Every document has a lifecycle – from creation through active use to archiving or deletion. Microsoft Purview Retention Policies help you automatically manage this lifecycle in SharePoint Online while fulfilling legal retention obligations.

Why Retention Management is So Important

Legal Requirements in Switzerland

Swiss companies are subject to various retention obligations:

• Business records and documents: 10 years according to OR Art. 958f
• Personnel files: Varies depending on document type (5–10 years after departure)
• Contracts: Generally 10 years after contract termination
• Tax documents: 10 years according to DBG
• Medical records: 10–20 years depending on the canton
• Emails with business relevance: Same periods as the underlying business processes

The Risk: Too Much and Too Little

Without an active retention strategy, two problems arise simultaneously:

Over-Retention: Everything is retained, nothing is deleted. The volume of data grows uncontrollably, storage costs rise, and in legal disputes, vast amounts of data must be reviewed (E-Discovery risk).

Under-Retention: Documents are deleted too early. Legal obligations are violated, and evidence is missing during audits or legal disputes.

Microsoft Purview Retention: The Basics

Retention Labels vs. Retention Policies

Microsoft Purview offers two mechanisms:

Retention Policies operate at the container level – they are applied to entire SharePoint sites, OneDrive accounts, or Exchange mailboxes. All content in the container is subject to the same rule.

Retention Labels operate at the document level – they are attached to individual documents or folders. Labels enable granular control and can also be manually applied by users.

How Retention Works Technically

When a retention period expires, the following happens:

1. 1Retain and then delete: The document is retained for the defined duration. If deleted beforehand, it moves to the Preservation Hold Library (hidden recycle bin). After expiration, it is permanently deleted.

1. 1Only retain: The document is permanently retained and cannot be deleted – not even by administrators.

1. 1Only delete: After the expiration period, the document is automatically deleted. There is no retention obligation.

The Preservation Hold Library is invisible to users. It ensures that documents remain intact even if someone deletes them from SharePoint – as long as the retention period is ongoing.

Retention Strategy for Swiss Companies

Step 1: Inventory Document Types

Capture all document types in your organization and assign retention periods:

Step 2: Create Retention Labels

In the Microsoft Purview Compliance Portal, create labels for each retention category:

Label "Business Document – 10 Years"

• Retention: 10 years from creation date
• After expiration: Disposition Review (manual review before deletion)
• Auto-Apply: On document libraries with business documents

Label "Personnel File – 5 Years After Departure"

• Retention: 5 years from label application (set upon departure)
• After expiration: Automatic deletion
• Application: Manually by HR upon employee departure

Label "Temporary – 1 Year"

• Retention: 1 year from creation
• After expiration: Automatic deletion
• For: Drafts, temporary working documents, meeting notes

Step 3: Establish Retention Policies for Baseline

In addition to labels, we recommend a baseline retention policy for all SharePoint sites:

• Standard retention: 7 years for all content
• After that: Deletion (unless a more specific label overrides)
• This ensures that no document slips through without minimum retention

Step 4: Set Up Disposition Reviews

For critical document types, we recommend disposition reviews. Before final deletion, designated reviewers receive a notification and can decide:

• Approve: Document is deleted
• Extend: Retention period is renewed
• Relabel: Another retention label is applied
• Declare as Record: Document becomes an immutable record

Records Management: The Next Step

What are Records?

Records are documents with legal or business significance that are declared immutable. In SharePoint, you can declare documents as records:

• Regulatory Records: Cannot be deleted or altered by anyone – not even by global administrators
• Standard Records: Can be unlocked by authorized individuals but are protected by default

When to Use Records?

• Contracts after signing
• Annual financial statements after auditing
• Regulatory submissions
• Minutes (board meetings, general assemblies)
• Certification documents

Adaptive Scopes: Dynamic Assignment

Instead of manually applying policies to individual sites, you can use Adaptive Scopes. These dynamic rules automatically find the right targets:

• All SharePoint sites with "HR" in the name: Automatic application of the HR retention policy
• All OneDrive accounts of the finance department: Automatic 10-year retention
• All sites that have not been edited in the last 2 years: Automatic archiving

Adaptive Scopes update automatically when new sites are created or employees change departments.

Integration with the Swiss DSG

Right to Deletion

The Swiss DSG gives affected individuals the right to request the deletion of their personal data (provided there is no legal retention obligation). Retention labels support this process:

1. 1Search with Content Search for all documents of the affected person
2. 2Check if retention obligations exist
3. 3Delete documents without retention obligation
4. 4Document the process for accountability

Proportionality

The DSG requires that data be retained only as long as necessary for the purpose. Retention policies technically implement this principle – data is automatically deleted after the expiration period.

Best Practices

Start with a Pilot Phase

Begin with one department (e.g., HR or Finance), test the policies, and gather feedback. Only then roll out company-wide.

Document Your Strategy

Create a retention schedule – a central document that records all retention periods, legal bases, and responsibilities. This document is also invaluable during audits.

Combine with Sensitivity Labels

Retention labels and sensitivity labels complement each other perfectly: Sensitivity labels control access, retention labels control lifespan. A document can carry both labels.

Train Employees

Explain to employees why retention is important and how to apply labels. Make it clear: It’s not about control, but about protection and compliance.

CNEXT Supports You

Implementing a retention strategy requires legal, organizational, and technical expertise. CNEXT brings all three dimensions together. We help you understand your retention obligations, define the right strategy, and implement it technically in Microsoft Purview.

Contact us for a non-binding consultation.

Further Links & Sources

Internal:

• Sensitivity Labels
• DLP in SharePoint
• SharePoint Governance
• Site Lifecycle Management

External:

• Retention Policies in Microsoft 365
• Records Management
• Compliance Center