{"id":31838,"date":"2026-10-06T22:10:31","date_gmt":"2026-10-06T20:10:31","guid":{"rendered":"https:\/\/www.wedoback.com\/?page_id=31838"},"modified":"2026-10-07T11:00:27","modified_gmt":"2026-10-07T09:00:27","slug":"how-long-to-keep-backups","status":"publish","type":"page","link":"https:\/\/www.wedoback.com\/en\/guides\/backup\/how-long-to-keep-backups\/","title":{"rendered":"How long should you keep your backups?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"31838\" class=\"elementor elementor-31838 elementor-31565\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-79d83d0 e-con-full wdb-g e-flex e-con e-parent\" data-id=\"79d83d0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-135a6d8 e-con-full wdb-g-hero e-flex e-con e-parent\" data-id=\"135a6d8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-beb3d96 e-con-full wdb-g-hero-in e-flex e-con e-parent\" data-id=\"beb3d96\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-107c093 elementor-widget elementor-widget-text-editor\" data-id=\"107c093\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/backup\/\">IT backup<\/a><\/p><p class=\"wdb-g-pill\" style=\"--pill:#01adb9\">IT backup<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f94e4f5 elementor-widget elementor-widget-heading\" data-id=\"f94e4f5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">How long should you keep your backups?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bffc3cf elementor-widget elementor-widget-text-editor\" data-id=\"bffc3cf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-lead\">To get the business running again after a failure, an error or ransomware, thirty days of daily restore points are enough for most SMEs. Obligations of ten years, twenty years or more apply to specific documents: they are handled through archiving, not by extending the nightly backup indefinitely.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f1fa601 elementor-widget elementor-widget-text-editor\" data-id=\"f1fa601\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>3 min<\/b> read<\/span><span><b>5<\/b> sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5a80ab6 e-con-full wdb-g-body e-flex e-con e-parent\" data-id=\"5a80ab6\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-99803ea e-con-full wdb-g-grid e-flex e-con e-parent\" data-id=\"99803ea\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-e1ade7c e-con-full wdb-g-article e-flex e-con e-parent\" data-id=\"e1ade7c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b3f23d5 elementor-widget elementor-widget-text-editor\" data-id=\"b3f23d5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-key\"><h2>Key points<\/h2><ul><li><strong>30 days<\/strong> of daily restore points: a useful minimum, because an intrusion often remains hidden for two weeks or more.<\/li><li>Beyond three months, keep <strong>spaced-out<\/strong> restore points (weekly, monthly), not every night.<\/li><li>Legal retention periods (10 years for accounting, 6 years for tax in France) apply to <strong>documents<\/strong>, not to server images.<\/li><li>The GDPR limits how long personal data can be kept: \u201cjust in case\u201d is not a retention period.<\/li><li>Write down the chosen retention period and monitor storage usage.<\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2c9bc8d elementor-widget elementor-widget-text-editor\" data-id=\"2c9bc8d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Why thirty days is a useful minimum<\/h2><p>Ransomware is not always spotted on the day it strikes. In its M-Trends 2026 report, Mandiant measured a median of 14 days between compromise and detection in 2025, compared with 11 days the previous year. A median means that half of all intrusions remain hidden for longer. The same report notes that ransomware groups now target backup infrastructure to prevent restoration.<\/p><p>A seven-day history may therefore contain only copies that are already compromised. Thirty days leave a margin to find a healthy version. Fourteen days is a minimum if backups and accounts are genuinely monitored every day.<\/p><p>Beyond three months, the volume becomes expensive and contains a lot of personal data you no longer need for operations. At that point, you keep more widely spaced restore points (one a month) rather than every night.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-de295e6 elementor-widget elementor-widget-text-editor\" data-id=\"de295e6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>A practical schedule<\/h2><table><thead><tr><th>Horizon<\/th><th>Content<\/th><th>Use<\/th><\/tr><\/thead><tbody><tr><td>24 hours<\/td><td>Several restore points if data changes constantly<\/td><td>Data entry error during the day<\/td><\/tr><tr><td>30 days<\/td><td>One restore point a day<\/td><td>Failure, deletion, recent ransomware<\/td><\/tr><tr><td>3 to 12 months<\/td><td>One restore point a week or a month<\/td><td>Late discovery, short-term dispute<\/td><\/tr><tr><td>Several years<\/td><td>Selected, immutable documents<\/td><td>Accounting, contracts, regulated records<\/td><\/tr><\/tbody><\/table><p>The ANSSI, France&#8217;s national cybersecurity agency, gives a similar example: fifteen days of daily backups, one year of monthly backups and five years of yearly backups. Above all, it requires these retention periods to be defined in a written strategy.