CLOUD & BACKUP
How long should a business keep backup data?
Retention should reflect how quickly a problem is likely to be noticed, any legal or record-keeping obligations, and how far back the business would need to recover from. There is no single correct retention period for every organisation.
Start with how a problem is usually found
Some issues, such as accidental deletion, are noticed quickly. Others, such as a slow-moving ransomware infection or an error that goes unnoticed for weeks, need a longer retention window to recover from cleanly.
Other factors that affect retention
- Legal, tax or industry record-keeping requirements
- How often information changes and how much history matters
- Storage cost versus the value of longer retention
- Whether backups need to cover email, files, servers or all three
A common structure
Many businesses use a tiered approach, for example daily backups kept for a shorter period, weekly backups kept for longer, and monthly backups retained for a year or more. The right structure depends on the organisation.
A practical next step
Document what is currently backed up, how long it is retained, and whether that would be enough if a problem was discovered later than expected. Adjust retention where there is a real gap.
RELATED QUESTIONS
Frequently asked questions.
Is Microsoft 365 retention the same as a backup?
Not necessarily. Retention and backup can overlap, but they are different controls with different recovery scenarios, and it is worth confirming which one actually applies to a given situation.
Should backup retention be the same for every type of data?
Not always. Financial records may need longer retention than day-to-day working files, so retention can reasonably vary by data type.