How long should we keep backups?

Long enough to go back to a point before an intrusion began and to meet your legal and business needs, but no longer than necessary for personal data. Attackers often sit in a network for weeks before they act, and corrupted or deleted files are sometimes noticed only months later, so a few days of retention is rarely enough. A common pattern is daily backups kept for a few weeks, weekly ones for a few months and monthly or quarterly ones for a year or more, with at least the most recent part immutable. Legal retention rules, for example for accounting records, set minimums for some data, while the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679).'s storage limitation principle means personal data should not be kept forever just because it sits in a backup; document how deletion requests are handled for backup copies. Write the retention plan down and check that the backup system actually enforces it.

← All 25 questions on Backups and recoveryAll topics