{"id":31747,"date":"2026-10-07T11:53:30","date_gmt":"2026-10-07T09:53:30","guid":{"rendered":"https:\/\/mu.wedoback.com\/?page_id=31747"},"modified":"2026-10-07T12:22:38","modified_gmt":"2026-10-07T10:22:38","slug":"immutable-backup-retention-period","status":"publish","type":"page","link":"https:\/\/mu.wedoback.com\/en\/guides\/backup\/immutable-backup-retention-period\/","title":{"rendered":"Immutable backup: how long should data be kept?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"31747\" class=\"elementor elementor-31747 elementor-31556\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-99989ea e-con-full wdb-g e-flex e-con e-parent\" data-id=\"99989ea\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-bbad2d7 e-con-full wdb-g-hero e-flex e-con e-parent\" data-id=\"bbad2d7\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-b1117c8 e-con-full wdb-g-hero-in e-flex e-con e-parent\" data-id=\"b1117c8\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0d3ce85 elementor-widget elementor-widget-text-editor\" data-id=\"0d3ce85\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/backup\/\">IT backup<\/a><\/p><p class=\"wdb-g-pill\" style=\"--pill:#01adb9\">IT backup<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7a4127 elementor-widget elementor-widget-heading\" data-id=\"d7a4127\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">Immutable backup: how long should data be kept?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-783ef38 elementor-widget elementor-widget-text-editor\" data-id=\"783ef38\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-lead\">The duration of an immutable backup is that of the risk to be covered, not the maximum period sold by the provider. Against ransomware or an error, 30 to 90 days is generally enough; for a legal obligation, it is the period set by the law, applied only to the documents concerned.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8d7ae82 elementor-widget elementor-widget-text-editor\" data-id=\"8d7ae82\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"wdb-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>3 min<\/b> read<\/span><span><b>5<\/b> sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-fd010ae e-con-full wdb-g-body e-flex e-con e-parent\" data-id=\"fd010ae\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-20ecaf3 e-con-full wdb-g-grid e-flex e-con e-parent\" data-id=\"20ecaf3\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-45402d9 e-con-full wdb-g-article e-flex e-con e-parent\" data-id=\"45402d9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-926ad8d elementor-widget elementor-widget-text-editor\" data-id=\"926ad8d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-key\"><h2>Key points<\/h2><ul><li>Anti-ransomware: <strong>30 days minimum<\/strong>, 90 days if monitoring is light or activity is seasonal.<\/li><li>Legal obligation: the period is the one set by the applicable <strong>Mauritian law<\/strong> (tax, companies, employment, health), to be <strong>confirmed<\/strong> by your accountant or your <strong>adviser<\/strong>.<\/li><li>A legal period can be <strong>extended<\/strong> after a reform: allow a margin rather than a lock cut too fine.<\/li><li>Separate an <strong>operational space<\/strong> (short) from an <strong>archive space<\/strong> (long, limited to records you must be able to prove).<\/li><li>Data that is immutable for ten years must remain <strong>decryptable and readable<\/strong> for ten years, key and format included.<\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d71b166 elementor-widget elementor-widget-text-editor\" data-id=\"d71b166\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Against ransomware and errors: 30 to 90 days<\/h2><p>The lock must last longer than the detection time.<\/p><ul><li>An accidental deletion is generally noticed within a few days. Fourteen to thirty days of immutability cover this case.<\/li><li>Ransomware preceded by a silent intrusion is often noticed after one to several weeks. Thirty days is a minimum. Ninety days leaves a margin if monitoring is light or if the company closes for several weeks in the holiday season.<\/li><li>Beyond a few months, locking <strong>all<\/strong> the daily backups of <strong>all<\/strong> servers is expensive and also freezes personal data you no longer need. You then space out the restore points (one per week) or reserve long immutability for a subset.<\/li><\/ul><p>Since a compliance lock cannot be shortened, choose the period after measuring the volume. A one-month trial, monitored, is better than a ten-year commitment on an entire server. The complementary measures (separate accounts, offline copy, alerts) are described in <a href=\"\/en\/guides\/backup\/protect-backups-from-ransomware\/\">How to protect your backups from ransomware<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-56af3f4 elementor-widget elementor-widget-text-editor\" data-id=\"56af3f4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>For the obligation to keep a record: the period set by law<\/h2><table><thead><tr><th>Document<\/th><th>Retention period<\/th><th>What to lock<\/th><\/tr><\/thead><tbody><tr><td>Accounting books and records<\/td><td>Period set by Mauritian law (Income Tax Act 