Your expert in backup and data protection!The solution tailored to your needs
What is the difference between backup and archiving?
Backup is used to get a system running again or to recover a recent file. Archiving is used to keep a document, often for years, in the state in which it was frozen, for business, accounting or legal reasons. The two have neither the same retention period nor the same rules.
Key points
- Backup: days to a few months of history, to get back to work.
- Archiving: years, for specific documents that no one must be able to modify.
- Examples of French retention periods: ten years for accounting documents, six years for tax documents, five years for payslips.
- The GDPR prohibits keeping everything “just in case”: the retention period follows the purpose.
- An old server backup is not an archive you can use during an audit.
Two questions, two retention periods
| Operational backup | Archiving | |
|---|---|---|
| Question | Can I get back to work tomorrow? | Can I find this document in five or ten years, unmodified? |
| Content | Systems, databases, live files, email | Frozen documents: invoices, contracts, files, logs |
| Typical retention | Days to a few months | Years, sometimes set by law |
| Modification | The oldest points are overwritten when the volume is full | Modification and deletion are prevented for the chosen period |
| Restore | Frequent, sometimes a single file | Rare, for an audit, a dispute or an inspection |
Mixing the two in the same space leads to two failures. Operational backup becomes too expensive if you keep ten years of daily backups. The archive becomes useless if it follows the same cycle as the nightly backups and gets purged.
The ANSSI, France’s national cybersecurity agency, also excludes legal archiving, which requires guaranteeing the authenticity of the data, from its backup guide: they are two separate subjects.
An archive is not an old backup
A server backup dated 2019 contains an operating system, passwords from that time and temporary files. It is heavy, hard to read back, and it carries personal data whose retention the GDPR requires you to limit. An archive of time-stamped, unmodifiable PDF invoices satisfies a tax audit. The 2019 backup does not.
Archiving with evidential value adds integrity: no one, not even an administrator, must be able to rewrite the document during the retention period. That is the role of write-once (WORM) storage or an immutable backup.
The three stages of personal data
The CNIL, France’s data protection authority, describes the life cycle of personal data in three phases:
- Active database: the data is used for day-to-day processing and remains accessible to the teams concerned.
- Intermediate archiving: the data is no longer used for its original purpose but must be kept for a legal obligation or possible litigation. Access is limited to authorised people, with physical or logical separation.
- Permanent archiving or deletion: only certain information is kept indefinitely, for its historical value; the rest is deleted.
Operational backup covers the active database. Intermediate archiving belongs in a separate space, with its own retention period.
What French law says: some examples
These periods apply to the document, not to the number of nightly backups. They do not replace advice tailored to your sector.
| Document | Retention period | Starting point |
|---|---|---|
| Accounting books and supporting documents (article L123-22 of the French Commercial Code) | 10 years | End of the financial year |
| Tax documents (corporate income tax, VAT, etc.) | 6 years | Last transaction |
| Contracts and business correspondence | 5 years | Depends on the document |
| Copies of payslips (employer) | 5 years | — |
| Patient records in a healthcare facility (article R1112-7 of the French Public Health Code) | 20 years | Last stay or last consultation |
For patient records, the French Medical Council specifies special cases: retention at least until the patient’s 28th birthday, and ten years after a death occurring less than ten years after the last visit.
For personal data, the GDPR requires a retention period linked to the purpose. “Keeping everything just in case” is not a legal basis: the CNIL points out that personal data cannot be kept indefinitely.
How to decide
- List the documents with evidential value and their retention periods.
- Take them out of the daily backup cycle and place them on immutable, encrypted storage whose retention period matches the obligation.
- Separately, keep a short history (days, weeks, a few months) for failures and errors.
- Plan how the archive will be read in ten years: file format, software, encryption key. An unreadable archive is not an archive.
At WeDoBack
The backup offer (SMART or INTEGRAL) covers operational history: retention is set according to the subscribed volume. The IMMUTABLE offer is WORM storage: data can be neither modified nor deleted during the chosen period, up to ten years. The public price is €20 excl. VAT per 100 GB block per month, plus one agent per machine. Once the period ends, protection is renewed with a new subscription. The encryption key stays with the customer: it must be kept for as long as the archive.
Frequently asked questions
Do my backups that are more than ten years old count as accounting archives?
In practice, no. An auditor expects documents that are readable and easy to find, not a server image that would have to be rebuilt with old software. Archiving isolates the relevant documents, in a readable format, on a medium that prevents them from being modified.
How long should you keep an invoice?
In France, accounting records, including invoices, must be kept for ten years from the end of the financial year. The tax authorities can audit the previous six years. These periods apply to the document, not to the daily backup of the server that holds it.
Can you archive in the same solution as your backups?
Yes, provided the archive space has its own retention period, separate from the backup rotation cycle, and is protected against modification and deletion. Otherwise, the archive ends up being purged along with the old backups.
Further reading
Sources
Documents consulted in October 2026.
- How long must businesses keep their documents? — Entreprendre.Service-Public.gouv.fr (French government portal for businesses)
- The patient record — French National Medical Council
- Data retention periods — CNIL
- Backing up information systems – The fundamentals (ANSSI-BP-100, v1.1, 27 November 2025) — ANSSI
- IMMUTABLE offer: WORM storage and prices — WeDoBack
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.