<\/p><p>Example for a file server with 1 TB of usable data. With moderate changes, a thirty-day history often weighs two to four times the usable volume, not thirty times, because incremental backups only copy the blocks that have changed. The rule of thumb \u201ccurrent volume \u00d7 3\u201d is a reasonable starting point, to be adjusted after a week of actual measurements.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-60b4722 elementor-widget elementor-widget-text-editor\" data-id=\"60b4722\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Do not confuse it with the legal retention period<\/h2><p>Keeping ten years of daily backups does not, on its own, satisfy the obligation to keep accounting books for ten years. The auditor expects readable documents, not a 2016 system disk. Conversely, deleting a forty-day-old backup does not breach that obligation if the invoices are archived elsewhere.<\/p><table><thead><tr><th>Document<\/th><th>Indicative legal retention period in France<\/th><\/tr><\/thead><tbody><tr><td>Accounting books and supporting documents<\/td><td>10 years from the end of the financial year<\/td><\/tr><tr><td>Tax documents<\/td><td>6 years<\/td><\/tr><tr><td>Payslips (employer&#8217;s copy)<\/td><td>5 years<\/td><\/tr><tr><td>Contracts and business correspondence<\/td><td>5 years<\/td><\/tr><\/tbody><\/table><p>The GDPR pushes in the opposite direction: personal data is kept only for as long as the purpose requires. The CNIL, France&#8217;s data protection authority, points out that it cannot be kept indefinitely, and distinguishes the active database from intermediate archiving, with restricted access. A mailbox backed up for five years \u201cjust in case\u201d may be excessive if no business rule requires it. Details are in <a href=\"\/en\/guides\/backup\/backup-vs-archiving\/\">What is the difference between backup and archiving?<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3d73289 elementor-widget elementor-widget-text-editor\" data-id=\"3d73289\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What makes the chosen retention period fail<\/h2><ul><li>The disk is full: the software erases old restore points without anyone noticing, or it stops backing up.<\/li><li>The encryption key has been changed and older copies have become unreadable.<\/li><li>The format or the software no longer exists when you want to read an eight-year-old archive.<\/li><li>No one has written down the retention period. Everyone assumes it is \u201ckept for a long time\u201d.<\/li><li>The retention period is short but no restore has been tested: see <a href=\"\/en\/guides\/backup\/how-to-test-a-backup\/\">How do you test that a backup works?<\/a>.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-048cd64 elementor-widget elementor-widget-text-editor\" data-id=\"048cd64\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-brand\"><h2>At WeDoBack<\/h2><p>The retention period of the <a href=\"\/en\/smart-offer\/\">SMART<\/a> and <a href=\"\/en\/integral-offer\/\">INTEGRAL<\/a> offers is set according to the subscribed storage. The customer can increase or reduce it. To size this storage, the published rule of thumb is current volume multiplied by three, adjusted after a week of use. For retention without modification, the <a href=\"\/en\/immutable-offer\/\">IMMUTABLE<\/a> offer sets a period during which no one can modify or delete the data, up to ten years, at \u20ac20 excl. VAT per 100 GB block per month, plus one agent.<\/p><div class=\"wdb-g-btns\"><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/offers-and-prices\/\">See offers and prices<\/a><a class=\"wdb-g-btn wdb-g-btn-ghost\" href=\"\/en\/immutable-offer\/\">Discover the IMMUTABLE offer<\/a><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0ec5a0 elementor-widget elementor-widget-text-editor\" data-id=\"f0ec5a0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-faq\"><h2>Frequently asked questions<\/h2><details><summary>Is seven days of history enough?<\/summary><p>Rarely. In 2025, Mandiant measured a median of 14 days between an intrusion and its detection: in half of all cases, the attacker was present for longer. With seven days of history, every copy may postdate the intrusion.<\/p><\/details><details><summary>Should backups be kept for ten years for accounting purposes?<\/summary><p>No. The ten-year obligation applies to accounting books and records. Archive these documents separately, in a readable, unmodifiable format, and keep a short history for everything else. It is cheaper and easier to present during an audit.<\/p><\/details><details><summary>What happens when backup storage is full?