1995, Companies Act): to be confirmed by your accountant<\/td><td>The records, not the daily disk image<\/td><\/tr><tr><td>Tax documents<\/td><td>Period provided for by the Income Tax Act 1995 (section 153): to be confirmed by your accountant<\/td><td>The tax supporting documents<\/td><\/tr><tr><td>Copies of payslips<\/td><td>Period set by Mauritian employment law: to be checked with your adviser<\/td><td>The payslips<\/td><\/tr><tr><td>Standard commercial contract<\/td><td>Limitation period applicable to the contract: to be confirmed by your adviser<\/td><td>The signed contract<\/td><\/tr><tr><td>Patient record in a healthcare facility<\/td><td>Sector rules: to be checked with the competent health authority<\/td><td>The record<\/td><\/tr><\/tbody><\/table><p>This table deliberately gives no figures: in Mauritius, periods depend on several laws (Income Tax Act 1995, Companies Act, employment law, sector rules) and must be confirmed by your accountant or adviser. Your sector, your client&#8217;s country and the contract may also impose something different. A reform can extend a legal period: a lock set today may sometimes need to cover a longer period than originally planned, and a reasonable margin is better than a lock that is too short.<\/p><p>For personal data, the Data Protection Act 2017 (section 27) requires data to be destroyed as soon as its purpose has lapsed. In practice, there are three phases: the active database, intermediate archiving (restricted access, for litigation or a legal obligation), then deletion. Long immutability corresponds to the intermediate archiving of a subset, not to keeping everything. Ten years of immutability on an entire mailbox is often excessive under the Data Protection Act 2017, whereas a long period may be justified for an accounting journal. The data protection officer, or an adviser, decides.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba917e3 elementor-widget elementor-widget-text-editor\" data-id=\"ba917e3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>One period, two spaces<\/h2><p>Space A, operational: daily backups, immutable for 30 or 90 days, then automatic expiry. Goal: roll back.<\/p><p>Space B, archive: only the documents you must be able to prove, immutable for the legal period, in a format still readable at that date (PDF\/A, database export, not an entire operating system). Goal: produce the record.<\/p><p>Mixing A and B under the same ten-year lock multiplies the volume by the number of nights. The distinction between the two uses is explained in <a href=\"\/en\/guides\/backup\/backup-vs-archiving\/\">What is the difference between backup and archiving?<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0cc2d3 elementor-widget elementor-widget-text-editor\" data-id=\"f0cc2d3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>The key and the software<\/h2><p>Data that is immutable for ten years must remain decryptable for ten years. This requires a procedure for keeping the key, independent of people who may leave the company, and a format that can still be opened. Storage immutability does not update the software needed to read the data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3b5aa21 elementor-widget elementor-widget-text-editor\" data-id=\"3b5aa21\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-brand\"><h2>At WeDoBack<\/h2><p>The immutability period is chosen at subscription, within the ten-year limit stated for the <a href=\"\/en\/immutable-offer\/\">IMMUTABLE<\/a> offer. The public price follows the locked volume: \u20ac20 excl. VAT per 100 GB block per month, plus one agent. Example: 500 GB locked costs \u20ac100 excl. VAT per month, plus one agent (\u20ac6 excl. VAT for a virtual server). At expiry, a new subscription starts a new period. Nothing on the site allows a running lock to be shortened: this is consistent with WORM, and it must be decided before the data is placed in storage. The encryption key stays with the client, who is responsible for keeping it for the entire chosen period.<\/p><div class=\"wdb-g-btns\"><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/immutable-offer\/\">Discover the IMMUTABLE offer<\/a><a class=\"wdb-g-btn wdb-g-btn-ghost\" href=\"\/en\/quotation\/\">Request a quote<\/a><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7880553 elementor-widget elementor-widget-text-editor\" data-id=\"7880553\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-faq\"><h2>Frequently asked questions<\/h2><details><summary>Can I make my entire mailbox immutable for ten years?<\/summary><p>Technically yes, but it is rarely justified. The Data Protection Act 2017 (section 27) requires personal data to be destroyed as soon as its purpose has lapsed; in practice, a distinction is made between the active database, intermediate archiving and deletion. Lock for a long time what a law requires you to keep for a long time, not all your correspondence.<\/p><\/details><details><summary>What happens at the end of the immutability period?<\/summary><p>The lock is released. The data can then be deleted by the normal retention cycle, or locked again for a new period. Nothing is deleted automatically if no deletion rule has been set.<\/p><\/details><details><summary>Does the legal period run from the backup date?