In a "normal" operation (when things go smoothly and are well designed) yes, the objects are retained, even if deleted in primary mailboxes, explicitly for the

In a "normal" operation (when things go smoothly and are well designed) yes, the objects are retained, even if deleted in primary mailboxes, explicitly for the accommodation of discovery requests and litigation holds. The rules can get more or less complex - negotiations on deals with TCV over a certain threshold have keywords and parties whose relevant emails are retained beyond normal policy, certain job classes have data retention extended beyond normal policy, keywords can trigger longer retention, information classification (either manual or automated) can extend retention periods. Software solutions have for many years streamlined the work necessary to pull this off compared to what it would have taken in an Exchange server farm 20 years ago. Anyway, all these business rules are (should be) documented in formal policies on data retention, litigation hold, privacy, etc. If a company were going through a working annual audit process for Sox or increasingly even routine annual financial audits (non-sox), policies would be examined for evidence that they are working with spot checks - e.g. auditor selects examples of qualifying events and asks for evidence that the given policy is in fact enabled/enforced technically. This may test retention as well as intention deletion (e.g. we should deliberately have no data beyond five years unless an exceptional circumstance warrants it).