Do Small Businesses Need Google Workspace Backup? What Google Keeps and Doesn't

Google Workspace protects against many everyday mistakes with built-in recovery windows, but those windows are short: for example, 30 days for a user to recover deleted Gmail from Trash plus 25 more days for an admin, and 20 days to restore a deleted user account. Google Vault is a retention and eDiscovery tool, and Google's documentation says it is not a data archive. Whether a small business needs a separate backup depends on how long it might take you to notice a loss compared with these windows.

Who this is for

This is for owners and administrators of small Google Workspace tenants, usually from 2 to 50 users, who want to understand what Google already keeps and where the gaps are. By the end you will have a table of the recovery windows Google documents, a view of what Vault does and does not do, a list of scenarios that fall outside the windows, and a decision method. If you also use Microsoft 365, see Microsoft 365 Backup for Small Businesses: Native Retention vs Backup for the same question there.

The recovery windows below are from Google's help pages as read on 28 October 2026. Google can change them, so check the linked pages before relying on a number.

What is a backup, and what is retention?

A backup is a separate, restorable copy of data, kept so you can return to a past state after loss, corruption or deletion. Retention is a rule that keeps data for a period, usually for compliance. They overlap but are not the same: Vault retention can keep data available to search and export; the Vault overview describes searching and exporting, and does not describe restoring data into a user's account the way a backup would.

What Google keeps and for how long

Gmail restore by an admin

Google's article on restoring a user's permanently deleted email gives these steps:

1. In the Admin console, go to Directory, then Users, and find the user.
2. Open the options menu for that user and choose Restore data.
3. Pick a date range within the last 25 days.
4. Select Gmail as the data type and start the restore.

Once started, the restore cannot be paused or stopped, and it may take several days to appear in the user's inbox. The article lists what cannot be restored: data permanently deleted more than 25 days earlier, messages deleted from spam, deleted drafts, deleted labels or nested label structures, and items in the user's Trash. The 25-day clock depends on the deletion date, not on when the message was sent or received.

Restoring a deleted user

Google's Admin Help says you can restore a user account, including administrator accounts, up to 20 days after deleting it, and that after 20 days the data is gone. The path it gives is Directory, then Users, then More options, then Recently deleted users, then Recover on the account. You need super admin rights, and the article lists other blockers, such as no available licence for the user's previous service or edition. Because the window is only 20 days, offboarding a leaver by deleting the account right away can be risky if their files or mail are still needed. Consider transferring data first.

What Google Vault does and does not do

Google's Vault overview describes it as a retention and eDiscovery service. It lets you retain, hold, search and export users' data across services including Gmail, Drive, Calendar, Chat, Meet and Groups.

• Retention rules control how long data is kept. Vault does not retain anything until you set up retention rules. Rules can keep data for a period so it stays available to Vault after users delete it, or remove data after a set time.
• Holds preserve data indefinitely for legal or other obligations, and can be placed on accounts, organisational units and groups.
• It is not an archive or a backup. The overview says Vault is not a data archive. Data that is not on hold is subject to standard deletion once retention rules expire, and purged data cannot be recovered. Exports are deleted after 15 days.
• Licences. Vault is included in some editions, including Business Plus, Enterprise Standard and Enterprise Plus, and can be added to some others. The page notes that, starting 1 November 2025, admins need a Vault licence to keep using it. Check Google's current edition list.

For a small business on a lower tier without Vault, the built-in windows above are what you have.

Where the gaps are

These situations can fall outside the windows:

1. Slow discovery. Someone deletes a folder or a mailbox's contents, or a sync tool overwrites files, and nobody notices for several weeks. Gmail restore is capped at 25 days after the 30-day Trash period, and Trash itself empties after 30 days.
2. Departed staff. An account deleted at offboarding cannot be restored after 20 days.
3. Shared files owned by someone who leaves. If the owner permanently deletes a file, those it was shared with lose access.
4. Malicious or accidental mass deletion. A compromised account or a mistaken script can delete a lot quickly. See the 2-step setup in Turn On Two-Step Verification for Google, Microsoft and Apple Accounts to reduce the chance.
5. Items the Gmail restore tool excludes, such as drafts and labels.
6. Compliance needs. If a regulation or contract requires you to keep records for a fixed period, retention rules (Vault or otherwise) are the tool, and a backup alone may not satisfy it. Check your own obligations.

Decide whether you need a separate backup

Work through these questions.

1. How long could a loss go unnoticed? If the answer is longer than the shortest relevant window above, you have a gap.
2. How much would losing it cost? Mail, shared drives with contracts and accounts data deserve more protection than scratch files.
3. Who can delete? The more users with admin rights or ownership of shared data, the higher the chance of large deletions.
4. Do you have to keep records for a set time? If so, consider retention rules and take advice.
5. Can you test a restore? A backup you have never restored is unproven.

If you decide to add backup, evaluate any third-party service against these points, using its own documentation: which services are covered (mail, Drive, shared drives, calendars, contacts), how often it runs, how long versions are kept, where the copies are stored, how restores work and how you test them, and what happens to the copies if you cancel. Do not choose on a vendor's claims alone.

Low-cost steps that help without a new product

• Delay account deletion for leavers: suspend first, transfer ownership of Drive files, then delete after you have confirmed nothing is needed.
• Limit super admins to a small number and protect them with strong sign-in methods.
• Use shared drives for team files instead of personal My Drive, so a leaver's departure does not remove them.
• Set Vault retention if your edition includes it and you have a defined retention requirement.
• Export key data periodically and keep copies elsewhere, if the volume is small.
• Write down the restore steps above and rehearse them once.

Troubleshooting a recovery

Summary checklist

• Know the windows: 30 days of Trash, then 25 days for admins on Gmail; 30 days of Trash for Drive; 20 days for deleted users.
• Remember that Vault is retention and eDiscovery, not backup.
• Compare the windows with how quickly you would notice a loss.
• Delay account deletion for leavers and use shared drives.
• If you add a separate backup, test a restore before relying on it.

References

• Google Workspace Admin Help, Restore a user's permanently deleted email: https://knowledge.workspace.google.com/admin/support/troubleshooting/restore-a-users-permanently-deleted-email
• Google Workspace Admin Help, Restore a recently deleted user: https://knowledge.workspace.google.com/admin/users/restore-a-recently-deleted-user
• Google Vault overview: https://knowledge.workspace.google.com/vault/getting-started/vault-overview
• Google Drive Help, Delete or restore files and folders: https://support.google.com/drive/answer/2375102