<\/summary><p>No, it generally runs from the event set by the law: the end of the financial year, the end of the contract or the last transaction, for example. A record backed up late must therefore be locked until the correct expiry date, not for the legal period counted from the backup.<\/p><\/details><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0fe953b elementor-widget elementor-widget-text-editor\" data-id=\"0fe953b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Further reading<\/h2><div class=\"wdb-g-related\"><a href=\"\/en\/guides\/backup\/what-is-an-immutable-backup\/\"><small>IT backup<\/small>What is an immutable backup?<\/a><a href=\"\/en\/guides\/backup\/what-is-worm-storage\/\"><small>IT backup<\/small>What is WORM storage?<\/a><a href=\"\/en\/guides\/backup\/how-long-to-keep-backups\/\"><small>IT backup<\/small>How long should you keep backups?<\/a><a href=\"\/en\/guides\/backup\/backup-vs-archiving\/\"><small>IT backup<\/small>What is the difference between backup and archiving?<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-230f180 elementor-widget elementor-widget-text-editor\" data-id=\"230f180\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-sources\"><h2>Sources<\/h2><p class=\"wdb-g-src-date\">Documents consulted in October 2026.<\/p><ol><li><a href=\"https:\/\/www.mra.mu\/download\/ITAConsolidated.pdf\" target=\"_blank\" rel=\"noopener\">Income Tax Act 1995 (consolidated version)<\/a> \u2014 Mauritius Revenue Authority<\/li><li><a href=\"https:\/\/dataprotection.govmu.org\/Documents\/DPA_2017.pdf\" target=\"_blank\" rel=\"noopener\">Data Protection Act 2017 (section 27)<\/a> \u2014 Data Protection Office (Mauritius)<\/li><li><a href=\"https:\/\/dataprotection.govmu.org\/Pages\/Downloads\/Publications%20and%20Guidelines\/Guidelines.pdf\" target=\"_blank\" rel=\"noopener\">Introductory Guide to the Data Protection Act 2017<\/a> \u2014 Data Protection Office (Mauritius)<\/li><li><a href=\"https:\/\/cert-mu.govmu.org\/cert-mu\/wp-content\/uploads\/2023\/10\/Guideline-on-devising-a-personal-backup-plan.pdf\" target=\"_blank\" rel=\"noopener\">Guideline on devising a personal backup plan (CMSGu2017-03)<\/a> \u2014 CERT-MU<\/li><li><a href=\"https:\/\/www.wedoback.com\/offre-immuable\/\" target=\"_blank\" rel=\"noopener\">IMMUTABLE offer: WORM storage and prices<\/a> \u2014 WeDoBack<\/li><\/ol><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-be61824 e-con-full wdb-g-aside e-flex e-con e-parent\" data-id=\"be61824\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-90e7596 elementor-widget elementor-widget-text-editor\" data-id=\"90e7596\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<nav class=\"wdb-g-toc\" aria-label=\"Table of contents\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-be2e510 elementor-widget elementor-widget-text-editor\" data-id=\"be2e510\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"wdb-g-card\"><h3>Planning a backup, DRP or BCP project?<\/h3><p>More than 20 years of experience protecting business data.<\/p><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/quotation\/\">Request a quote<\/a><a class=\"wdb-g-tel\" href=\"tel:+33972507828\">+33 9 72 50 78 28<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-3c4f79a e-con-full wdb-g-cta e-flex e-con e-parent\" data-id=\"3c4f79a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<div class=\"elementor-element elementor-element-d5d47c7 e-con-full wdb-g-cta-in e-flex e-con e-parent\" data-id=\"d5d47c7\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-963165d elementor-widget elementor-widget-text-editor\" data-id=\"963165d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Protect your data with WeDoBack<\/h2><p>Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.<\/p><div class=\"wdb-g-btns\"><a class=\"wdb-g-btn wdb-g-btn-primary\" href=\"\/en\/quotation\/\">Request a quote<\/a><a class=\"wdb-g-btn wdb-g-btn-ghost\" href=\"\/en\/offers-and-prices\/\">See offers and prices<\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":31721,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"Immutable backup: which retention period? | WeDoBack","_seopress_titles_desc":"Against ransomware, lock for 30 to 90 days. For a legal obligation, lock for the period set by law, and only the documents concerned.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/sites\/4\/2026\/10\/wdb-og-sauvegarde.jpg","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"https:\/\/www.wedoback.com\/wp-content\/uploads\/sites\/4\/2026\/10\/wdb-og-sauvegarde.jpg","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-31747","page","type-page","status-publish","hentry"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31747","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/comments?post=31747"}],"version-history":[{"count":1,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31747\/revisions"}],"predecessor-version":[{"id":31812,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31747\/revisions\/31812"}],"up":[{"embeddable":true,"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/pages\/31721"}],"wp:attachment":[{"href":"https:\/\/mu.wedoback.com\/en\/wp-json\/wp\/v2\/media?parent=31747"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}