Updated October 2026
This report compares native recovery windows, retention obligations, and recovery times side by side, using only the publishers who set them: Microsoft and Google documentation, regulators, NIST, and the original breach and outage studies.
For IT teams, the challenge is ensuring required records remain available after standard recovery windows expire.
An Exchange Online mailbox deleted without an applicable hold can generally be recovered for 30 days (Microsoft Learn). A broker-dealer must keep the business communications in that mailbox for at least three years, the first two in an easily accessible place, and some of its books and records for six (SEC Rule 17a-4). Both rules work exactly as written. The gap is days versus years, and under the shared responsibility model Microsoft describes, the customer is responsible for its data.
Retention closes part of that distance. Microsoft Purview keeps content for as long as the longest retention policy requires, and Google Vault preserves supported data according to retention rules and holds. Retention keeps data in place for discovery. Restoring a mailbox, a OneDrive, or a departed user’s files inside a recovery time objective is a separate job. Google says that Vault “isn’t designed to be a backup or archive tool.” Meanwhile, NIST now describes recovery from a serious incident in weeks or months.
Key data recovery statistics for 2026
- A deleted user’s Exchange Online mailbox is generally kept for 30 days unless an applicable hold or retention policy preserves it.
- Drive files owned by a deleted Google Workspace user can generally be recovered within 20 days by restoring the user account (Google Workspace Admin Help).
- SEC Rule 17a-4 requires broker-dealers to preserve certain records for at least six years, the first two in an easily accessible place.
- Recovery from a cybersecurity incident often takes weeks or months (NIST SP 800-61r3).
- Only 42% of breached organizations reported complete recovery in IBM’s 2026 study, which covers breaches from March 2025 to February 2026 (IBM Cost of a Data Breach, 2026).
- Ransomware was present in 48% of breaches, up from 44% a year earlier (Verizon DBIR, 2026).
- Most data loss in Microsoft 365 results from customer actions, according to Microsoft’s own resiliency guidance (Microsoft Learn).
Data loss and breach statistics for 2026
Most data loss in Microsoft 365 results from customer actions, including accidental deletion. Major incidents and legal requests can extend beyond standard recovery windows, and breaches carry high costs.
- Microsoft designs self-service restore for accidental deletion because most data loss in Microsoft 365 comes from customer actions (Microsoft Learn).
- The human element was present in 62% of breaches, up from 60% the year before (Verizon DBIR, 2026).
- Data theft or leakage featured in 80% of the incidents Microsoft’s security teams investigated (Microsoft Digital Defense Report, 2025).
- The global average cost of a data breach rose 12% to a record $4.99 million (IBM, 2026).
- In the US, the average breach reached $11.5 million, the highest of any country or region (IBM, 2026).
A file deleted by mistake this morning is the case the standard recovery tools were built for, and they handle it well. A breach, a departure, or a legal request can outlast those windows, and those are the events that carry the cost.
Microsoft 365 retention and recovery windows
Under their shared responsibility model, Microsoft 365 includes some built-in tools to recover deleted files, emails, and other data. How long you can recover that data depends on the service and its configuration. Standard recycle bins and restore tools address recent changes, while longer-term protection depends on configured retention or backup capabilities.
- Exchange Online keeps deleted items for 14 days by default, adjustable to a maximum of 30 days (Microsoft Learn).
- SharePoint keeps deleted items in its first- and second-stage recycle bins for a combined maximum of 93 days from the original deletion (Microsoft Learn).
- Files Restore can take a SharePoint document library back to a point in time within the last 30 days (Microsoft Learn).
- When a Microsoft 365 user account is deleted, the user’s OneDrive is retained for 30 days by default, and can be extended for up to 3,650 days using retention settings. However, extended retention may involve storage and reactivation fees and requirements that can impact recoverability. After that period, the deleted OneDrive generally remains recoverable for another 93 days, during which a SharePoint administrator can restore it using PowerShell (Microsoft Learn).
- After 30 days, you can no longer restore a deleted Microsoft 365 group through the standard group recovery process, although retention policies may preserve some content (Microsoft Learn).
- Microsoft 365 Backup, Microsoft’s add-on, separately keeps recovery points for 3 months, 6 months, 1 year, or 2 years, depending on the policy (Microsoft Learn).
Standard recycle-bin and self-service recovery windows are generally measured in days. Microsoft 365 Backup provides a separate recovery mechanism with configurable windows of up to two years, while Purview retention can preserve content for years. By default, “retention always takes precedence over permanent deletion, and the longest retention period wins” (Microsoft Learn). Retaining content through Purview does not necessarily provide the same operational restore capabilities as a backup.
Microsoft now sells its own backup add-on and says its shared-responsibility point of view has not changed (Microsoft Learn). Under that model, the customer is responsible for its data, including data protection (Microsoft Learn), so recovery beyond the standard windows is the customer’s job.
