Backup Retention

Backup retention refers to how long backup copies are kept before they are deleted, overwritten, or moved to long-term storage. A backup retention policy defines which backups should be retained and for how long, helping organizations maintain useful recovery points without storing every backup indefinitely.

For example, a business might keep daily backups for 14 days, weekly backups for three months, and monthly backups for one year. The appropriate schedule depends on how important the data is, how quickly problems are detected, available storage, recovery needs, and any applicable legal or compliance requirements.

How Does Backup Retention Work?

Every time a backup is created, it takes up storage space. Without a retention policy, backups can continue accumulating and eventually consume unnecessary storage.

Backup retention rules determine when older copies can be removed. A typical schedule might look like this:

These periods are examples, not universal recommendations. A small development environment and a business-critical database can have very different recovery requirements.

Automated backup systems can apply retention rules so that expired backups are removed or archived without requiring administrators to manage every copy manually.

What Is a Backup Retention Policy?

A backup retention policy is a set of rules defining how long an organization keeps its backups. It may also specify which systems are backed up, how often backups are created, where copies are stored, and what happens when the retention period expires.

A useful policy should answer questions such as:

• How far back might we need to recover data?
• How many restore points do we need?
• Which systems contain critical data?
• How much backup storage is available?
• Are there regulatory or contractual retention requirements?

A policy should be based on actual recovery needs rather than simply choosing a common number such as 30 or 90 days.

Common Backup Retention Methods

Different retention methods can be used depending on the workload and recovery requirements.

Time-Based Retention

With time-based retention, backups are stored for a defined period, such as 30, 60, or 90 days. Once a backup exceeds that period, it becomes eligible for deletion or archival.

Version-Based Retention

Version-based retention keeps a specified number of backup copies rather than using a fixed number of days. For example, a system might always retain its 20 most recent backups.

Grandfather-Father-Son Retention

The Grandfather-Father-Son (GFS) method uses different retention periods for different backup cycles. Daily backups may be retained for a short period, weekly backups for longer, and monthly backups for the longest period.

This provides both recent and historical restore points without keeping every daily backup indefinitely.

Backup Retention vs Backup Frequency

Backup frequency and backup retention are related but have different purposes. Backup frequency defines how often backups are created, while backup retention defines how long those backups remain available.

For example, a server might create a backup every six hours and retain each backup for 30 days.

A system can therefore have frequent backups but short retention, or less frequent backups with long retention. Both settings should reflect the organization's recovery objectives and the importance of its data.

Why Is Backup Retention Important?

Data problems are not always discovered immediately. A corrupted database, accidentally deleted file, incorrect application update, or compromised account could go unnoticed for days or weeks. If only very recent backups are available, all retained copies may already contain the same problem. Longer retention provides older restore points that may predate the incident. Retention policies also help control storage usage. Rather than accumulating backup copies indefinitely, organizations can retain the versions that provide meaningful recovery value and remove copies that are no longer required.

Backup Retention for Servers

Server backup retention should reflect the workload running on the system. A frequently updated ecommerce database, for example, may require more frequent recovery points than a mostly static website. A business application may also need older copies if errors can remain unnoticed for a long time.

Whether the workload runs on a VPS, dedicated server, or another hosting environment, administrators should also consider where backups are stored. Keeping the only backup on the same server as the production data creates a single point of failure. If the server or its storage becomes unavailable, the backup may become unavailable as well.

This is especially important for production hosting environments where backups are part of a wider disaster recovery plan.

Backup Retention Best Practices

Start by defining how much data your organization can afford to lose and how far back it might reasonably need to restore information. Critical workloads often need multiple generations of backups rather than only the latest copy. Backups should also be tested periodically. A long retention period has little value if the stored data cannot be successfully restored.

Administrators should protect backup access, monitor available storage, document retention settings, and regularly review whether the policy still matches current infrastructure and business requirements.

Where compliance requirements apply, organizations should determine the required retention periods for their specific industry and jurisdiction instead of relying on a generic backup schedule.