From articles I've read and sample policies I've seen, it appears to be practice to keep e-mails on your computer for a period of time before deleting them. Most people read e-mail and then hit delete and put it in the deleted folder. If the computer is set to delete upon exiting, that e-mail is gone. I have been asked by our IT Officer to show in writing why it is written in our policy that all e-mails will be kept for a period of 90 days before being deleted and why. I know it is just like keeping paper correspondence until you think you no longer need it, but I need it in writing. Anyone help me with this?

It is not a rule, but a good or even best practice. E-mails fly back and forth fast and the responder doesn't always quote the last message. It isn't as fast as a phone call but it is much faster than snail mail. E-mails can be the equivalent of a delayed conversation. Mistakes can happen in these messages.

If I e-mail you and ask for rates on car loans and you reply with 5 or 6 rates, and I respond and say I'll take the X% without reference to the car loan or terms, you may not know what I was talking about. The customer may also mis-quote you.

E-mails are in writing and could be more damaging if the wrong things are said. Saving them keeps these in context and likely you won't need it for longer than that.

Some messages which are insignificant (a subjective judgment call) can be deleted immediately. Some should be retained for a time such as 90 days, and some should be fit into the paper based rules such as being tied to a denied consumer loan application (25 months).