Mike Ounsworth answered this to an extent, but I will chime in here.
What are your requirements for backups? Do you need to follow any regulatory controls that have specifics? For example, HIPAA/HITECH had specific mandates for 2 years. If so, that is your final answer regardless of what anyone here can tell you.
As for full backups, is there a requirement for a full backup versus a differential? These are questions only your organization, and information technology/executives can answer, not anyone here. All we can do is speculate.
If I were unsure, it would mean I didn't have proper guidance, and my role wasn't clear. If this were the case, I would look at my industry to see what others are doing, and again, look to any regulatory requirements, as they have the final say.