Google Workspace retention and recovery windows
Google draws a clear line between keeping data and restoring it. Vault preserves data for legal discovery, while recovery windows vary depending on whether a file or user account was deleted.
- Files moved to Google Drive trash remain available for user restoration for up to 30 days before automatic removal (Google Drive Help).
- Workspace administrators can recover eligible deleted Drive items for up to 25 days after removal from trash, whether the trash was emptied manually or the files were removed automatically. This window begins when the files leave trash, not when they were originally deleted (Google Workspace Admin Help).
- After that 25-day administrator recovery period, files cannot be restored using Google’s standard Drive recovery tools, although data preserved by Vault retention rules or holds may still be available for export (Google Workspace security whitepaper).
- An earlier version of a non-Google file stored in Drive may be permanently deleted after 30 days or once there are 100 newer versions (Google Drive Help).
- Google keeps its own Workspace backups for disaster recovery, and those backups are not available to restore data at a customer’s request (Google Workspace Admin Help).
- By default, Workspace data stays in user accounts until the user or an admin deletes it (Google Vault Help).
- Vault “isn’t designed to be a backup or archive tool,” and “doesn’t have any automated recovery tools” (Google Vault FAQ).
- Vault exports are prepared for legal discovery, and Vault cannot create differential backups or deduplicate data (Google Vault FAQ).
A Workspace tenant can hold mail and files in Vault for years. Getting them back means an export built for discovery, which Google itself calls hard to restore from.
Record retention requirements by regulation
The obligations attached to the same mail and files are measured in years, and regulators can impose penalties for recordkeeping violations. Retention periods also have an end, because privacy law limits how long personal data can be kept.
- SEC Rule 17a-4 sets six years for certain broker-dealer records and at least three years for others, with the first two years easily accessible (17 CFR 240.17a-4).
- FINRA Rule 4511 requires six years for books and records with no other specified period, preserved in a format that complies with SEA Rule 17a-4 (FINRA).
- HIPAA requires covered entities to keep required security documentation for six years from creation or from the date it was last in effect, whichever is later (45 CFR 164.316).
- The IRS baseline for tax records is three years, and employment tax records must be kept at least four years (IRS).
- A business that claims a bad debt deduction or a loss from worthless securities must keep records for seven years (IRS).
- GDPR requires that personal data be kept “no longer than is necessary for the purposes for which the personal data are processed” (GDPR Article 5).
- In fiscal 2024 alone, SEC recordkeeping cases produced more than $600 million in civil penalties against more than 70 firms (SEC, 2024).
- 85% of executives say compliance requirements have become more complex over the last three years (PwC Global Compliance Survey, 2025).
- Noncompliance with regulations added $201,112 to the average cost of a breach (IBM, 2026).
Recovery windows compared with retention requirements
| Data or rule | Recovery window or retention period | Source |
| Deleted Google Workspace user (Drive files) | 20 days from user account deletion; requires restoring the user | Google Workspace Admin Help |
| Drive items after removal from trash | Up to 25 additional days for administrator recovery | Google Workspace Admin Help |
| Google Drive trash | Up to 30 days from initial deletion for user restoration | Google Drive Help |
| Exchange Online deleted items | 14 days default, configurable to 30 days | Microsoft Learn |
| Deleted Exchange Online mailbox | Generally 30 days after deletion, unless applicable retention or hold settings preserve it | Microsoft Learn |
| Departed user’s OneDrive (deleted user account) | 30 days default, configurable to 3,650 days, followed by 93 days in the deleted-site recovery state | Microsoft Learn |
| Unlicensed OneDrive account (license removed) | Default lifecycle: read-only after 60 days, archived after 93 days; configurable | Microsoft Learn |
| Deleted Microsoft 365 group | 30 days for standard group recovery | Microsoft Learn |
| SharePoint recycle bins | 93 days total across both stages, measured from original deletion | Microsoft Learn |
| Microsoft 365 Backup recovery points | 3 months, 6 months, 1 year, or 2 years, depending on policy | Microsoft Learn |
| IRS tax records (baseline) | 3 years | IRS |
| SEC Rule 17a-4 records | 3 or 6 years | 17 CFR 240.17a-4 |
| FINRA Rule 4511 records (no other period) | 6 years | FINRA |
| HIPAA security documentation | 6 years | 45 CFR 164.316 |
| IRS records for bad debt or worthless securities | 7 years | IRS |
SharePoint’s standard recycle-bin recovery window is 93 days total, while Microsoft 365 Backup supports recovery windows of up to two years. The 93-day recovery period for a deleted user’s OneDrive is a separate process from the unlicensed-account archiving timeline. Several regulatory obligations in the table run three years or longer.
Purview retention and Vault rules can keep the record. An auditor or opposing counsel asks whether the team can produce it, intact, for the person and period requested. CrashPlan’s guide to how long to retain Microsoft 365 data sets out a framework for deciding those retention periods.
