Retention policies enable you to maintain certain types of content in Box for a specified period of time and to remove content from Box that is no longer relevant or in use after a specific period.
Admins and co-admins who have been given explicit permission to manage policies can create Retention policies to apply to content stored in Box. Admins can apply a policy on a per-folder basis, or place a blanket policy over any new content added to the enterprise. Retention policies are available via the Admin Console in the Box web application.
When a file is subject to a retention period, that file cannot be permanently deleted/purged from the trash. Files under retention can, however, be deleted from folders; at that point, they will be retained in the trash until the retention period expires. When the retention period expires, you can choose to have the content automatically deleted or for the policy to be removed.
Retention policies apply to versions of files; so, if Version 1 of a file has a 7-day retention period applied, and Version 2 is uploaded 3 days later, Version 2 will be under retention for 7 days from the date of upload (for 4 days after Version 1's retention period expires).
Creating a Retention Policy
In the Admin Console, navigate to the Policies tab. Then, click the Create Policy button, go the the Policy type field, and select Retention.
Next, select the folders where you want the policy applied. Please note that any subfolder would be subject to the same Retention policy.
Note: You can also select All new content to apply a retention policy enterprise-wide.
To choose folders, click the Select a folder button, and use the folder picker to navigate to users and their folders or to search for folders or users. To apply to policy to a particular folder, click on the circle to the left of the folder name, and then click Save for policy.
You'll need to indicate the length of your retention period. To do this, go to the Set retention period for field, and select an option from the drop-down menu. As an Admin, you can designate the length of a retention period. Currently, available retention periods are:
7, 30, 60, or 90 days
1, 2, 3, 5, 7, or 10 years
A custom number of days or years
An indefinite period of time: Files can also be governed by an indefinite flag or unknown retention policy. If a file must be retained for the life of a customer or life of an enterprise, admins can set a folder to retain all files within it indefinitely. Once it is known when the material is eligible for disposition, folder owners, co-owners, and editors can move the file (or folder) to a folder with a finite retention period.
In the After policy endsfield, specify what Box should do with your content when the retention period has expired, i.e. a disposition action. You can choose to either Permanently delete content or Remove retention policy (making content deleteable). You can also give folder owners and co-owners the ability to extend deletion dates.
You can choose to notify folder owners and co-owners (or specific users of your choosing) before their content is deleted in the Send notification email to field. Selected users will recieve weekly emails with a list of all content set to be deleted in the next two weeks. The email will specify the folder up for deletion, and will hyperlink to the appropriate location in Box.
To start your new Retention policy, click Start Policy Now.
Retention policies apply to entire folders, so any content added to a folder with a retention policy applied will also be subject to that policy. If a policy is set at a top folder level, and a different policy is set lower down in the folder structure (i.e. on a sub-folder), the longer policy will govern the content.
Editing a Retention Policy
Once you have created a Retention policy, you can use the Edit function to either change the name of the policy or change what happens when the retention period expires.
To edit a Retention policy, navigate to that policy and click on the Action button in the top-right corner. Select Edit from the drop-down menu.
After making changes, click the Update Policy button to save your changes.
End User Experience
When a folder is governed by a Retention policy, end users will see a notification at the top of the folder view. Notifications are also displayed on individual files; to view, click the More options arrow to the right of the file name and select Properties > General Info.
If a user moves a file that is subject to a Retention policy, the policy follows the file to its destination.
If a user moves a file carrying a Retention policy to a folder with the same retention period—Box observes both the retention period and the original post-retention period action.
If a user moves a file carrying a Retention policy to a folder with a different retention period, the longer retention period will supersede the shorter one. The retention period will be based on the upload date of the file, not the move date to the new folder.
If a user moves a file from a folder with a Retention policy to a folder without a Retention policy, the file is still governed under the initial retention period.
If a user copies a file, that file is not subject to a Retention policy unless it is copied into a folder governed by a policy.
A user cannot transfer a file or folder with a Retention policy outside of the enterprise, change the folder owner to an external party, or move an individual file to a folder owned by an external user.
Users can click the delete button on a retained file, sending that file to trash. However, users cannot purge the file from trash. They can only restore the file to its original location. If the original location has been deleted, users can choose where the file will live upon restoration.
As a Box admin, you can notify folder owners and co-owners that a file is reaching the end of its retention period via the policy settings. Folder owners and co-owners will then receive a batched email notification that files are near the end of their retention periods (planned functionality).
File retention overrides administrative trash settings, so if trash is purged every 30 days, but a file is to be retained for 6 years, the file will not be purged from the user’s trash until the retention period has ended.
Retiring a Retention Policy
Retiring a Retention policy means that any new content added to a folder under that policy will not be subject to the policy. Any content already under that Retention policy will continue to adhere to that policy.
Only admins with access to the Policies tab in the Admin Console can retire a policy.
To retire a policy, navigate to that policy and click on the Action button in the top-right corner. Select Retire from the drop-down menu.
When you retire a policy, you can't undo the action.
Retention Policy Reporting
As an admin, you can generate a report on the creation, editing, and retiring of a policy (administrative actions). You can also report on the application of policies to documents and the deletion of documents as part of an end-of-policy disposition action. Admins can report on any of these actions for a period of 7 years after an action was taken. Box does not keep reports beyond 7 years; you must download and maintain reports for retention beyond this 7-year period.