A deleted folder discovered on Monday morning creates one question very quickly: how long do backups last? The answer determines whether your business can restore the missing files in minutes, or whether they have already disappeared from every recovery point. Retention is not a technical detail to leave buried in a software setting. It is a business continuity decision.
For most organisations, backups should last long enough to recover from accidental deletion, hardware failure, ransomware, system errors and longer-running issues that may not be noticed immediately. The right period depends on the data, the risks involved and any legal or contractual obligations. Keeping everything forever is rarely practical, but keeping too little can turn a manageable incident into a costly disruption.
How long do backups last in practice?
There is no single retention period that suits every business. A typical business backup policy may keep daily backups for 30 days, monthly backups for 12 months and annual archive copies for several years. That structure gives teams frequent restore points for recent incidents without requiring every daily copy to be retained indefinitely.
However, a 30-day retention period may be insufficient for finance records, regulated information, long-term contracts or data that supports tax, audit and legal requirements. Equally, retaining every version of routine operational data for seven years can add unnecessary storage cost and make policies difficult to manage.
The practical question is not simply how long a backup can be stored. It is: how far back might the business realistically need to recover, and how quickly must that recovery happen?
A file deleted yesterday needs a different response from a payroll record required for an audit three years later. Both may need retention, but they do not necessarily need the same type of backup, storage location or recovery speed.
Backup retention is different from archive retention
Backup and archive are often used interchangeably, but they serve different purposes.
A backup is primarily there to restore systems and information after a disruption. It should support recovery from a failed server, a compromised Microsoft 365 account, a faulty update or an accidental deletion. Backups are usually taken regularly and are designed to be restored when the business needs to resume normal operations.
An archive is normally retained for longer-term reference, compliance or record-keeping. It may contain historic documents that are no longer used day to day but must remain available. Archived data may take longer to retrieve, which is acceptable where immediate operational recovery is not required.
Treating a backup platform as a permanent archive can become expensive and difficult to control. Treating an archive as a backup can be equally risky, particularly if it does not preserve complete systems, versions or application data. A clear policy separates short-term recovery, longer-term retention and secure disposal.
What should determine your backup retention period?
Retention should be based on the value and sensitivity of information, not on an arbitrary number selected during setup. Start with the systems that would cause the greatest disruption if unavailable: finance platforms, customer records, shared files, email, line-of-business applications and critical server workloads.
Consider how quickly a problem may be identified. Ransomware, for example, may remain unnoticed for days or weeks before encryption begins. If all backups are retained for only a short period, clean recovery points could be overwritten before the issue is detected. Longer retention and immutable copies provide a much safer position.
You should also account for contractual, regulatory and financial requirements. Irish businesses may need to retain specific records for tax, employment, financial or sector-related reasons. These obligations vary, so retention periods should be agreed with the relevant finance, legal or compliance advisers rather than assumed from an IT standard.
Recovery objectives matter too. A business may be comfortable retrieving an old document within a day, but unable to tolerate its core systems being unavailable for more than a few hours. This distinction affects where copies are held and the technology used to restore them.
A sensible retention model for many businesses
For a typical small or medium-sized organisation, a tiered approach is often easier to manage than one blanket rule. Daily backups can protect recent work and support fast recovery from common issues. Weekly and monthly copies extend the recovery window, while annual archive copies preserve information that must be retained over the long term.
A policy might retain daily backups for 30 to 90 days, monthly backups for one to seven years, and selected records for longer where legal or commercial requirements apply. These are planning examples, not universal rules. A construction firm, professional services company, healthcare provider and multi-site retailer will have different priorities and obligations.
The same principle applies to Microsoft 365. Many organisations assume that email, Teams files, SharePoint sites and OneDrive data are permanently protected because they are in the cloud. Microsoft provides resilience within its platform, but your organisation remains responsible for managing retention, accidental deletion, account compromise and recovery requirements. A dedicated Microsoft 365 backup gives the business more control over how long recoverable copies are held and how they are restored.
Retention alone does not make a backup reliable
A backup that exists but cannot be restored is not a recovery plan. Businesses should regularly test whether individual files, mailboxes, applications, virtual machines and complete servers can be recovered within the required timeframe.
Testing also exposes overlooked gaps. For example, a server backup may protect the operating system but not a cloud-based application. A Microsoft 365 backup may cover mailboxes but exclude a critical third-party platform. A local copy may restore quickly but be vulnerable to fire, theft or ransomware if it remains connected to the same network.
A stronger approach follows the 3-2-1 principle: maintain at least three copies of important data, on two different types of storage, with one copy kept off-site. Many organisations now add an immutable or isolated copy, meaning it cannot be altered or deleted for a defined period. This is particularly valuable when responding to ransomware or compromised administrator accounts.
Retention policies should cover the full environment, including servers, laptops where appropriate, cloud applications, network configuration and critical business data. It is easy to focus on documents while overlooking the settings and systems needed to make those documents useful again.
The trade-off between retention, cost and risk
Longer retention usually means greater storage use and potentially higher costs. It can also introduce governance issues if personal data is kept beyond its necessary purpose. The goal is not to retain every copy indefinitely. It is to retain the right copies for a justified period, protect them properly and dispose of them securely when that period ends.
Storage costs should be weighed against the cost of downtime. Losing access to a month-old project file may delay a team. Losing a year of financial records, client correspondence or operational data can affect revenue, reputation and regulatory compliance. The most economical policy is not always the one with the lowest monthly storage bill.
There is also a difference between the retention period promised by a backup service and the retention actually configured for each workload. Ask for clarity on daily, weekly, monthly and annual restore points; off-site storage; immutability; encryption; and the process for requesting a restore. These details should be documented, reviewed and aligned with the organisation’s changing needs.
Review backup retention as the business changes
A retention policy should not be set once and forgotten. New software, hybrid working, office moves, acquisitions, new customer contracts and changes in regulation can all alter what needs protection. A business that relied on a single file server five years ago may now hold critical information across Microsoft 365, cloud applications, employee devices and hosted systems.
Review the policy at least annually and after any major technology or business change. Confirm which data is covered, where copies are stored, who can authorise restoration, how long recovery takes and whether retention periods remain appropriate. Keep the policy understandable enough that management can make informed decisions rather than relying on assumptions.
The best backup retention period is the one that gives your business a realistic route back after an incident, without creating unnecessary cost or uncontrolled data storage. If you are unsure whether your current backups will still be there when you need them, testing and reviewing the policy now is far easier than finding out during a recovery.