30 Vault retention & legal hold

Vault decides how long Gmail, Drive, Chat and Groups data is kept and whether a user can delete it at all. A default rule sets a retention period per service; a custom rule overrides it for an OU or shared drive; a hold on a matter overrides both — including user deletion — for as long as the hold exists. Retention is what makes data survive an attacker or a departing employee trying to destroy it, and Vault privileges are a separate admin role rather than something implicit in super admin.

Documentation: Set up Vault for your organization ↗ · How retention works ↗

Caveats

A retention rule with an expire action is a data-destruction mechanism¹
Holds beat retention rules and user deletes, but they do not beat a rule you never wrote²
Vault is bundled with Business Plus and higher³
Vault privileges are a separate admin role from super admin⁴

Setup steps

Vault › Retention › Default rules
Open Retention > Default rules and set a default retention rule per service (Gmail, Drive, Chat, Groups) so data is retained for the records-retention period rather than indefinitely-by-accident.

Default rule per service
Retain for <N> days from message/file creation
post-retention action
purge (choose purge only already-deleted items, or purge all data including undeleted items) (OU carve-outs, e.g. retain-indefinitely for crown jewels, belong in the next step's custom rules)

Retain Gmail messages with Vault ↗
open ↗
https://vault.google.com/u/0/retention · captured 2026-07-15
Vault › Retention › Custom rules
Add a custom rule scoped to the OU (organizational unit) / shared drive holding sensitive material where the default duration is wrong.

Custom rule
scope (OU / shared drive / term) + duration + expire action

Retain Drive files with Vault ↗
Vault › Matters › <matter> › Holds
Create a matter and place a hold on the accounts/OUs under legal preservation. A hold overrides retention rules and user deletion for as long as it exists.

Hold = service (Gmail/Drive/Chat) + accounts or OU; no end date

Get started with holds in Google Vault ↗ Create & manage matters ↗
Admin console › Account › Admin roles
Confirm the Vault privileges are a separately-granted role, not implicit in super-admin day-to-day accounts, and that Vault actions are alerted on (see №61 audit-the-auditors).

Vault role granted to named custodians only; since November 1, 2025 each Vault admin must also hold a Vault license — the role alone no longer grants access

Set up Vault privileges ↗

Ongoing maintenance

requires a human On every departure/litigation event: place or release holds per the legal process.

How to verify

In Vault, read the default retention rule and any custom rules against the retention schedule, and list active holds — then search for a message older than the retention window to confirm expiry actually happens.

Further screens

Admin console screen — Google Vault > Matters (legal hold lives inside a matter) — https://vault.google.com/u/0/matters captured 2026-07-15

v0.1.3Recoveredition Business Plus+ policy #18 · #11 (gap G2) ↗