{"id":31873,"date":"2026-10-06T22:10:30","date_gmt":"2026-10-06T20:10:30","guid":{"rendered":"https:\/\/www.wedoback.com\/?page_id=31873"},"modified":"2026-10-07T11:00:22","modified_gmt":"2026-10-07T09:00:22","slug":"immutable-backup-retention-period","status":"publish","type":"page","link":"https:\/\/www.wedoback.com\/en\/guides\/backup\/immutable-backup-retention-period\/","title":{"rendered":"Immutable backup: how long should data be retained?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"31873\" class=\"elementor elementor-31873 elementor-31563\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-27ea042 e-con-full wdb-g e-flex e-con e-parent\" data-id=\"27ea042\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-8dfb1c1 e-con-full wdb-g-hero e-flex e-con e-parent\" data-id=\"8dfb1c1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-8cb3416 e-con-full wdb-g-hero-in e-flex e-con e-parent\" data-id=\"8cb3416\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-99fdae2 elementor-widget elementor-widget-text-editor\" data-id=\"99fdae2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/backup\/\">IT backup<\/a><\/p><p class=\"wdb-g-pill\" style=\"--pill:#01adb9\">IT backup<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a245b37 elementor-widget elementor-widget-heading\" data-id=\"a245b37\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Immutable backup: how long should data be retained?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5313254 elementor-widget elementor-widget-text-editor\" data-id=\"5313254\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-lead\">The right period for an immutable backup is that of the risk to be covered, not the maximum period sold by the provider. Against ransomware or human error, 30 to 90 days is generally enough; for a legal obligation, it is the period set by law, applied only to the documents concerned.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bdf495d elementor-widget elementor-widget-text-editor\" data-id=\"bdf495d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>3 min<\/b> read<\/span><span><b>5<\/b> sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-d5717fe e-con-full wdb-g-body e-flex e-con e-parent\" data-id=\"d5717fe\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-a06a733 e-con-full wdb-g-grid e-flex e-con e-parent\" data-id=\"a06a733\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-0650d0d e-con-full wdb-g-article e-flex e-con e-parent\" data-id=\"0650d0d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0683af6 elementor-widget elementor-widget-text-editor\" data-id=\"0683af6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-key\"><h2>Key points<\/h2><ul><li>Anti-ransomware: <strong>30 days minimum<\/strong>, 90 days if monitoring is light or business is seasonal.<\/li><li>Legal obligations in France: accounting records <strong>10 years<\/strong>, payslips <strong>5 years<\/strong>, patient records <strong>20 years<\/strong> in healthcare facilities.<\/li><li>Tax documents go from <strong>6 to 10 years<\/strong> for those whose period expires after 1 January 2027.<\/li><li>Separate an <strong>operational area<\/strong> (short) from an <strong>archive area<\/strong> (long, limited to the documents you must be able to produce).<\/li><li>Data that is immutable for ten years must remain <strong>decryptable and readable<\/strong> for ten years: key and format included.<\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4e68fc4 elementor-widget elementor-widget-text-editor\" data-id=\"4e68fc4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Against ransomware and error: 30 to 90 days<\/h2><p>The lock must last longer than the detection time.<\/p><ul><li>An accidental deletion is usually noticed within a few days. Fourteen to thirty days of immutability cover this case.<\/li><li>Ransomware preceded by a silent intrusion is often noticed after one to several weeks. Thirty days is a minimum. Ninety days leaves a margin if monitoring is light or if the company closes for several weeks in summer.<\/li><li>Beyond a few months, locking <strong>all<\/strong> the daily backups of <strong>all<\/strong> servers is expensive and also freezes personal data you no longer need. You then space out the restore points (one per week) or reserve long immutability for a subset.<\/li><\/ul><p>Since a compliance lock cannot be shortened, choose the period after measuring the volume. A one-month trial, monitored closely, is better than a ten-year commitment on an entire server. The complementary measures (separate accounts, offline copy, alerts) are described in <a href=\"\/en\/guides\/backup\/protect-backups-from-ransomware\/\">How do you protect your backups against ransomware?