What to Do With Company Email and Servers After Closing a Business
When a company closes, its IT is often switched off in a rush. The office broadband is cancelled, the Microsoft 365 or Google Workspace subscription lapses, and the server in the comms cupboard is wiped or unplugged. Yet email accounts and servers hold the company's working history. Some of it must be kept for legal reasons, and some of it may have value. This guide explains what to do with company email after closing a business, and how to handle servers and cloud storage properly.
Why it matters
- Legal retention: UK law requires certain records to be kept for set periods. HMRC, for example, expects accounting records to be kept for a number of years.
- Investigations and claims: liquidators, creditors or former clients may need access to correspondence.
- Continuity: customers and suppliers may still email the old addresses.
- Value: operational records may have a use, including licensing. See how to sell data to AI companies.
Step 1: Take control of administrator access
Make sure someone with authority holds the global administrator credentials for Microsoft 365 or Google Workspace, the domain registrar and any hosting provider. Remove former staff access, and enable multi-factor authentication.
Step 2: Inventory every data store
- Mailboxes, shared mailboxes and distribution lists
- SharePoint sites, OneDrive and Google shared drives
- On-premises file servers and NAS devices
- Hosted servers and virtual machines
- Backup services and their retention
- Line-of-business applications with their own databases
Note each system's size, date range and renewal date.
Step 3: Decide: continue, export or both
Continue
Keeping a reduced subscription running for a few months often costs less than losing the data. Microsoft 365 and Google Workspace both offer options to keep mailboxes as inactive or archived accounts. Check current licensing terms.
Export
Export mailboxes and file stores to secure, encrypted storage. Use formats that keep metadata such as timestamps, senders, recipients and folder structure. Microsoft Purview eDiscovery and Google Takeout or Vault are the usual tools.
Image servers
For on-premises servers, take a full image before hardware is sold or disposed of, then wipe the original securely.
Step 4: Handle the domain
Keep the domain name registered. If it lapses, someone else could register it and receive email sent to your old addresses. Consider an auto-reply explaining that the company has closed and who to contact.
Step 5: Apply retention and deletion rules
Decide what must be kept and for how long, and what can be securely deleted. Personal data shouldn't be kept longer than necessary, so document your reasoning.
Step 6: Consider whether the data has a further use
Before deleting operational material, consider whether it could be licensed responsibly once personal data has been removed. Our guides on anonymising data before a sale and data valuation explain what to look for.
Common mistakes
- Cancelling the Microsoft 365 or Google Workspace subscription before exporting
- Letting the domain expire
- Selling or recycling servers without imaging and wiping them
- Exporting files without metadata, which loses dates and authors
- Leaving former directors as the only people who can log in
If the company is in insolvency
The office-holder takes control of the company's data. Practitioners should read insolvency data: digital records in liquidation.
How McKays can help
McKays helps owners and advisers assess whether preserved records have a responsible licensing use. Start with a non-confidential description. Explore the sector guides or see for advisers.
Collaboration tools and line-of-business systems
Email is only part of the picture. Many businesses now do as much work in Microsoft Teams or Slack as they do in email, and their operational history sits in project, job-management, CRM and accounting software. Each has its own export method and its own retention settings. Our guides to exporting Slack data and Teams archives and Jira export and project-software data cover these systems. Don't assume that an email export captures everything.
Security during wind-down
A closing company is an attractive target for fraud. Former staff accounts may still be active, invoices may be redirected and phishing may exploit the confusion. Keep multi-factor authentication on, monitor sign-ins, and make sure only a small, named group can approve changes to domains, DNS records and payment details. Log every export and every deletion. If a data breach does occur, the reporting duty to the ICO still applies after closure.
A simple decision table
| Situation | Suggested approach |
|---|---|
| Records may be needed for investigation | Preserve everything; do not delete |
| Statutory retention applies | Keep for the required period, then delete securely |
| No legal need and no further use | Delete securely and record the deletion |
| Possible licensing value | Preserve, then assess with personal data removed |
FAQ
How long should I keep company email after closing?
It depends on the content and on legal requirements. Financial, contractual and employment records each have their own retention periods. Take advice.
Can I just delete everything?
Not safely. You may have legal retention duties, and deleting data can harm investigations or claims.
What is the cheapest way to keep email?
Usually a reduced or archive licence, or a secure export to encrypted storage. Prices change, so compare current options.
Should I keep the domain?
Yes, at least for a period. A lapsed domain can be re-registered by someone else and used to receive your email.
Who owns company email after closure?
The company, or the office-holder acting for it in insolvency. It does not belong to individual directors or staff.