# Do Small Businesses Need Google Workspace Backup? What Google Keeps and Doesn't

> What Google Workspace keeps after deletion, how long admins can restore Gmail and users, why Vault is not a backup, and how to decide whether a small business needs a separate backup.

Source: https://www.epifive.com/blog/microsoft-365-vs-google-workspace-backup-small-business · Published 2026-10-28 · EpiFive

## Key takeaways

- Google's recovery windows are short, with 30 days in Gmail Trash plus 25 days for admins, and 20 days to restore a deleted user.
- Google Vault is a retention and eDiscovery tool, not a backup; it does not retain anything until you set retention rules.
- Data that is permanently deleted beyond the recovery window may not be recoverable without a separate backup.
- Decide on a separate backup by comparing how long you might take to notice a loss with these windows.

Google Workspace protects against many everyday mistakes with built-in recovery windows, but those windows are short: for example, 30 days for a user to recover deleted Gmail from Trash plus 25 more days for an admin, and 20 days to restore a deleted user account. Google Vault is a retention and eDiscovery tool, and Google's documentation says it is not a data archive. Whether a small business needs a separate backup depends on how long it might take you to notice a loss compared with these windows.

## Who this is for

This is for owners and administrators of small Google Workspace tenants, usually from 2 to 50 users, who want to understand what Google already keeps and where the gaps are. By the end you will have a table of the recovery windows Google documents, a view of what Vault does and does not do, a list of scenarios that fall outside the windows, and a decision method. If you also use Microsoft 365, see [Microsoft 365 Backup for Small Businesses: Native Retention vs Backup](https://www.epifive.com/blog/microsoft-365-backup-small-business-options) for the same question there.

The recovery windows below are from Google's help pages as read on 28 October 2026. Google can change them, so check the linked pages before relying on a number.

## What is a backup, and what is retention?

A **backup** is a separate, restorable copy of data, kept so you can return to a past state after loss, corruption or deletion. **Retention** is a rule that keeps data for a period, usually for compliance. They overlap but are not the same: Vault retention can keep data available to search and export; the Vault overview describes searching and exporting, and does not describe restoring data into a user's account the way a backup would.

## What Google keeps and for how long

| Scenario | What Google documents |
| --- | --- |
| User deletes a Gmail message | The user can recover it from Trash for 30 days |
| After the 30 days | Admins get an additional 25 days to restore messages, counted from when the 30-day window ends |
| User deletes a Drive file | Files in Trash are deleted forever after 30 days, or immediately on Empty trash |
| Owner permanently deletes a shared file | Everyone it was shared with loses access |
| Admin deletes a user account | A super admin can restore the user up to 20 days after deletion; after that the data is gone |
| Data under a Vault retention rule or hold | Vault keeps it available to search and export; restoring it to the user's account is not a documented Vault function |

### Gmail restore by an admin

Google's article on restoring a user's permanently deleted email gives these steps:

1. In the Admin console, go to Directory, then Users, and find the user.
2. Open the options menu for that user and choose Restore data.
3. Pick a date range within the last 25 days.
4. Select Gmail as the data type and start the restore.

Once started, the restore cannot be paused or stopped, and it may take several days to appear in the user's inbox. The article lists what cannot be restored: data permanently deleted more than 25 days earlier, messages deleted from spam, deleted drafts, deleted labels or nested label structures, and items in the user's Trash. The 25-day clock depends on the deletion date, not on when the message was sent or received.

### Restoring a deleted user

Google's Admin Help says you can restore a user account, including administrator accounts, up to 20 days after deleting it, and that after 20 days the data is gone. The path it gives is Directory, then Users, then More options, then Recently deleted users, then Recover on the account. You need super admin rights, and the article lists other blockers, such as no available licence for the user's previous service or edition. Because the window is only 20 days, offboarding a leaver by deleting the account right away can be risky if their files or mail are still needed. Consider transferring data first.

## What Google Vault does and does not do

Google's Vault overview describes it as a retention and eDiscovery service. It lets you retain, hold, search and export users' data across services including Gmail, Drive, Calendar, Chat, Meet and Groups.

- **Retention rules** control how long data is kept. Vault does not retain anything until you set up retention rules. Rules can keep data for a period so it stays available to Vault after users delete it, or remove data after a set time.
- **Holds** preserve data indefinitely for legal or other obligations, and can be placed on accounts, organisational units and groups.
- **It is not an archive or a backup.** The overview says Vault is not a data archive. Data that is not on hold is subject to standard deletion once retention rules expire, and purged data cannot be recovered. Exports are deleted after 15 days.
- **Licences.** Vault is included in some editions, including Business Plus, Enterprise Standard and Enterprise Plus, and can be added to some others. The page notes that, starting 1 November 2025, admins need a Vault licence to keep using it. Check Google's current edition list.

For a small business on a lower tier without Vault, the built-in windows above are what you have.

