Google Vault and Google Workspace backup serve different purposes in protecting business data. Google Vault provides data retention, legal holds, and eDiscovery, while an independent Google Workspace backup enables recovery of Gmail and Google Drive data following accidental deletion, ransomware, or employee departure. This article explains Google’s native recovery limitations, including the 30-day Drive trash period, 25-day administrator recovery window, and 20-day deleted-user restoration window. It also examines regulatory retention requirements, compares Google Workspace and Microsoft 365 recovery capabilities, and explains how CrashPlan for Google Workspace supports automated backup, granular recovery, and long-term data resilience.
The practical consequences become clear when a routine employee offboarding is followed by an unexpected request to recover business data.
An IT team deletes a departing employee’s Google Workspace account on schedule. A month later, a manager asks for a project folder the former employee owned in My Drive. Vault can no longer search or export the former employee’s data, and the 20-day window to restore the user has closed. Nobody transferred the folder before the account was deleted, so it may be unrecoverable unless a backup or another preserved copy exists.
Google Vault and a Google Workspace backup can look like the same safeguard: both can preserve Gmail and Drive data, and both have retention settings. They serve different purposes. Vault addresses what the organization must keep and be able to produce for counsel, auditors, and investigators. A backup addresses what IT can restore, into whose Drive, and from which recovery point.
Google’s own Vault FAQ says Vault isn’t designed to be a backup tool, and the practical rule follows from it: before deleting a Workspace account, organizations should confirm that required data has been transferred or otherwise preserved and that an independent backup is available for recovery.
This article draws on primary sources— including Google’s own documentation, and research and data from Verizon, the IRS, and federal regulations—to explain how Google Vault differs from a true backup, and why that matters. It was last reviewed in October 2026.
Key statistics and details related to Google Workspace backup and retention
- Vault “isn’t designed to be a backup or archive tool” for Google Workspace data, in Google’s own words (Google Vault FAQ).
- After 30 days in Google Drive’s trash, files are automatically deleted from the trash, subject to any applicable retention policies and administrative recovery options (Google Drive Help).
- Administrators can recover deleted Drive items only within 25 days after a user empties their trash (Google Workspace Admin Help).
- Administrators can restore a deleted Google Workspace user within 20 days of deletion, although some data may already have been expunged (Google Workspace Admin Help).
- Earlier versions of files uploaded to Drive may be permanently deleted after 30 days or once 100 newer versions exist, unless a version is marked Keep forever (Google Drive Help). Google Docs, Sheets, and Slides keep version history differently.
- A custom Vault retention rule generally takes precedence over the default rule, even when the custom rule is shorter, subject to additional rules for Drive ownership and collaboration (Google Vault Help).
- 48% of breaches involved ransomware in the 2026 Data Breach Investigations Report, up from 44% the year before (Verizon, 2026).
Is Google Vault a backup tool?
Vault is Google’s retention, legal hold, and eDiscovery service, preserving supported data within Google Workspace. Its FAQ identifies several capabilities outside its scope.
- Vault exports cover a limited number of accounts and only one Google service at a time.
- Vault can’t create differential backups or deduplicate data, so when many accounts have access to the same Drive items, those items can be exported again for each account.
- Among the services Vault doesn’t support are Contacts and Keep.
- Vault doesn’t provide automated recovery tools, and restoring data from its export files can be difficult.
- For Drive exports, files aren’t separated by account, and Google Docs, Sheets, and Slides files are exported in formats different from their native Google Workspace formats.
- For protection against human error or ransomware attacks, Google notes that an organization may want a backup.
- Data whose retention period expires can be purged from Google systems when no other applicable retention rule or legal hold requires its preservation (Google Vault Help).
- Without an applicable Vault retention rule or hold, Google Workspace data remains subject to the native service’s deletion and retention behavior (Google Vault Help).
- Google’s obligation to retain data covered by Vault rules is subject to the customer’s retention period and applicable Vault license terms, with exceptions for legal holds and other legal requirements (Google Workspace Service Specific Terms). Restoring a project folder from a Vault export may require converting files and re-uploading them to the appropriate location, without a built-in automated restore workflow.
Google Drive restore windows for deleted files
Google has several native recovery paths, all of which are time-bound.
- Files in Drive’s trash are automatically removed after 30 days unless restored earlier (Google Drive Help).
- Administrators can restore deleted Drive items for 25 days after a user empties the trash (Google Workspace Admin Help).
- After the administrative recovery window closes, deleted Drive or Gmail data can’t be restored through Google’s native administrative recovery process, even with technical support (Google Workspace security whitepaper).
