When a business backs up its data, it is natural to focus on whether the backup is running successfully. But there is another important question: how long should those backups be kept? This is known as backup retention. Retention determines how far back a business can potentially go when it needs to recover information. A backup from yesterday may help if a computer failed today, but it may not help if an important problem was discovered several weeks after it happened. The right retention strategy gives a business enough recovery history to deal with more than just today’s problems.

Consider an employee who accidentally changes an important spreadsheet. The problem might not be discovered immediately. If the backup system keeps only the newest version of the file, the original information may no longer be available. A longer retention period can provide additional recovery points that allow the business to go back and find an earlier version. This is particularly important for businesses where mistakes or data problems may go unnoticed for days or weeks. How to Protect Your Business From Accidental Data Loss explains why ordinary mistakes can create real data-protection problems for a business.

Retention also becomes important when dealing with ransomware and other destructive events. Imagine that a business is infected and the damage isn’t discovered immediately. If the backup system continually replaces older recovery points with newer copies, there may eventually be no unaffected recovery point left from before the problem occurred. Appropriate retention gives the business a better chance of having an earlier copy available. It is one reason that simply asking whether a company has backups doesn’t tell the entire story. The business also needs to know what recovery history those backups provide.

There is no single retention period that is correct for every small business. A company may need different retention periods for different types of information. Some businesses may need to retain certain data for longer because of operational requirements, contractual obligations, or industry-specific considerations. Other information may have a much shorter useful life. Storage capacity and cost also need to be considered. The objective is to create a retention policy that balances the business’s recovery needs with the practical cost of maintaining those recovery copies. How Long Should a Small Business Keep Its Backups? explores this question in more detail.

Backup retention is therefore not simply a technical setting. It is part of the business’s overall data protection strategy. A good strategy considers what information is important, how long problems might remain undiscovered, how far back the business may need to recover, and what could happen if older recovery points no longer exist. When backups are managed as an ongoing business process rather than something that is configured once and forgotten, retention can be designed around the actual needs of the business.