How long should a business keep backup data?
A business should keep backup data for as long as it is needed to restore operations, meet legal or contractual obligations, and investigate security incidents. The appropriate retention period depends on the organisation’s data, industry, recovery requirements and risk profile, so it should be defined in a documented backup policy and reviewed regularly.
Backup retention is the period for which a recoverable copy of a particular type of business data remains available. The appropriate period should be set for each data category, rather than applying one blanket rule to every backup. Operational files may need short-term version history, while records linked to finance, contracts, projects, disputes or compliance may require a longer controlled record-keeping period.
A useful retention policy separates the reasons for keeping data:
- Operational recovery: copies used to recover recently deleted, corrupted or incorrectly changed files.
- Business continuity: copies retained to rebuild systems after hardware failure, a major outage or a cyber incident.
- Historical reference: point-in-time copies that show how information existed at a particular stage of a project, reporting period or transaction.
- Investigation: preserved data that may help establish what happened during a security incident or suspected misuse.
- Compliance and contractual purposes: records retained to satisfy applicable legal, regulatory, client or insurance requirements.
These purposes can produce different retention periods for the same system. For example, recent versions of working documents may be replaced as newer copies are created, while a final project record may be retained separately until the relevant contractual or business requirement has ended. A backup should not be treated as the organisation’s only archive unless it has been designed, controlled and tested for that purpose.
Legal requirements should be checked against the organisation’s sector, the type of record and the reason it is being held. UK data protection rules include a storage limitation principle: personal data should not be kept for longer than necessary for its purpose. This does not create one universal backup period, but it does mean that backup retention, deletion processes and restoration procedures should be considered as part of the organisation’s data protection arrangements. Financial records, employment information, health-related data, regulated records and contractual documents may each have different requirements.
Organisations should also account for legal holds. If litigation, an investigation, an audit or a regulatory request is reasonably anticipated, relevant deletion schedules may need to be suspended for the affected information. A legal hold should identify the systems and data concerned, record who authorised it and state when normal disposal can resume. It should not result in every backup being retained indefinitely.
A practical retention policy normally documents:
- which systems and data sets are covered;
- how many versions or recovery points are maintained for each category;
- when copies move from routine recovery storage to longer-term retention;
- which legal, contractual, insurance or internal requirements apply;
- who approves exceptions and legal holds;
- how expired copies are securely deleted or allowed to expire;
- how the policy is reviewed when systems, suppliers, regulations or business activities change.
Retention also has a technical and financial effect. Keeping more recovery points requires additional storage, and older copies may need different controls from frequently accessed operational backups. Data should be encrypted, access should be restricted, and retained copies should be protected from unauthorised alteration or deletion. A long retention period is not useful if an attacker can remove every copy or if the organisation cannot identify which version is trustworthy.
Retention schedules should be tested through restoration exercises. Testing can reveal whether older backups are readable, whether encryption keys remain available, whether applications can use the recovered data and whether the documented process reflects the current infrastructure. The test should cover representative systems and data types, not just the easiest file to restore.
Finally, retention should be reviewed alongside the wider backup policy rather than set once and forgotten. Changes to data protection obligations, contracts, software, locations, staff responsibilities or recovery requirements may alter how long particular copies should remain available. A managed IT provider such as S2 Technology Group can help an organisation map its data, document retention rules and align backup configuration with its operational and compliance requirements, while the business remains responsible for confirming the obligations that apply to its records.
Backup retention must account for how long data corruption, unauthorised changes or a security incident could remain undiscovered. If a problem is identified after the most recent recovery points were created, those copies may all contain the same damaged or compromised data.
For this reason, a retention plan should preserve suitable historical recovery points rather than keeping only the newest copies. The required history depends on how quickly different problems are likely to be detected and how far the organisation may need to go back to find a trustworthy version.
Older recovery points should be clearly identified and protected from routine deletion. They also need to remain usable: the organisation should know which systems they relate to, how to access them and whether the necessary encryption keys and application dependencies are still available. This makes the retention period meaningful when recovery requires a point in time before an issue was discovered.