- Earlier versions of an uploaded file may be permanently deleted after 30 days or once 100 newer versions exist, unless a version is marked Keep forever (Google Drive Help). Google Docs, Sheets, and Slides keep version history differently.
- Google keeps its own Workspace backups for disaster recovery, and these backups aren’t available to restore data upon customer request (Google Workspace Admin Help).
- Google’s administrative Drive recovery process restores files deleted within a selected date range. Administrators can’t select individual files or folders for recovery through that process (Google Workspace Admin Help).
Native recovery depends on discovering the loss within the applicable window. A user who empties the trash on the first of the month leaves IT until approximately the 26th to hear about it and act. Vault may preserve data for search and export beyond that period, but it can’t restore it directly to the user’s Drive. An independent backup provides granular recovery from retained recovery points.
What deleting a Google Workspace user removes
For each departing employee, IT must decide whether to archive, suspend, or delete the account.
- Once a user is deleted, admins can no longer search for or export that user’s data in Vault (Google Vault FAQ).
- Retention rules and holds on a deleted user’s data no longer apply, and data can be expunged immediately (Google Vault FAQ).
- Google Workspace administrators generally can’t delete an account while its data is subject to a Vault hold. The hold must be removed before deletion, and Google also restricts transferring held data (Google Vault Help).
- Administrators can restore a deleted user within 20 days. However, data already expunged after deletion may not be recoverable (Google Workspace Admin Help).
- As a best practice, Google recommends an Archived User license to preserve a former employee’s data (Google Vault FAQ).
- Suspending an account also preserves data, though a suspended account is billed the same as an active account (Google Workspace Admin Help).
- Organizations that use Google Cloud Directory Sync should configure the tool to suspend accounts instead of deleting them (Google Vault FAQ).
- Files owned by a shared drive remain in the shared drive when a member’s account is deleted. Files owned by an individual user in My Drive require separate consideration during offboarding (Google Workspace Admin Help).
If a former employee’s project folder was stored in My Drive and wasn’t transferred before deletion, a manager’s request months later falls outside the native user recovery window. A retained independent backup can provide recovery, while Archived User licensing or suspension preserves the account and applicable Vault coverage.
Restoring Google Drive files after ransomware
Google’s ransomware detection and file restoration capabilities for Drive belong in Workspace incident response planning.
- Drive users can restore multiple files to versions from before ransomware encrypted files on their computer. Since March 30, 2026, file restoration has been generally available to all Google Workspace customers, while ransomware detection is available for specified Workspace editions using Drive for desktop (Google Workspace Updates, 2026).
- Google’s bulk file restoration works with recent file revisions, with a 25-day revision window documented for the tool. It doesn’t allow users to select individual files within the bulk restoration workflow (Google Drive Help).
- Many ransomware variants search for accessible backups and delete or encrypt them (CISA #StopRansomware Guide).
- For critical data, organizations should maintain protected backup copies, including offline backups where appropriate, and regularly test their availability and integrity (CISA #StopRansomware Guide).
Google’s bulk restore addresses recently encrypted Drive files within its supported revision window. Restoring deleted users, purged items, or older recovery points may require a separate retained copy. Because attackers can target accessible backups, that copy needs protection against unauthorized access, encryption, and deletion.
Google Workspace and Microsoft 365 retention compared
Enterprises operating both platforms face different native recovery windows depending on the workload, stage of deletion, and configured retention policies or holds.
| Loss event | Google Workspace (native) | Microsoft 365 (native) |
| User deletes a file | Drive trash: 30 days, followed by up to 25 days of administrative recovery after the item leaves trash | SharePoint and OneDrive recycle bins: up to 93 days across first- and second-stage recycle bins |
| Earlier file versions | Uploaded files: versions may be removed after 30 days or once 100 newer versions exist. Docs, Sheets, and Slides differ | SharePoint and OneDrive version history uses configurable limits. Automatic version-history management can remove selected older versions over time |
| User permanently deletes email | Gmail: administrators can recover eligible messages for up to 25 days after they leave trash | Exchange Online: items removed from Deleted Items are retained in Recoverable Items for 14 days by default, configurable up to 30 days |
| Deleted user | Google Workspace account recovery: up to 20 days, although some data may be expunged sooner | OneDrive: 30 days by default, configurable from 30 to 3,650 days, followed by a 93-day site collection recycle-bin period. Exchange Online mailboxes are generally recoverable for 30 days unless preserved by applicable retention or holds |
| Conflicting retention rules | Custom Vault rules generally override default rules, even when shorter, with service-specific exceptions | Microsoft Purview generally prioritizes retention over deletion, and the longest applicable retention period determines how long an item is retained. Additional rules determine deletion timing |
Sources: Google Drive recovery, Google Vault retention, Microsoft SharePoint recycle bin, Microsoft version history, Exchange Online deleted items, OneDrive retention and deletion, and Microsoft Purview retention.