## Where the gaps are

These situations can fall outside the windows:

1. **Slow discovery.** Someone deletes a folder or a mailbox's contents, or a sync tool overwrites files, and nobody notices for several weeks. Gmail restore is capped at 25 days after the 30-day Trash period, and Trash itself empties after 30 days.
2. **Departed staff.** An account deleted at offboarding cannot be restored after 20 days.
3. **Shared files owned by someone who leaves.** If the owner permanently deletes a file, those it was shared with lose access.
4. **Malicious or accidental mass deletion.** A compromised account or a mistaken script can delete a lot quickly. See the 2-step setup in [Turn On Two-Step Verification for Google, Microsoft and Apple Accounts](https://www.epifive.com/blog/enable-two-step-verification-google-microsoft-apple) to reduce the chance.
5. **Items the Gmail restore tool excludes**, such as drafts and labels.
6. **Compliance needs.** If a regulation or contract requires you to keep records for a fixed period, retention rules (Vault or otherwise) are the tool, and a backup alone may not satisfy it. Check your own obligations.

## Decide whether you need a separate backup

Work through these questions.

1. **How long could a loss go unnoticed?** If the answer is longer than the shortest relevant window above, you have a gap.
2. **How much would losing it cost?** Mail, shared drives with contracts and accounts data deserve more protection than scratch files.
3. **Who can delete?** The more users with admin rights or ownership of shared data, the higher the chance of large deletions.
4. **Do you have to keep records for a set time?** If so, consider retention rules and take advice.
5. **Can you test a restore?** A backup you have never restored is unproven.

If you decide to add backup, evaluate any third-party service against these points, using its own documentation: which services are covered (mail, Drive, shared drives, calendars, contacts), how often it runs, how long versions are kept, where the copies are stored, how restores work and how you test them, and what happens to the copies if you cancel. Do not choose on a vendor's claims alone.

## Low-cost steps that help without a new product

- **Delay account deletion** for leavers: suspend first, transfer ownership of Drive files, then delete after you have confirmed nothing is needed.
- **Limit super admins** to a small number and protect them with strong sign-in methods.
- **Use shared drives** for team files instead of personal My Drive, so a leaver's departure does not remove them.
- **Set Vault retention** if your edition includes it and you have a defined retention requirement.
- **Export key data periodically** and keep copies elsewhere, if the volume is small.
- **Write down the restore steps** above and rehearse them once.

## Troubleshooting a recovery

| Problem | What to check |
| --- | --- |
| The Restore data option is missing | You may lack the needed admin privilege; check with a super admin |
| Gmail restore shows nothing after starting | It may take several days to appear, and it cannot be stopped once begun |
| Cannot recover a deleted user | It may be past 20 days, or there may be no licence available for the user's service or edition |
| A deleted draft or label is not returned | Google lists drafts and labels as not restorable by the tool |
| Vault shows data but the user cannot see it | Vault searches and exports; restoring into the mailbox is not a documented Vault function, so use the Restore data tool where it applies |

## Summary checklist

- Know the windows: 30 days of Trash, then 25 days for admins on Gmail; 30 days of Trash for Drive; 20 days for deleted users.
- Remember that Vault is retention and eDiscovery, not backup.
- Compare the windows with how quickly you would notice a loss.
- Delay account deletion for leavers and use shared drives.
- If you add a separate backup, test a restore before relying on it.

## References

- Google Workspace Admin Help, Restore a user's permanently deleted email: https://knowledge.workspace.google.com/admin/support/troubleshooting/restore-a-users-permanently-deleted-email
- Google Workspace Admin Help, Restore a recently deleted user: https://knowledge.workspace.google.com/admin/users/restore-a-recently-deleted-user
- Google Vault overview: https://knowledge.workspace.google.com/vault/getting-started/vault-overview
- Google Drive Help, Delete or restore files and folders: https://support.google.com/drive/answer/2375102

## Frequently asked questions

### Does Google Workspace back up my data?

Google keeps your data available as a service, but recovery after deletion is limited by time windows. For example, users can recover deleted Gmail messages from Trash for 30 days, and admins get a further 25 days with the Restore data tool. After that, permanently deleted data may not be recoverable.

### Is Google Vault a backup tool?

No. Google describes Vault as a retention and eDiscovery service. It can keep, hold, search and export data under rules you set, but Google's documentation says Vault is not a data archive. Its documented functions are retaining, searching and exporting, not restoring a mailbox.

### How long can I restore a deleted Google Workspace user?

Google's Admin Help says a super admin can restore a deleted user account up to 20 days after deleting it. After 20 days the data is gone and the user cannot be restored.

### How long do deleted Drive files stay in Trash?

Google's Drive Help says files in Trash are deleted forever after 30 days, or immediately if you select Empty trash. If an owner permanently deletes a file, everyone it was shared with loses access.