What happens to data when an employee leaves
Offboarding can start different recovery clocks. Removing an Exchange Online license generally starts the mailbox’s grace period. For OneDrive, removing a license triggers the unlicensed-account lifecycle, while deleting the Microsoft 365 user account initiates the separate OneDrive deletion process. The obligation on that person’s mail and files stays the same after they leave.
- US employers recorded 62.8 million separations in 2025 (BLS JOLTS).
- Without an applicable hold or retention policy, removing an Exchange Online license ordinarily starts a 30-day grace period before mailbox data is permanently deleted (Microsoft Learn).
- Once the license is removed, the mailbox is no longer searchable with eDiscovery tools such as Content Search or eDiscovery (Premium) (Microsoft Learn).
- A qualifying hold applied before user account deletion can preserve the mailbox as an inactive mailbox (Microsoft Learn).
- Under the default unlicensed OneDrive lifecycle, accounts become read-only after 60 days and are archived after 93 days. Administrators can configure a different active-storage period (Microsoft Learn).
- Without billing enabled for unlicensed accounts, a OneDrive can become subject to deletion after 365 cumulative unpaid days, even if retention policies, settings, or holds exist on the account. For accounts already unlicensed on July 1, 2026, deletion risk begins no earlier than July 1, 2027 (Microsoft Learn).
- Microsoft’s own worked example prices 100 TB of archived unlicensed OneDrive storage at $5,120 a month (Microsoft Learn).
- When a Workspace admin deletes a user, retention rules and holds on that user’s data no longer apply, and the data can be expunged. Google blocks deletion of users subject to active Vault legal holds (Google Workspace Admin Help).
A properly configured mailbox hold or backup can preserve a departing employee’s data. Unlicensed OneDrive retention depends on billing and account state, while Workspace admins should archive users or transfer data before deletion when records must be preserved. The same step taken a week later depends on which window has already started. CrashPlan’s guide to employee offboarding and data security sets out offboarding security best practices and a checklist for employee offboarding.
How long data recovery takes after a breach
IT teams set a recovery time objective in advance, but the breach’s nature and severity will influence how long recovery actually takes. NIST’s earlier incident-response guidance was written when recovery “was usually completed within a day or two,” and the current revision says it often takes weeks or months. The figures below measure incident recovery or business disruption, not simply backup restoration time.
- 42% of breached organizations reported complete recovery, up from 35% (IBM, 2026).
- Among organizations that fully recovered, 19% took more than 150 days, down from 26% the year before (IBM, 2026).
- Firms lose an average of 32 hours of operational downtime for every successful attack (Hiscox Cyber Readiness Report, 2026).
- 57% of respondents said their most recent major outage cost more than $100,000 in Uptime’s 2025 survey (Uptime Institute, 2026).
- Business interruption accounts for 51% of ransomware loss costs, the largest share of any cost component (Munich Re, 2025 edition).
- 86% of the incidents Unit 42 responded to in 2024 involved business disruption (Unit 42, 2025).
- Many ransomware variants look for accessible backups and delete or encrypt them, so CISA recommends organizations to keep backups offline, and also recognizes immutable cloud storage as a way to protect backup data against tampering or deletion.
- (CISA #StopRansomware Guide).
- More than 40% of ransomware attacks now involve hybrid components, up from under 5% two years earlier (Microsoft Digital Defense Report, 2025).
- A record 86% of Coalition policyholders hit by ransomware refused to pay in 2025 (Coalition, 2026).
An incident investigation that lasts weeks can outlive a 25- or 30-day standard recovery window. The restore point from before the intrusion has to still exist when the organization is ready to recover its data. Tested backups give organizations more recovery options when responding to ransomware.
Map recovery windows against retention obligations
Use the comparison table above as the starting inventory for your own tenant, then work through four steps this quarter to close the distance between days and years.
- List the standard recovery window for each workload in your tenant, along with any separately configured backup and retention periods. Then write the longest retention obligation beside them. The gaps that matter are the rows where the obligation runs in years and available recovery copies do not cover the required period.
- Move the hold or backup step ahead of offboarding changes in your runbook. For Exchange Online, apply the appropriate hold while the mailbox is licensed, then follow Microsoft’s inactive-mailbox procedure when deleting the user account.
- Time one restore from a point older than 30 days and record the result against the recovery time objective. For moderate-impact systems, NIST calls for a functional exercise that includes recovery from backup, run at a frequency the organization sets, such as yearly (NIST SP 800-34 Rev. 1).
- Agree on the obligation list with legal or compliance once a year.
CrashPlan adds a third-party backup and recovery layer beyond native tools, protecting Microsoft 365, Google Workspace, endpoints, and servers in one platform. With centralized management, flexible storage options, and granular recovery, organizations can strengthen ransomware resilience, minimize data loss and downtime, simplify IT operations, and preserve supported data through legal hold capabilities for legal and compliance needs.
About the Author
