A method, system and computer program product for data backup based on a workload behavior includes a first computer identifying, using machine learning tools, data associated with frequently accessed files on the first computer by a workload being processed by a second computer. The first computer processes the identified data associated with the frequently accessed files to generate a list of frequently accessed files by the workload, and compares the list of frequently accessed files to backup policy rules active on the first computer. Based on the comparison, the first computer identifies a mismatch between the list of frequently accessed files and the backup policy rules, and specifies a new backup rule to update the backup policy rules for each identified mismatch between the list of frequently accessed files and the backup policy rules.