{"id":31735,"date":"2026-10-07T11:53:32","date_gmt":"2026-10-07T09:53:32","guid":{"rendered":"https:\/\/mu.wedoback.com\/?page_id=31735"},"modified":"2026-10-07T12:22:48","modified_gmt":"2026-10-07T10:22:48","slug":"how-long-to-keep-backups","status":"publish","type":"page","link":"https:\/\/mu.wedoback.com\/en\/guides\/backup\/how-long-to-keep-backups\/","title":{"rendered":"How long should you keep your backups?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"31735\" class=\"elementor elementor-31735 elementor-31548\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8172c74 e-con-full wdb-g e-flex e-con e-parent\" data-id=\"8172c74\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-777d99b e-con-full wdb-g-hero e-flex e-con e-parent\" data-id=\"777d99b\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-88aac07 e-con-full wdb-g-hero-in e-flex e-con e-parent\" data-id=\"88aac07\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7bf17e6 elementor-widget elementor-widget-text-editor\" data-id=\"7bf17e6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/backup\/\">IT backup<\/a><\/p><p class=\"wdb-g-pill\" style=\"--pill:#01adb9\">IT backup<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4fcbb6d elementor-widget elementor-widget-heading\" data-id=\"4fcbb6d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">How long should you keep your backups?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9b98739 elementor-widget elementor-widget-text-editor\" data-id=\"9b98739\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-lead\">To resume operations after a failure, an error or ransomware, thirty days of daily restore points are enough for most SMEs. Retention obligations spanning several years concern specific documents: they are handled through archiving, not by extending each night\u2019s backup indefinitely.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-926189b elementor-widget elementor-widget-text-editor\" data-id=\"926189b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>3 min<\/b> read<\/span><span><b>5<\/b> sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fe9c581 e-con-full wdb-g-body e-flex e-con e-parent\" data-id=\"fe9c581\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-8862ab9 e-con-full wdb-g-grid e-flex e-con e-parent\" data-id=\"8862ab9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-d171b58 e-con-full wdb-g-article e-flex e-con e-parent\" data-id=\"d171b58\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-18199e4 elementor-widget elementor-widget-text-editor\" data-id=\"18199e4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-key\"><h2>Key points<\/h2><ul><li><strong>30 days<\/strong> of daily restore points: a useful minimum, because an intrusion often remains hidden for two weeks or more.<\/li><li>Beyond three months, keep <strong>spaced-out<\/strong> restore points (weekly, monthly), not every night.<\/li><li>Legal retention periods (accounting, tax) apply to <strong>documents<\/strong>, not to server images.<\/li><li>The Data Protection Act 2017 limits the retention of personal data: \u201cjust in case\u201d is not a retention period.<\/li><li>Write down the period you choose and monitor how full the storage is.<\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-31ae790 elementor-widget elementor-widget-text-editor\" data-id=\"31ae790\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Why thirty days is a useful minimum<\/h2><p>Ransomware is not always spotted on the day it strikes. In its M-Trends 2026 report, Mandiant measured a median of 14 days between compromise and detection in 2025, compared with 11 days the year before. A median means that half of all intrusions remain hidden for longer. The same report notes that ransomware groups now target backup infrastructure to prevent restoration.<\/p><p>A seven-day history may therefore contain only copies that are already affected. Thirty days leave a margin to find a healthy version. Fourteen days is a minimum if backups and accounts are genuinely monitored every day.<\/p><p>Beyond three months, the volume becomes expensive and contains a lot of personal data you no longer need for operations. You then keep more widely spaced restore points (one a month) rather than every night.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-55dd0bf elementor-widget elementor-widget-text-editor\" data-id=\"55dd0bf\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>A practical schedule<\/h2><table><thead><tr><th>Horizon<\/th><th>Content<\/th><th>Use<\/th><\/tr><\/thead><tbody><tr><td>24 hours<\/td><td>Several restore points if data changes constantly<\/td><td>Data entry error during the day<\/td><\/tr><tr><td>30 days<\/td><td>One restore point per day<\/td><td>Failure, deletion, recent ransomware<\/td><\/tr><tr><td>3 to 12 months<\/td><td>One restore point per week or per month<\/td><td>Late discovery, short dispute<\/td><\/tr><tr><td>Several years<\/td><td>Selected, immutable documents<\/td><td>Accounting, contracts, regulated records<\/td><\/tr><\/tbody><\/table><p>The ANSSI, France\u2019s national cybersecurity agency, gives a similar example breakdown: fifteen days of daily backups, one year of monthly backups and five years of annual backups. Above all, it asks for these retention periods to be defined in a written strategy.