← All posts
Thought Leadership

Deleting emails after the duty starts: obstruction, preservation, and the notice that prevents it

October 13, 2026 · 8 min read

In June 2024 the European Commission fined a fragrance and flavours group €15.9 million. No cartel finding was involved in that figure. The fine was for obstruction: during a 2023 inspection, a senior employee intentionally deleted WhatsApp messages exchanged with a competitor, after being told the inspection was under way. The Commission’s inspectors found the deletion themselves when the phone was submitted for review.

One person, one action, taken in the minutes after learning that regulators were in the building. Under Regulation 1/2003 the Commission can fine up to 1% of worldwide turnover for obstruction, and it settled on 0.3% here, reduced because the company acknowledged the facts immediately and helped recover the data.

The deletion is the part everyone remembers. The more useful part for a compliance team is what came before it: whatever made a senior person believe that removing a thread was an available option.

Two duties, two triggers, one reflex

Organisations tend to hold a single vague idea of “do not destroy evidence”. In practice two distinct duties apply, they start at different moments, and the same instinct breaches both.

Obstruction during an investigation. The duty starts the moment the company is informed of an inspection. There is no litigation, no hold notice, no legal instruction needed. Regulation 1/2003 exposes the company to a fine of up to 1% of total turnover if employees intentionally or negligently obstruct, and a single deleted chat thread is enough to engage it. The Commission treated the 2023 deletion as very serious partly because it happened after the employee had been informed of the inspection, and partly because the company did not report it, leaving inspectors to detect it.

Preservation in litigation. In the Business and Property Courts of England and Wales, Practice Direction 57AD sets out what preservation actually requires. Paragraph 4.1 is explicit that the documents to be preserved include those that would otherwise be deleted “in accordance with a document retention policy or in the ordinary course of business”. Paragraph 4.2 turns that into three obligations: suspend relevant deletion or destruction processes for the duration of the proceedings, send a written notification to relevant employees and former employees where there are reasonable grounds to believe they hold disclosable documents the company does not also hold, and take reasonable steps so that agents and third parties do not delete material either.

The trigger for the second duty is earlier than most staff assume. Paragraph 4.4 requires legal representatives instructed where their client knows it may become a party to proceedings to notify the client of the preservation duty and to obtain written confirmation that the steps in 4.2 and 4.3 have been taken. Paragraph 4.5 then requires each party to confirm in writing, when serving its statement of case, that preservation steps were taken.

The sentences that come before the deletion

Deletion is a physical act with a timestamp, which is why it is easy to prove. The sentences that precede it are the ones that establish intent, and they survive in the other side’s mailbox even when the original thread does not.

The sentence What it does to the record
“Let’s take this offline.” Reads as an intention to continue the discussion where it cannot be produced. On its own it is ambiguous. Next to a deleted thread it stops being ambiguous.
“Better not to put that in writing.” Establishes that the writer understood the subject was sensitive. That understanding is what turns a gap in the record into an adverse inference.
“Can you delete the earlier thread?” An instruction. If a duty has already started, this is the obstruction, whether or not the recipient complies.
“Use my personal number for this one.” Moves the exchange to a device the company does not control and the employee believes is private. The Commission asked to review employees’ mobile phones during the 2023 inspection.
“Our policy is 90 days, so it is gone anyway.” Treats a retention policy as permission. PD 57AD 4.1 removes that reading: routine deletion is exactly what has to stop.

None of these five is written by someone planning a cover-up. They are written by people being efficient, discreet or reassuring. That is the pattern we keep finding in the cases we broke down in the private messages that became the case, and it is the reason a policy document alone does not move the number.

Three beliefs that produce the reflex

“Tidying is good practice.” Mailbox hygiene is encouraged for years, then becomes an offence overnight when a duty starts. The switch is invisible to the person doing the tidying, because nothing in the mailbox changes to tell them.

“The retention policy protects us.” A schedule that deletes messages after a fixed period is a defensible policy right up to the moment a duty attaches, at which point paragraph 4.2(1) requires the process to be suspended. Companies that cannot suspend deletion selectively end up suspending it globally, which is expensive and often the only available answer.

“My personal phone is mine.” Where business is discussed on a personal device, the messages are within the scope of both duties. Staff learn this during an inspection, which is the worst possible moment. This is the same boundary problem covered in off-channel communications and SYSC 10A.

Where a pre-send check fits

Preservation controls, archiving and eDiscovery all operate on messages that exist. They are the right tools for the record, and they cannot reach the sentence that was typed before anyone thought about records.

A pre-send check runs at the keyboard, on the phrasing itself. “Let’s not put this in writing” and “can you delete the earlier thread” are short, recognisable phrase patterns, which is the kind of accidental risk VerbaPulse is built for: the careless line from a well-intentioned person, flagged on their own screen before it is sent. Firms that already know which phrasings cause them trouble can load their own list as custom policies, and the department-level record of what was flagged sits in the audit trail without storing message content. We wrote up what that record should contain in the audit trail for business communications.

The notification, written to the rule

Most hold notices fail in the same two ways: they ask the recipient to exercise judgement, and they say “email” when the exposure is in chat and on phones. Paragraph 4.3 of PD 57AD is narrow about what the notification should do, and the narrowness is helpful. It should identify the documents or classes of documents to be preserved, and notify the recipient that they should not delete or destroy those documents and should take reasonable steps to preserve them.

Here is that requirement as text a legal team can adapt. It is short on purpose.

Subject: Preservation notice, [matter reference], action required

[Name], this notice concerns [describe the matter in one sentence]. Until we tell you otherwise, you must preserve everything you hold about [classes: the [project] tender, pricing discussions with [counterparty], and any communication with [names or roles] between [date] and [date]].

This covers email, attachments, chat messages including Teams and WhatsApp, meeting notes, voice notes, and calendar entries. It applies wherever they are held, including your personal phone and any personal account, if the subject is work.

Do not delete or destroy any of it. Do not edit, move or reorganise it. If a deletion routine or an auto-archive rule would remove it, stop that rule and tell [name] today. If you are unsure whether something is in scope, keep it and ask [name].

If you have already deleted something relevant, tell [name] now. Recovery is usually possible and reporting it immediately changes the position materially.

Confirm by reply that you have read this and taken the steps above.

Four details in that text carry the weight. It names classes of documents, as 4.3(1) requires, so the recipient is not left to define relevance. It lists channels and devices, because the exposure lives in chat and on phones. It instructs suspension of automated deletion, which is the 4.2(1) obligation translated into something an individual can act on. And it asks for a reply, which is how the company later shows that the notification was sent and received, alongside the written confirmations 4.4 and 4.5 require.

The last paragraph is the one legal teams often cut, and it is worth keeping. The 2024 obstruction fine was reduced because the company acknowledged the deletion immediately and helped recover the data. A notice that makes early reporting the obvious move buys back part of the exposure created by whoever deletes something anyway.

Takeaway

Write the preservation notice before you need it, with classes, channels and devices named, and store it where whoever picks up the next matter will find it in the first hour. The gap between the duty starting and the notice going out is where the second fine comes from, and that gap is a drafting problem you can solve on a quiet afternoon.

See how VerbaPulse flags risk before an email is sent, right inside Gmail and Outlook.

See VerbaPulse in action →
← What does clear, fair and not misleading mean in a customer email? Cloud, Sovereign, Enclave, Black: four ways to deploy a compliance check, and when each fits →