Keep backups for a set time

How to do it

Pick the period from the oldest mistake you need to undo, such as a bad import found weeks later. Daily copies for 30 to 35 days suit most services. Keep monthly copies longer only when a law or contract asks, and write down why. Set the expiry in the storage itself, such as an S3 lifecycle rule, so it runs even when the server is gone. Set the object lock to the same period, never longer. Backups are not edited to honour an erasure request. The erased data leaves with the backups as they expire, and a restore runs the erasure log again, as data requests says. Name the period in the privacy notice and in the retention schedule.

Example

{
  "Rules": [{
    "ID": "expire-daily-backups",
    "Filter": { "Prefix": "daily/" },
    "Status": "Enabled",
    "Expiration": { "Days": 35 },
    "NoncurrentVersionExpiration": { "NoncurrentDays": 1 }
  }]
}

# restic: keep 35 daily snapshots, then prune the data they no longer use
restic forget --keep-daily 35 --prune

How to check

The oldest backup in the off-site store is no older than the period plus one day. The retention schedule and the storage's expiry rule name the same period.