Does Google back up Google Workspace? The gaps in native recovery

Does Google back up your Google Workspace data?

Google replicates Workspace across its infrastructure to keep the service available, but it doesn't keep restore points for you. Protecting and recovering your content is your responsibility.

Here's how it usually surfaces. A project manager clears out an old shared folder in March. In May, legal asks for a contract that was in it. Trash emptied after 30 days, the admin restore window closed 25 days later, and the file no longer exists anywhere. Nobody did anything unusual, which is why we treat Workspace as part of your backup as a service plan, not a platform that backs itself up.

Google's own Workspace for Education data protection implementation guide sets out the split: "Google protects the infrastructure underlying Google Workspace", while the customer is "responsible for the security of components that you provide or control, such as the content you put in" the services. The same model applies to business editions. Availability is Google's job. Recoverability is yours.

How long can you recover deleted Gmail and Drive data?

Between 20 and 55 days, depending on what was deleted and how. After that, Google permanently removes the data from its systems.

Google's help page on restoring permanently deleted email says admins "have an additional 25 days to restore messages", starting 30 days after deletion. For Drive, the admin recovery guide sets the same 25-day limit after a user empties their trash, and notes that a restore recovers everything deleted in the selected date range, not individual files. The page on restoring a deleted user is the starkest: "After 20 days, the data is gone and you can't restore it."

Is Google Vault a backup for Google Workspace?

No. Vault is a retention and eDiscovery tool for legal holds, searches and exports. It can't restore a mailbox, a Drive or an account to an earlier state.

Google's Vault help centre states plainly that "Vault isn't a data archive". It also warns: "If you delete a user or a required license, their data may be irreversibly purged and no longer available to Vault." That last point catches many organisations during offboarding, when licences are removed to save money.

Vault is still worth having for legal holds. But retrieving one email for a dispute is a different job from bringing back 40,000 files after a sync client overwrites them. For that, you need point-in-time restore.

Which scenarios fall through the native gaps?

Anything discovered late, anything tied to a deleted account, and anything done by someone holding valid admin credentials.

Compromised accounts deserve special attention. Session token theft and MFA fatigue attacks hand attackers real credentials, as we explain in when MFA fails, backup is your last line. And if Google itself has an outage, you'll want a copy you can reach elsewhere; see what happens when a SaaS provider goes down.

Why does it matter where a Google Workspace backup is stored?

Because a backup is a second copy of your personal data, and the law applies to it as much as to the original. For EU organisations, storing it with an EU operator under EU law keeps that copy simpler to justify.

GDPR Article 32(1)(c) requires "the ability to restore the availability and access to personal data in a timely manner", and Article 28 requires a processor agreement with whoever stores that copy. For organisations in scope of NIS2, Article 21(2)(c) of Directive (EU) 2022/2555 lists "business continuity, such as backup management and disaster recovery" among the required measures. Auditors will ask for evidence, not intentions.

A backup held by another US provider adds a copy without adding independence from US jurisdiction. Our article on data sovereignty explains the difference between where data sits and who controls it.

How do you close the Google Workspace backup gaps?

Match your recovery capability to your obligations, not to Google's defaults. Five steps cover most organisations.

1. Write down your retention needs. Contracts, financial records and HR files often have to be kept for years. Compare that with a 20 to 55 day native window.
2. Add an independent backup. Check exactly which data types any solution covers, for example Gmail, Drive, shared drives, Calendar and Contacts, and get it in writing.
3. Make the copy immutable and EU-hosted. The backup should sit outside your Google tenant, under credentials a compromised Workspace admin can't use.
4. Change your offboarding. Confirm a leaver's data is in the backup before you delete the account or remove the licence.
5. Test restores. Restore a mailbox and a folder each quarter and keep the record.

Mindtime backup for Google Workspace covers Gmail, Drive, Calendar and Contacts. Copies are stored only in our own Tier III data centres in the Netherlands and Germany, immutable with Object Lock plus an air-gapped copy, with every backup job checked automatically and granular restore. Every contract includes a GDPR Data Processing Agreement, and support is personal, in Dutch, German and English.

What to do next

Google Workspace is excellent at staying online. Its recovery tools are built for recent mistakes, not for a file found missing in an audit, a leaver deleted last quarter or an admin account in the wrong hands. Closing that gap takes an independent, immutable backup in the EU and a habit of testing it.

Start by checking two things: how your offboarding handles licences, and when someone last restored Workspace data from outside Google. Then see how Workspace fits into your backup as a service plan alongside your other systems.

Book a free 15-minute demo and we'll show you a Gmail and Drive restore from our Dutch and German data centres.

This article is information, not legal advice.