<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5efa670 elementor-widget elementor-widget-text-editor\" data-id=\"5efa670\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>To meet an obligation to keep a document: the period set by law<\/h2><table><thead><tr><th>Document<\/th><th>Retention period<\/th><th>What to lock<\/th><\/tr><\/thead><tbody><tr><td>Accounting books and records<\/td><td>10 years from the end of the financial year (French Commercial Code, Art. L123-22)<\/td><td>The records, not the daily disk image<\/td><\/tr><tr><td>Tax documents<\/td><td>6 years, extended to 10 years for documents whose period expires after 1 January 2027<\/td><td>The tax supporting documents<\/td><\/tr><tr><td>Copies of payslips<\/td><td>5 years (French Labour Code)<\/td><td>The payslips<\/td><\/tr><tr><td>Standard commercial contract<\/td><td>5 years; 10 years from delivery for a contract of at least \u20ac120 concluded electronically<\/td><td>The signed contract<\/td><\/tr><tr><td>Patient record in a healthcare facility<\/td><td>20 years from the last stay or last outpatient consultation (French Public Health Code, Art. R1112-7)<\/td><td>The record<\/td><\/tr><\/tbody><\/table><p>These are the periods published by the French authorities for French companies, as consulted in October 2026. The sector, the client&#8217;s country and the contract may require something else. The change in the retention period for tax documents, introduced by a law passed in June 2026, shows that a lock applied today sometimes needs to cover a longer period than originally planned: a reasonable margin is better than a lock that is too short.<\/p><p>For personal data, the GDPR requires a period proportionate to the purpose. The CNIL, France&#8217;s data protection authority, describes three phases: the active database, intermediate archiving (restricted access, for litigation or a legal obligation), then deletion or permanent archiving. Long-term immutability corresponds to intermediate archiving of a subset, not to keeping everything. Ten years of immutability on a complete mailbox is often excessive under the GDPR, whereas it is appropriate for an accounting ledger. The data protection officer, or a legal adviser, makes the call.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-daabe35 elementor-widget elementor-widget-text-editor\" data-id=\"daabe35\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>One period, two areas<\/h2><p>Area A, operational: daily backups, immutable for 30 or 90 days, then automatic expiry. Objective: roll back.<\/p><p>Area B, archive: only the documents you must be able to produce, immutable for the legal period, in a format that will still be readable when it expires (PDF\/A, database export, not an entire operating system). Objective: produce the document.<\/p><p>Mixing A and B under the same ten-year lock multiplies the volume by the number of nights. The distinction between the two uses is explained in <a href=\"\/en\/guides\/backup\/backup-vs-archiving\/\">What is the difference between backup and archiving?<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e16388c elementor-widget elementor-widget-text-editor\" data-id=\"e16388c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>The key and the software<\/h2><p>Data that is immutable for ten years must remain decryptable for ten years. This requires a key retention procedure that does not depend on people who may leave the company, and a format you will still be able to open. Immutable storage does not update the software needed to read the data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7be0009 elementor-widget elementor-widget-text-editor\" data-id=\"7be0009\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-brand\"><h2>At WeDoBack<\/h2><p>The immutability period is chosen when you subscribe, up to the ten-year limit stated for the <a href=\"\/en\/immutable-offer\/\">IMMUTABLE<\/a> offer. The public price follows the locked volume: \u20ac20 excl. VAT per 100 GB block per month, plus one agent. Example: 500 GB locked costs \u20ac100 excl. VAT per month, plus one agent (\u20ac6 excl. VAT for a virtual server). When the period ends, a new subscription starts a new period. Nothing on the site allows a running lock to be shortened: this is consistent with WORM, and it must be decided before the data is written. The encryption key stays with the client, who is responsible for keeping it for the entire chosen period.<\/p><div class=\"wdb-g-btns\"><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/immutable-offer\/\">Discover the IMMUTABLE offer<\/a><a class=\"wdb-g-btn wdb-g-btn-ghost\" href=\"\/en\/quotation\/\">Request a quote<\/a><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-86b60e6 elementor-widget elementor-widget-text-editor\" data-id=\"86b60e6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-faq\"><h2>Frequently asked questions<\/h2><details><summary>Can I make my entire email system immutable for ten years?<\/summary><p>Technically yes, but it is rarely justified. The GDPR requires a retention period proportionate to the purpose, and the CNIL, France&#8217;s data protection authority, distinguishes between the active database, intermediate archiving and deletion. Lock for ten years what a law requires you to keep for ten years, not all of your correspondence.<\/p><\/details><details><summary>What happens at the end of the immutability period?<\/summary><p>The lock is lifted. The data can then be deleted by the normal retention cycle, or locked again for a new period. Nothing is erased automatically if no deletion rule has been set.