The words "retention" and "backup" often get used interchangeably, which causes real confusion. A partner may say, "We keep everything for seven years," believing it means the firm can restore any file from any day in that period. A technician hears the same sentence and configures a backup system that keeps thirty days of copies. Both think the firm is covered. Neither is.
Understanding the difference helps you meet client file obligations, respond to legal holds and recover from incidents.
The two concepts
Backup
A backup is a copy of data made to recover from loss, such as hardware failure, ransomware, accidental deletion or disaster. Backup retention, how long copies are kept, is generally short to medium: days, weeks or months, depending on the design.
Records retention
Records retention is a policy about how long the firm keeps certain information as an official record, such as client files, trust account records and business records, and when it disposes of them. It is driven by ethics rules, law, contracts and risk management.
Put simply: backup answers "Can we recover?" Retention answers "How long must or should we keep this, and when do we destroy it?"
Why the difference matters
- Backups are not archives. Using backup tapes or snapshots as a long-term archive makes finding a specific record slow and unreliable.
- Deleted data may linger in backups. If you dispose of a client file at the end of its retention period but old backups still hold copies, the data still exists and remains exposed to a breach.
- Legal holds interact with both. When a matter triggers a duty to preserve information, routine deletion must pause, and the backup rotation may also need attention. Work with counsel.
- Cloud services have their own rules. Microsoft 365 and other platforms have default retention settings for deleted items and versions that may not match your policy.
Building a coherent approach
1. Define records retention first
Develop a written schedule by category, such as client files, trust records, billing records, employment files and email. Confirm the time periods that apply in your state with your state bar and counsel, and include any longer periods required by engagement letters or outside counsel guidelines.
2. Decide where active and archived records live
Active matters live in the document management system. Closed matters can move to an archive with controlled access. The archive, not the backup, is the system of record.
3. Design backup retention to match recovery needs
Define how far back you may need to restore: for example, recent daily copies, weekly copies for a few months and monthly copies for a year. This depends on how quickly you would detect accidental deletion or corruption. Slow-moving issues, like a quietly encrypted file, may not be noticed for weeks.
4. Reconcile disposal with backups
When you destroy records, document that it occurred, and understand how long those records persist in backups. Many firms accept that the data will age out of backup rotation within a defined period and record that in the policy. Confirm this approach with counsel.
5. Plan for legal holds
Create a procedure for issuing, tracking and releasing holds, including notifying IT so that automatic deletion and email retention rules are suspended for the relevant custodians and matters. Keep a record of each hold.
6. Include email and messaging
Email is a record. Decide whether email is retained in the mailbox, archived or filed to the matter, and for how long. Do the same for chat, text messages and recordings.
7. Treat personal data with care
Data minimization is a security principle. The longer you retain personal information, the longer it is exposed to breach. Dispose of what you are not required to keep.
Questions to ask your IT provider
- What is our current backup retention, system by system?
- How are deleted files and mailbox items recovered, and for how long?
- How would a legal hold be implemented technically?
- Does retention in our document management system match the policy?
- How do we dispose of archived data and confirm it?
Communicate with clients
Engagement letters and closing letters should say how long you will keep the file and what will happen afterward. This reduces surprises and supports compliance.
How Counsel Cyber helps
We help firms align backup settings, cloud retention and archive practices with written records policies. Ask us to map your current retention against your policy.