The CFO asks "we archive invoices for ten years, right?" The tech team answers "yes, nightly backups on the VPS". The accounting auditor asks for evidential value, chain of custody, impossibility of silent modification. Silence.
Legal archiving and backup answer two different questions. Backup: can I bring the site back after an outage? Archive: can I prove in ten years what that document contained, intact and dated? Confusing the two is one of the costliest compliance mistakes in hosted environments.
Two goals, two architectures
| Criterion | Operational backup | Legal archiving |
|---|---|---|
| Goal | Fast recovery | Evidential retention |
| Duration | Days to months | Years to decades |
| Modification | Overwrite / rotation | Immutability, WORM |
| Proof | RTO/RPO | Timestamping, sealing |
| Owner | Operations / host | Business + DPO/compliance |
An S3 copy with a thirty-day lifecycle is not an accounting archive. Internal NAS without access logs neither.
"We keep it a long time" is not "we archive legally".
Minimum technical requirements
Depending on sector (accounting, health, public sector), verify:
Integrity — cryptographic fingerprint, alteration detection, WORM storage or equivalent.
Traceability — who deposited, viewed, exported; retained logs.
Durable format — PDF/A, signed XML, not a proprietary database without export.
Environment separation — archive distinct from production and operational backups.
Destruction plan — documented end of legal period (link with Data deletion).
The host can provide storage; legal qualification remains your processing responsibility or the business unit's.
Hosting: questions for the provider
- Does the offer guarantee immutability (Object Lock, WORM tape) or simple retention?
- Location of long-term copies — including disaster replication?
- Host admin access: can they delete an archive without trace?
- Reversibility at contract end: open-format export, deadline, egress cost?
- Subsequent archiving sub-processors listed in the DPA?
For sensitive flows, cross-check the directory with object storage + immutability offers or certified electronic archiving providers — without inventing undocumented certification.
The peak: ten years of backup ≠ ten years of proof
Decide and move forward without blind spots
Inventory documents subject to legal archiving. For each, note legal duration, expected format, required proof and business owner. Separate archive volumes or buckets from operational backups. Document everything in the GDPR register. See Email retention if mail falls in scope. Compare storage and location via the comparison tool and Backup location.
Frequently asked questions
Does daily backup count as legal archiving?
No. Backup targets incident recovery; legal archiving targets evidential retention over the legal period, with integrity, traceability and often sealing or qualified timestamping.
Can a web host serve as archive?
Rarely alone. Shared hosting or a standard S3 bucket does not automatically provide evidential value. Certified archiving offers or a specialised third party are often required depending on sector.
What retention periods to plan?
They depend on document type — accounting, commercial, HR, health. Map obligations by flow before choosing technical retention at the host.
Archive outside the EU?
Only with legal basis, appropriate safeguards and documented transfer analysis. Sensitive legal archiving often requires EU residence or enhanced guarantees.
The right question is not "how long do we store?" — it is "what proof will we have in ten years?"