval workflows executed through a bot may be the only record of an authorisation. External and guest participants. Shared channels with customers, suppliers or advisers create records governed by two organisations' policies at once, with unclear ownership and frequently no agreement about who retains what. Unsanctioned channels. The policy covers the platform the company licenses. It does not cover the messaging app where a substantial share of the actual conversation happens, and regulators in several jurisdictions have made clear that the obligation attaches to the communication, not to the channel — with very large penalties imposed on financial firms for off-channel messaging.
Setting a policy that holds up
The workable approach is short and unglamorous. Classify by channel type rather than trying to classify by content, because content classification at message level does not work at scale. Project and team channels, executive channels, regulated-business channels and direct messages can each carry a different period. Set the period from the actual obligation: the regulatory requirement where one applies, the limitation period for likely disputes where one does not, and business utility where neither is binding. For most non-regulated internal conversation, a period measured in months to a small number of years is adequate and defensible. Apply it automatically. Manual deletion is inconsistent by construction, and inconsistency is what makes a retention practice indefensible. Build the legal hold mechanism and test it before you need it. The question to answer in a drill is how quickly you can suspend deletion for a named set of custodians and produce their material, and the honest answer in most organisations is that nobody has tried. And document the reasoning. A policy with a written rationale, applied consistently, survives scrutiny. An undocumented practice does not, even if the outcome is identical.
Inspect actual settings
Check message, file, direct-message and departure behavior.
Map obligations and holds
Record the applicable duties and how deletion can be suspended.
Test preservation and export
Rehearse named-custodian hold and evidence production end to end.
Qualitative summary of this article's source text, not a measured outcome or performance estimate.
Practical Guidance for Collaboration Retention Review
- Establish what the platform is doing today before writing any policy. Current retention settings, what happens on account deactivation, whether direct messages are covered, and what the export capability actually produces.
- Set different periods by channel category rather than one blanket rule. Regulated conversation, general team channels and direct messages have genuinely different obligations and risks.
- Include files, not just messages. Shared documents are the highest-sensitivity content in most collaboration archives and the most commonly omitted from retention design.
- Test legal hold end to end at least annually. Suspend deletion for named custodians, export their material, and time it. This is the capability you will need under pressure.
- Decide the departed-employee rule explicitly. What is retained, for how long, who can search it, and how that interacts with your obligations in each jurisdiction where you employ people.
- Address off-channel communication directly in policy and in practice. Prohibiting messaging apps that everyone uses produces unrecorded business conversation, which is the worst outcome available.
- Govern shared external channels with an explicit agreement. Who retains, who may export, and what happens to the channel when the commercial relationship ends.
- Write down the reasoning behind each period. The documented rationale is what makes the practice defensible, and it takes an afternoon.
The Regional Dimension
Retention design in Gulf organisations runs into three complications that global templates do not address. The first is the channel reality. A very large share of business communication across the region happens on consumer messaging apps — supplier negotiation, customer commitments, internal approvals, payment instructions. That material is business communication regardless of where it lives, and it is effectively unretained, unsearchable and unproducible. Regulated entities in DIFC and ADGM face record-keeping expectations that this behaviour does not satisfy, and the international enforcement trend on off-channel communications makes the exposure concrete rather than theoretical. The realistic policy response is not prohibition, which fails. It is defining which categories of communication must occur in a recorded channel — anything constituting an approval, a commitment, or a payment instruction — and providing a sanctioned mobile option that people will actually use. The second is jurisdictional fragmentation. A group with mainland UAE entities, a DIFC or ADGM entity, a Saudi subsidiary and international operations sits under several regimes at once: local data protection frameworks with their own requirements on retention limitation and cross-border transfer, financial services rules with prescribed record-keeping periods, and — for entities with European exposure — storage limitation obligations that push in the opposite direction from "keep everything". Those requirements conflict in places, and the resolution has to be made deliberately per entity rather than by applying the strictest rule everywhere, which is usually both expensive and wrong. The third is residency and access. Where the archive physically sits, which backups exist in which region, and which support personnel can reach it are questions that regional regulators and enterprise customers now ask directly. The arrival of UAE and Saudi cloud regions has made local storage feasible for many workloads, but collaboration platform tiers differ in what they offer, and a platform whose archive and eDiscovery functions run in another region may not satisfy a residency commitment even when the primary data store does. One further local factor: workforce mobility. High turnover means the departed-employee retention rule is exercised constantly rather than occasionally. Getting it wrong in either direction — losing the history of everyone who leaves, or retaining everything indefinitely across thousands of departures — compounds quickly.
The objection worth taking seriously
The strongest criticism is that aggressive retention policies destroy the thing that makes collaboration platforms valuable. The searchable archive is genuinely useful. New joiners learn how a system works by reading the channel where it was built. Engineers resolve incidents by finding how the same failure was handled two years ago. Decisions are reconstructed by reading the discussion that produced them. A ninety-day retention policy deletes all of that on a rolling basis, and the organisation quietly loses institutional memory to reduce a litigation risk that may never materialise. There is a behavioural cost too. People communicate differently when they know the record is permanent and producible. Some of that is healthy; much of it is not. Teams that become careful in writing move the candid conversation to calls and private messaging, which is worse for the organisation on every dimension — no record, no searchability, no supervision. The honest resolution is that the right answer depends on your risk profile and cannot be borrowed from someone else's. A regulated financial services entity with active litigation exposure and a technology company with neither should not have the same policy. Differentiating by channel is what lets both objectives coexist: longer retention for the channels that carry durable operational knowledge, shorter for the ones that carry conversation, with the regulated categories set by obligation rather than by preference. The failure mode to avoid is neither extreme — it is having no policy at all and discovering the answer during a production request.
Common Questions
What retention period should we set?
There is no portable number. Start from the binding obligations that apply to each entity, then the limitation periods for disputes you plausibly face, then business utility. For unregulated internal conversation, a period long enough to preserve operational knowledge and short enough to limit the discoverable set is the trade being made, and it should be written down with its reasoning.
Do direct messages need the same treatment as channels?
They need a deliberate decision, and usually a different one. Direct messages carry higher sensitivity and lower operational value, which argues for shorter retention — but regulated communications are regulated wherever they occur, so the categorisation must follow the content's status rather than the container.
How do we handle messaging apps people actually use?
By defining which communications must be recorded rather than by banning the tool. Prohibition without an acceptable alternative produces unrecorded business conversation and a policy that is visibly ignored, which is worse evidentially than permitting the channel and capturing what matters.
How do AI features interact with retention?
Directly, and most policies have not caught up. Summaries, search indexes, embeddings and assistant conversation histories are derived copies of your messages, and deleting the source message does not necessarily remove them. Any retention review conducted now should ask what the platform's AI features retain, for how long, whether that retention is governed by the same schedule, and whether those derived artefacts are covered by legal hold and export. There is also a supervision dimension: an assistant that can search across channels gives every user a more powerful retrieval tool than the compliance team had a few years ago, which changes who can find what in your archive.
Collaboration Retention Review — the archive you never configured is a records decision you have already made, just not deliberately and not defensibly.