<\/p><\/details><details><summary>Does the legal period start from the backup date?<\/summary><p>No, it starts from the event set by the law: the end of the financial year for accounting, the patient&#8217;s last stay for medical records, the last transaction for tax documents. A document backed up late must therefore be locked until the correct expiry date, not for ten years after the backup.<\/p><\/details><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d62a8db elementor-widget elementor-widget-text-editor\" data-id=\"d62a8db\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Further reading<\/h2><div class=\"wdb-g-related\"><a href=\"\/en\/guides\/backup\/what-is-an-immutable-backup\/\"><small>IT backup<\/small>What is an immutable backup?<\/a><a href=\"\/en\/guides\/backup\/what-is-worm-storage\/\"><small>IT backup<\/small>What is WORM storage?<\/a><a href=\"\/en\/guides\/backup\/how-long-to-keep-backups\/\"><small>IT backup<\/small>How long should you keep your backups?<\/a><a href=\"\/en\/guides\/backup\/backup-vs-archiving\/\"><small>IT backup<\/small>What is the difference between backup and archiving?<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-54519a9 elementor-widget elementor-widget-text-editor\" data-id=\"54519a9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-sources\"><h2>Sources<\/h2><p class=\"wdb-g-src-date\">Documents consulted in October 2026.<\/p><ol><li><a href=\"https:\/\/entreprendre.service-public.gouv.fr\/vosdroits\/F10029\" target=\"_blank\" rel=\"noopener\">What are the document retention periods for businesses?<\/a> \u2014 Entreprendre.Service-Public.gouv.fr (French government business portal)<\/li><li><a href=\"https:\/\/entreprendre.service-public.gouv.fr\/actualites\/A18906\" target=\"_blank\" rel=\"noopener\">Change to the retention period for tax documents<\/a> \u2014 Entreprendre.Service-Public.gouv.fr<\/li><li><a href=\"https:\/\/www.service-public.gouv.fr\/particuliers\/vosdroits\/F12210\" target=\"_blank\" rel=\"noopener\">Medical records<\/a> \u2014 Service-Public.gouv.fr (French government public services portal)<\/li><li><a href=\"https:\/\/www.cnil.fr\/sites\/default\/files\/atoms\/files\/guide_durees_de_conservation.pdf\" target=\"_blank\" rel=\"noopener\">Practical guide: Retention periods (July 2020)<\/a> \u2014 CNIL<\/li><li><a href=\"https:\/\/www.wedoback.com\/offre-immuable\/\" target=\"_blank\" rel=\"noopener\">IMMUTABLE offer: WORM storage and prices<\/a> \u2014 WeDoBack<\/li><\/ol><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-83b45b0 e-con-full wdb-g-aside e-flex e-con e-parent\" data-id=\"83b45b0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c5f9c3d elementor-widget elementor-widget-text-editor\" data-id=\"c5f9c3d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<nav class=\"wdb-g-toc\" aria-label=\"Table of contents\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8d92d4a elementor-widget elementor-widget-text-editor\" data-id=\"8d92d4a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-card\"><h3>Planning a backup, DRP or BCP project?<\/h3><p>More than 20 years of experience protecting business data.<\/p><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/quotation\/\">Request a quote<\/a><a class=\"wdb-g-tel\" href=\"tel:+33972507828\">+33 9 72 50 78 28<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0c3d2b9 e-con-full wdb-g-cta e-flex e-con e-parent\" data-id=\"0c3d2b9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-5ab0ddf e-con-full wdb-g-cta-in e-flex e-con e-parent\" data-id=\"5ab0ddf\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8b5f89d elementor-widget elementor-widget-text-editor\" data-id=\"8b5f89d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Protect your data with WeDoBack<\/h2><p>Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.<\/p><div class=\"wdb-g-btns\"><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/quotation\/\">Request a quote<\/a><a class=\"wdb-g-btn wdb-g-btn-ghost\" href=\"\/en\/offers-and-prices\/\">See offers and prices<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":31776,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"Immutable backup: which retention period? | WeDoBack","_seopress_titles_desc":"Against ransomware, lock for 30 to 90 days. For a legal obligation, lock for the period set by law, and only the documents concerned.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/2026\/10\/wdb-og-sauvegarde.jpg","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/2026\/10\/wdb-og-sauvegarde.jpg","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-31873","page","type-page","status-publish","hentry"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/comments?post=31873"}],"version-history":[{"count":1,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31873\/revisions"}],"predecessor-version":[{"id":32206,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31873\/revisions\/32206"}],"up":[{"embeddable":true,"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31776"}],"wp:attachment":[{"href":"https:\/\/www.wedoback.com\/en\/wp-json\/wp\/v2\/media?parent=31873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}