My business is not a backup service for any client.
All clients should be backing up the files they've received on their own. It's not my responsibility to be an indefinite backup service for any client, ever.
Clients are not paying a regular fee to maintain equipment, upgrade hard drives, purchase additional hard drives as needed, maintaining software, etc. Therefore clients are NOT compensating me for backing up their files. Clients have no claims to any of my company's backups. I maintain backups for my business just as they should be doing for their business. If I were running a backup service, there would be a monthly subscription fee and contracts in place for such a service. To expect my business to retain old items your business may need in the future is ludicrous.
Let me be clear... I have backups for my business since, well, prior to even its inception. I think I have files more than 30-35 years old. Chances are very high that should I need a file from 10-20-30 years ago I have it. Whether or not I can open it (i.e. Pagemaker, Freehand, Quark, Dimensions, etc) may be another matter, but I'll probably have the files.
The difference here is what the client may be requesting...
Essentially my backups are there to support my customer relations and ease my own workflow, but my backups are never free storage for clients to retrieve files at a later date merely because the client asks for them.
It's somewhat unprofessional for a client to be asking for "source files" without compensating you for those files. Here, source files always cost money. It's also a bit "unprofessional" for your client to not be backing up their own files and relying on some unrelated business to maintain their important digital content.
It's not unprofessional for you to fail to have a 2 year old backup of their files if they haven't been a client in two years. In fact, it's often normal to not have files for older clients. And even if you do have them, you are not obligated to provide them. It's your backup, not theirs.
My backup procedures....
There are no real rules regarding this. In general, I keep files as long as I'm still working with a client or until it becomes inconvenient to maintain them.
I maintain a triple redundant current backup at all times which encompasses all relatively active clients in addition to all client branding, custom illustration, high resolution images, etc.
The triple redundancy and incremental backup system allows me to remove a file or several files from my primary working directory with the knowledge that the file I've removed is already backed up in at least 2 other locations. This tends to keep my primary working directory at a reasonable size. I'll often remove .zip archives or client supplied files, or previous, unapproved/rejected, iterations of a project - basically the superfluous stuff that wouldn't be needed in the future anyway. Again, I remove these files but I know they also exist in a minimum of 2 other locations. So I'm really only pruning the SOURCE directory, not the backups. Individual project directories here can easily surpass 10s or 100s of GB at times. So some consideration to overall backup size is kind of imperative. Anything I can do to ensure important files are kept while reducing the total amount of MB/GB/TB needed for the backup is a good thing. If all I had were 50-100MB web site HTML/PHP/CSS files and web images, then I'd probably keep absolutely everything.
I tend to rebuild my backups entirely every 4-6 years. What I do is disconnect one of the backup RAIDs and store it (safe deposit box). Reformat the other backup RAID, add a new backup RAID and backup everything starting fresh from that date. With this method nothing is actual ever disposed of, but older files are no longer part of a redundant backup. If the only location of a particular clients file(s) is on that single archived hard drive in the safe deposit box, and that RAID happens to fail, well, I've lost those project files. So any projects older than 4-6 years may or may not have had their files removed, lost, or destroyed due to corruption.
Since implementing all of this roughly 15 years ago I've not lost a single file. Not one. Sure, it may take me the better part of a week to restore things from various backup RAIDs, but the important thing is I still have everything.
Charge if you are going to dig for it.....
The hard reality is anything more than 3/6 months or possibly 1/2 years old should be considered gone by the client, even if I do happen to still have the files. I would certainly charge an hourly fee to check to see if I still have their files and the time it takes to retrieve anything I may have, all associated with a minimum fee. That in addition to any delivery fee for the files. Clients who fail to maintain their own backups are liable for the expenses associated with losing their files.
Unless a client is paying me for storage, I'm not responsible for backing anything up for them. I'll stress again, that if the client wants to hire me to update to an old project, I have no issue diving into my backups to retrieve the old project (saving the client money possibly). I really only have issue with using my backup merely to be a source for file delivery because some other business failed to maintain their own backup.
The sneaky clients......
Also be aware... some haphazard or perhaps nefarious or unethical clients can use time passage as a method of getting around your standard practices. It's not always malicious in nature, but it can be. Client knows full well that you charge a fee for project files. They don't want to pay that fee when you complete the project initially. No problem. You deliver what the contract states you are to deliver, client pays you and everyone moves on happy.
Some time later, usually a year or more, the client may return asking for project files as if "they've lost them" or "they were mistakenly destroyed" pretending like they were delivered initially as part of the project. This is done in the hopes you may fail to remember specifics. Be cautious of this practice. Like I posted its not always malicious in nature, sometimes clients honestly forget you charge for project files. However, it can also be very intentional and thought out to try and circumvent payment while getting the files. I've encountered both over the years.
Tl;dr:
My backups are for my business, They are mine. My backups are not for the clients business and the client has no "right" to my backups without compensation. Clients are entirely 100% responsible for their own backups.