Start with how much work you could lose
Frequency is really a question about pain. If your backup runs at 10pm and a server dies at 4pm the next day, you lose almost a full day of work. For a two-person consultancy that writes reports, that might mean redoing a few documents. For a busy accounts team entering hundreds of transactions, or a practice booking appointments all day, it could mean a lot of reconstruction from paper, emails and memory.
Go through your systems one at a time and ask how many hours of changes you could recreate without real cost. That number guides the schedule. Email and cloud files in Microsoft 365 or Google Workspace are usually backed up several times a day by cloud backup services anyway. On-premises servers and databases are where you have to make an active choice.
Typical schedules that work
For most small offices, a sensible baseline is a full system image of any server each night, plus more frequent snapshots of busy data during business hours, perhaps every hour or two. Modern backup tools only copy changed blocks after the first run, so frequent backups do not mean copying everything again. Cloud services such as 365 and Workspace typically back up a few times a day by default.
Laptops that hold work locally should back up whenever they are online, continuously or several times a day, because they are the devices most likely to be lost, stolen or dropped. If staff keep everything in OneDrive, the laptop itself needs less protection, but check that known folder redirection actually moved Desktop and Documents into OneDrive.
How long to keep each kind of copy
Retention is usually layered. Daily restore points are kept for two to six weeks so you can recover from recent mistakes. Weekly points are kept for a few months to cover problems noticed later. Monthly points are kept for a year or longer, giving you a way back to an earlier state when, for instance, someone finds that a spreadsheet was corrupted last quarter. Some businesses add a yearly copy kept for seven years to line up with record-keeping.
Longer is not automatically better. Each extra month of history costs storage, and if those copies include personal information, keeping them longer than you need sits awkwardly with the Privacy Act 2020. The aim is to keep enough history to recover from realistic problems, plus whatever your legal and contractual duties require.
Why late discoveries change the answer
Many data problems are noticed long after they start. A formula error in a pricing sheet, a folder dragged into the wrong place, a synced file quietly overwritten by an old copy, or malware that sat dormant for weeks. If you only keep seven days of backups, those problems may have already rolled out of your history by the time anyone looks.
That is the strongest argument for keeping monthly copies for at least a year. It costs relatively little, because monthly points share most of their data with each other, and it covers the slow-burn mistakes that daily retention misses. If budget is tight, shorten the daily tier slightly rather than dropping the monthly copies, because the monthly tier is what rescues you from the problems nobody saw coming.
Matching retention to obligations
Some data has its own rules. In New Zealand, businesses generally keep financial records for seven years for tax purposes, and certain industries such as health, legal and finance have extra requirements set by their regulators or professional bodies. Client contracts sometimes specify how long project files must be kept, or how quickly they must be destroyed after the work ends.
Backups are not the best tool for meeting record-keeping duties, because restoring a five-year-old backup just to find one invoice is slow. Keep proper records in your accounting system or an archive, and set backup retention to support recovery. Where the two overlap, write down which system holds the authoritative copy.
Write it down and review yearly
Record the schedule and retention for each system in a short table: what is backed up, how often, where to, and how long each tier is kept. Review it once a year or when something big changes, like moving to a new accounting platform or adding a second office. The table also makes it easy for anyone covering your IT to see whether the settings still match the plan.
Finally, check that the schedule is actually running. A plan for hourly snapshots means little if the job has failed silently since a server update last winter. Make sure failure alerts go to a person who reads them, not a shared inbox nobody checks. Monitoring and regular test restores are what turn a sensible schedule into real protection.
In short
- Set frequency by how many hours of work you could afford to redo.
- Layer retention: daily for weeks, weekly for months, monthly for a year or more.
- Keep enough history to catch problems discovered late.
- Use accounting systems and archives for record-keeping, not old backups.