How Long Should Backups Be Kept?

At a recent Information Governance conference, one of the audience members asked this question. A number of other people nodded their heads, as if they, too, wanted to know the answer to this most perplexing question.

The moderator asked if the person was talking about backup tapes or data that was archived to a long term repository. The person didn’t seem to understand the difference – aren’t back tapes supposed to be used for long term storage?

This question highlights a very serious, but unfortunately common, misunderstanding of information governance. Backups are for recovering information if something goes wrong – a server crashes, a cyber-hacker breaks in an wreaks havoc, or that most disastrous occurrence – you inadvertently delete an email and empty your “Deleted Items” folder. If a backup of the data on each system is made daily, you can rest assured that data can likely be recovered.

On the other hand, backups are not designed to store records that need to be retained by an organization’s records retention policy. Period. End of story. They are used in this capacity simply because it’s easy – backup everything, file away the tapes, and you’re done. Regrettably, this leads to two  important problems with data that Information Governance aims to remedy – retention of multiple copies and retention of everything.

​Instead of asking how long to retain backups, ask how the information in an organization can be better managed.