# Who should be allowed to delete backups?

Almost nobody, and nobody alone. Deleting backups or shortening their retention is the action attackers most want to perform before encryption, so it should be harder than any normal admin task. Practical rules: only a small number of named backup administrators hold the right, using accounts separate from the main domain and protected by phishing-resistant MFA; deletion or retention changes need approval from a second person where the product supports it; immutable copies cannot be deleted by anyone until their lock expires; and every deletion is logged to a place the backup administrators cannot edit. Ordinary IT staff can run and monitor backups and restore files without being able to remove them. Review the list of people with these rights regularly and remove leavers immediately. If deletion is genuinely required, for example by a court order or a GDPR erasure request, document the decision and the approval.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/who-should-be-allowed-to-delete-backups

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [Does NetSenX back up our data?](https://netsenx.com/en/faq/does-netsenx-back-up-our-data)
- [Should we back up the configuration of firewalls, switches and routers?](https://netsenx.com/en/faq/should-we-back-up-network-device-configurations)
- [Is a snapshot a backup?](https://netsenx.com/en/faq/is-a-snapshot-a-backup)
- [What is the 3-2-1 backup rule?](https://netsenx.com/en/faq/what-is-the-3-2-1-backup-rule)
- [What is an immutable backup?](https://netsenx.com/en/faq/what-is-an-immutable-backup)