<\/summary><p>Depending on the software, either the oldest restore points are erased or new backups fail. In both cases, the actual retention period becomes shorter than the documented one. An alert on storage usage and a monthly check prevent unpleasant surprises.<\/p><\/details><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2a1e4a4 elementor-widget elementor-widget-text-editor\" data-id=\"2a1e4a4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Further reading<\/h2><div class=\"wdb-g-related\"><a href=\"\/en\/guides\/backup\/how-many-backups-to-keep\/\"><small>IT backup<\/small>How many backups should you keep?<\/a><a href=\"\/en\/guides\/backup\/immutable-backup-retention-period\/\"><small>IT backup<\/small>Immutable backup: how long should data be kept?<\/a><a href=\"\/en\/guides\/backup\/backup-vs-archiving\/\"><small>IT backup<\/small>What is the difference between backup and archiving?<\/a><a href=\"\/en\/guides\/backup\/protect-backups-from-ransomware\/\"><small>IT backup<\/small>How do you protect your backups against ransomware?<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-865705a elementor-widget elementor-widget-text-editor\" data-id=\"865705a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-sources\"><h2>Sources<\/h2><p class=\"wdb-g-src-date\">Documents consulted in October 2026.<\/p><ol><li><a href=\"https:\/\/messervices.cyber.gouv.fr\/documents-guides\/anssi_fondamentaux_sauvegarde_systemes_dinformation_v1.1.pdf\" target=\"_blank\" rel=\"noopener\">Backing up information systems \u2013 The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025)<\/a> \u2014 ANSSI<\/li><li><a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/m-trends-2026\/\" target=\"_blank\" rel=\"noopener\">M-Trends 2026: Data, Insights, and Strategies From the Frontlines<\/a> \u2014 Mandiant (Google Cloud)<\/li><li><a href=\"https:\/\/entreprendre.service-public.gouv.fr\/vosdroits\/F10029\" target=\"_blank\" rel=\"noopener\">How long must businesses keep their documents?<\/a> \u2014 Entreprendre.Service-Public.gouv.fr (French government portal for businesses)<\/li><li><a href=\"https:\/\/cnil.fr\/fr\/passer-laction\/les-durees-de-conservation-des-donnees\" target=\"_blank\" rel=\"noopener\">Data retention periods<\/a> \u2014 CNIL<\/li><li><a href=\"https:\/\/www.wedoback.com\/offre-immuable\/\" target=\"_blank\" rel=\"noopener\">IMMUTABLE offer: WORM storage and prices<\/a> \u2014 WeDoBack<\/li><\/ol><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9af119a e-con-full wdb-g-aside e-flex e-con e-parent\" data-id=\"9af119a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5c5fd0b elementor-widget elementor-widget-text-editor\" data-id=\"5c5fd0b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<nav class=\"wdb-g-toc\" aria-label=\"Table of contents\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a223655 elementor-widget elementor-widget-text-editor\" data-id=\"a223655\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-card\"><h3>Planning a backup, DRP or BCP project?<\/h3><p>More than 20 years of experience protecting business data.<\/p><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/quotation\/\">Request a quote<\/a><a class=\"wdb-g-tel\" href=\"tel:+33972507828\">+33 9 72 50 78 28<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-3c51f90 e-con-full wdb-g-cta e-flex e-con e-parent\" data-id=\"3c51f90\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-eddf0b2 e-con-full wdb-g-cta-in e-flex e-con e-parent\" data-id=\"eddf0b2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d15dd75 elementor-widget elementor-widget-text-editor\" data-id=\"d15dd75\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Protect your data with WeDoBack<\/h2><p>Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.<\/p><div class=\"wdb-g-btns\"><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/quotation\/\">Request a quote<\/a><a class=\"wdb-g-btn wdb-g-btn-ghost\" href=\"\/en\/offers-and-prices\/\">See offers and prices<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":31776,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"How long should you keep backups? | WeDoBack","_seopress_titles_desc":"Keep a few weeks of backups to get back to work, and separate, longer-term archiving only for documents that must serve as evidence.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/2026\/10\/wdb-og-sauvegarde.jpg","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/2026\/10\/wdb-og-sauvegarde.jpg","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-31838","page","type-page","status-publish","hentry"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/comments?post=31838"}],"version-history":[{"count":1,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31838\/revisions"}],"predecessor-version":[{"id":32213,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31838\/revisions\/32213"}],"up":[{"embeddable":true,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31776"}],"wp:attachment":[{"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/media?parent=31838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}