<\/p><p>Example for a file server with 1 TB of usable data. With moderate changes, a thirty-day history often weighs between two and four times the usable volume, not thirty times, because incremental backups copy only the changed blocks. The rule of thumb \u201ccurrent volume \u00d7 3\u201d is a reasonable starting point, to be adjusted after a week of real measurements.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c174504 elementor-widget elementor-widget-text-editor\" data-id=\"c174504\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Do not confuse this with the legal retention period<\/h2><p>Keeping years of daily backups does not, on its own, satisfy the obligation to retain accounting books. An inspector expects the documents, readable, not a 2016 system disk. Conversely, deleting a forty-day-old backup does not breach this obligation if the invoices are archived elsewhere.<\/p><table><thead><tr><th>Document<\/th><th>Legal period in Mauritius<\/th><\/tr><\/thead><tbody><tr><td>Accounting books and supporting documents<\/td><td>Under the Companies Act: to be confirmed with your accountant<\/td><\/tr><tr><td>Tax documents<\/td><td>Under the Income Tax Act 1995 (section 153): to be confirmed with your accountant<\/td><\/tr><tr><td>Payslips (employer\u2019s copy)<\/td><td>Under Mauritian labour law: to be checked<\/td><\/tr><tr><td>Contracts and business correspondence<\/td><td>According to limitation periods: to be checked with your adviser<\/td><\/tr><\/tbody><\/table><p>The Data Protection Act 2017 pushes in the other direction: section 27 requires personal data to be destroyed as soon as the purpose has been fulfilled. It therefore cannot be kept indefinitely, and a distinction is made between the active database and intermediate archiving, with restricted access. A mailbox backed up for five years \u201cjust in case\u201d may be excessive if no business rule requires it. Details are in <a href=\"\/en\/guides\/backup\/backup-vs-archiving\/\">What is the difference between backup and archiving?<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-506d6c9 elementor-widget elementor-widget-text-editor\" data-id=\"506d6c9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What makes the chosen period fail<\/h2><ul><li>The disk is full: the software deletes old restore points without anyone noticing, or stops backing up.<\/li><li>The encryption key has been changed and the old copies have become unreadable.<\/li><li>The format or software no longer exists when you want to read an eight-year-old archive.<\/li><li>No one has written down the period. Everyone assumes \u201cit is kept for a long time\u201d.<\/li><li>The period is short but no restore has been tested: see <a href=\"\/en\/guides\/backup\/how-to-test-a-backup\/\">How do you test that a backup works?<\/a>.<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ebc0130 elementor-widget elementor-widget-text-editor\" data-id=\"ebc0130\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-brand\"><h2>At WeDoBack<\/h2><p>The retention period of the <a href=\"\/en\/smart-offer\/\">SMART<\/a> and <a href=\"\/en\/integral-offer\/\">INTEGRAL<\/a> offers is set according to the subscribed storage. The client increases or reduces it. To size this storage, the published rule of thumb is the current volume multiplied by three, adjusted after a week of use. For retention without modification, the <a href=\"\/en\/immutable-offer\/\">IMMUTABLE<\/a> offer sets a period during which no one can modify or delete the data, up to ten years, at \u20ac20 excl. VAT per 100 GB block per month, plus one agent.<\/p><div class=\"wdb-g-btns\"><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/offers-and-prices\/\">See offers and prices<\/a><a class=\"wdb-g-btn wdb-g-btn-ghost\" href=\"\/en\/immutable-offer\/\">Discover the IMMUTABLE offer<\/a><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dc7d775 elementor-widget elementor-widget-text-editor\" data-id=\"dc7d775\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-faq\"><h2>Frequently asked questions<\/h2><details><summary>Is seven days of history enough?<\/summary><p>Rarely. In 2025, Mandiant measured a median of 14 days between intrusion and detection: in half of all cases, the attacker was present for longer. With seven days of history, every copy may postdate the intrusion.<\/p><\/details><details><summary>Should backups be kept for years for accounting purposes?<\/summary><p>No. The legal retention obligation, whose duration should be confirmed with your accountant, covers accounting books and records. Archive these documents separately, in a readable and unmodifiable format, and keep a short history for everything else. It is cheaper and easier to present during an inspection.<\/p><\/details><details><summary>What happens when backup storage is full?