These are native recovery behaviors, not equivalent backup retention guarantees.
Microsoft also defines separate lifecycle rules for former employees’ mailboxes and OneDrive accounts.
- An Exchange Online mailbox placed under an applicable hold or retention policy before account deletion can become an inactive mailbox, with preserved contents remaining available through supported eDiscovery and recovery processes (Microsoft Learn).
- Unlicensed OneDrive accounts follow different lifecycle paths depending on whether the Microsoft Entra ID user still exists. For existing users, read-only mode begins after 60 days and archiving after 93 days by default. Deleted-user accounts follow separate retention and recycle-bin rules. Since July 2026, unpaid unlicensed accounts are also subject to a cumulative 365-day nonpayment limit; retention policies and holds don’t remove applicable payment requirements (Microsoft Learn).
- Microsoft recommends evaluating Microsoft 365 Backup or a recognized partner solution built on the Microsoft 365 Backup Storage platform (Microsoft Learn).
Neither platform has uniformly longer recovery windows. IT teams need workload-specific recovery plans that account for native limits, retention settings, and required recovery points, with independent backup available when native tools can’t restore the necessary data. For hybrid environments, a third-party backup that covers both Google Workspace and Microsoft 365 can bring consistency to coverage and restore workflows.
Records retention requirements and Google Workspace restore windows
Records schedules are set by regulation, organizational policy, and legal counsel. They often run in years, compared with recovery windows measured in days for certain Google Workspace deletion scenarios.
- As a general baseline, the IRS advises businesses to keep many tax records for three years, with longer periods applying in some circumstances (IRS).
- Employment tax records must be kept for at least four years after the tax becomes due or is paid, whichever is later (IRS).
- Under SEC Rule 17a-4, broker-dealers must keep certain books and records, such as specified blotters and ledgers, for at least six years. Certain business-related communications, including applicable email correspondence, must be kept for at least three years. In both cases, the records must be readily accessible during the first two years (17 CFR 240.17a-4). Electronic recordkeeping systems must also satisfy applicable preservation requirements, including the rule’s WORM or audit-trail options (SEC guidance).
- HIPAA’s Security Rule requires regulated entities to retain specified security policies, procedures, and related documentation for six years from creation or the date the documentation was last in effect, whichever is later (HHS). This requirement doesn’t establish a universal six-year retention period for all healthcare records.
Vault can preserve supported records under appropriate retention rules and licensing, but deleting a user account ends Vault access to data associated with that user.
An independent backup can support operational recovery once native restore windows close. Backup retention alone doesn’t establish regulatory compliance. Organizations must also meet applicable requirements for record integrity, accessibility, audit trails, legal holds, and production of records.
Google Workspace offboarding backup checklist
Settle both retention and recovery requirements for each departing employee before the account is deleted. Before deleting accounts, confirm the following for each one:
- Required files in the employee’s My Drive have been transferred to the appropriate owner or shared drive, where permitted.
- A successful backup of the account’s required Drive and Gmail data exists outside Google Workspace, with the necessary recovery points available.
- The backup’s retention follows the organization’s applicable records and recovery policies.
- IT has verified that the required data can be restored from the backup.
- The former employee’s manager knows where to request a restore.
- Any applicable Vault retention rules or legal holds have been reviewed before deletion.
- Where Vault coverage must continue for legal or regulatory reasons, the account is preserved using an appropriate license, such as the Archived User license Google recommends, rather than deleted.
Record each check in the offboarding ticket so the audit trail shows it happened.
What CrashPlan Offers
CrashPlan for Google Workspace provides automated, incremental backup for Gmail and Google Drive, with configurable retention, granular search, and point-in-time recovery from available backup versions. Data successfully backed up before an account is suspended or deleted can remain available for recovery as long as the organization retains the required versions under its policies. IT can restore data to its original location or another supported location, while self-service recovery lets employees retrieve their protected emails and files without routing every request through IT. The solution is part of CrashPlan’s enterprise data resilience platform for Microsoft 365, Google Workspace, endpoints, and servers.
Google Vault preserves supported data for retention and discovery under applicable policies. CrashPlan provides a separate, cloud-based recovery copy that helps organizations restore critical data and keep work moving forward.
About the Author
