# How long should we keep backups?

Long enough to go back to a point before an intrusion began and to meet your legal and business needs, but no longer than necessary for personal data. Attackers often sit in a network for weeks before they act, and corrupted or deleted files are sometimes noticed only months later, so a few days of retention is rarely enough. A common pattern is daily backups kept for a few weeks, weekly ones for a few months and monthly or quarterly ones for a year or more, with at least the most recent part immutable. Legal retention rules, for example for accounting records, set minimums for some data, while the GDPR's storage limitation principle means personal data should not be kept forever just because it sits in a backup; document how deletion requests are handled for backup copies. Write the retention plan down and check that the backup system actually enforces it.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/how-long-should-backups-be-kept

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [Should backups be encrypted?](https://netsenx.com/en/faq/should-backups-be-encrypted)
- [How do we protect backup servers on the network?](https://netsenx.com/en/faq/how-to-protect-backup-servers-on-the-network)
- [What is the difference between a backup plan and a disaster recovery plan?](https://netsenx.com/en/faq/difference-between-a-backup-plan-and-a-disaster-recovery-plan)
- [How should we back up virtual machines and hypervisors?](https://netsenx.com/en/faq/how-to-back-up-virtual-machines-and-hypervisors)
- [What is isolated or clean-room recovery?](https://netsenx.com/en/faq/what-is-isolated-or-clean-room-recovery)