<\/summary><p>Depending on the software, either the oldest restore points are deleted or new backups fail. In both cases, the actual retention period becomes shorter than the written one. An alert on the fill rate and a monthly check avoid unpleasant surprises.<\/p><\/details><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c96a608 elementor-widget elementor-widget-text-editor\" data-id=\"c96a608\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Further reading<\/h2><div class=\"wdb-g-related\"><a href=\"\/en\/guides\/backup\/how-many-backups-to-keep\/\"><small>IT backup<\/small>How many backups should you keep?<\/a><a href=\"\/en\/guides\/backup\/immutable-backup-retention-period\/\"><small>IT backup<\/small>Immutable backup: how long should data be kept?<\/a><a href=\"\/en\/guides\/backup\/backup-vs-archiving\/\"><small>IT backup<\/small>What is the difference between backup and archiving?<\/a><a href=\"\/en\/guides\/backup\/protect-backups-from-ransomware\/\"><small>IT backup<\/small>How do you protect your backups against ransomware?<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-12969ab elementor-widget elementor-widget-text-editor\" data-id=\"12969ab\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-sources\"><h2>Sources<\/h2><p class=\"wdb-g-src-date\">Documents consulted in October 2026.<\/p><ol><li><a href=\"https:\/\/messervices.cyber.gouv.fr\/documents-guides\/anssi_fondamentaux_sauvegarde_systemes_dinformation_v1.1.pdf\" target=\"_blank\" rel=\"noopener\">Backing up information systems \u2013 The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025)<\/a> \u2014 ANSSI (France\u2019s national cybersecurity agency)<\/li><li><a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/m-trends-2026\/\" target=\"_blank\" rel=\"noopener\">M-Trends 2026: Data, Insights, and Strategies From the Frontlines<\/a> \u2014 Mandiant (Google Cloud)<\/li><li><a href=\"https:\/\/www.mra.mu\/download\/ITAConsolidated.pdf\" target=\"_blank\" rel=\"noopener\">Income Tax Act 1995 (consolidated version)<\/a> \u2014 Mauritius Revenue Authority<\/li><li><a href=\"https:\/\/dataprotection.govmu.org\/Documents\/DPA_2017.pdf\" target=\"_blank\" rel=\"noopener\">Data Protection Act 2017<\/a> \u2014 Data Protection Office (Mauritius)<\/li><li><a href=\"https:\/\/www.wedoback.com\/offre-immuable\/\" target=\"_blank\" rel=\"noopener\">IMMUTABLE offer: WORM storage and prices<\/a> \u2014 WeDoBack<\/li><\/ol><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ecaf21e e-con-full wdb-g-aside e-flex e-con e-parent\" data-id=\"ecaf21e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c00538b elementor-widget elementor-widget-text-editor\" data-id=\"c00538b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<nav class=\"wdb-g-toc\" aria-label=\"Table of contents\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2ca6101 elementor-widget elementor-widget-text-editor\" data-id=\"2ca6101\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-card\"><h3>Planning a backup, DRP or BCP project?<\/h3><p>More than 20 years of experience protecting business data.<\/p><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/quotation\/\">Request a quote<\/a><a class=\"wdb-g-tel\" href=\"tel:+33972507828\">+33 9 72 50 78 28<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-33866fb e-con-full wdb-g-cta e-flex e-con e-parent\" data-id=\"33866fb\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-007cabd e-con-full wdb-g-cta-in e-flex e-con e-parent\" data-id=\"007cabd\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e4b9914 elementor-widget elementor-widget-text-editor\" data-id=\"e4b9914\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Protect your data with WeDoBack<\/h2><p>Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.<\/p><div class=\"wdb-g-btns\"><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/quotation\/\">Request a quote<\/a><a class=\"wdb-g-btn wdb-g-btn-ghost\" href=\"\/en\/offers-and-prices\/\">See offers and prices<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":31721,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"How long should you keep your backups? | WeDoBack","_seopress_titles_desc":"Keep a few weeks of backups to resume work, and a separate, longer archive only for documents that must serve as evidence.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/sites\/4\/2026\/10\/wdb-og-sauvegarde.jpg","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/sites\/4\/2026\/10\/wdb-og-sauvegarde.jpg","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-31735","page","type-page","status-publish","hentry"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/comments?post=31735"}],"version-history":[{"count":1,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31735\/revisions"}],"predecessor-version":[{"id":31824,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31735\/revisions\/31824"}],"up":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31721"}],"wp:attachment":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/media?parent=31735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}