The small business backup guide: protect your data properly

The short answer

A proper small business backup follows the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy kept somewhere else entirely (usually the cloud). It should run automatically, without anyone needing to remember to do it, and it should be tested occasionally by actually restoring a file, not just trusted to be working because no error appeared. Most small businesses that lose data badly aren't missing a backup; they have one that silently stopped working months earlier.

Why backups matter more than people expect

Data loss doesn't only come from a dramatic event like theft or fire. The far more common causes are mundane: a laptop fails, a file gets overwritten or accidentally deleted, an update goes wrong, or ransomware encrypts a shared drive. Any of these can wipe out invoices, customer records, years of correspondence or work in progress within minutes. For a small business, that's not just inconvenient, it can stop you trading until it's resolved, and some of it may never come back if there's no working backup underneath it.

The 3-2-1 rule, explained simply

• Three copies of your data. The working copy you use day to day, plus two backups. One backup is better than none, but a single backup can itself fail.
• Two different types of storage. For example, an external drive and a cloud backup, rather than two copies sitting on the same type of storage, which tend to fail in similar ways.
• One copy somewhere else entirely. If your backup lives in the same building as your main computer, a fire, flood or theft can take out both at once. A cloud backup, or a drive physically kept elsewhere, protects against that.

This doesn't need to be complicated or expensive to follow properly. For most small businesses, it means: your everyday files, a cloud backup service running automatically, and either a second cloud copy or an occasional offline copy kept elsewhere.

Where backups commonly go wrong

"We thought it was backing up"

Backup software that silently stops working, perhaps after a password change, a storage limit being reached, or an update breaking a connection, is one of the most common causes of a "we had a backup" surprise. Backups need checking occasionally, not just setting up once and forgotten.

Relying on sync instead of backup

Tools like OneDrive, Google Drive and Dropbox sync files between devices, which is useful, but it isn't the same as a backup. If a file is deleted or corrupted, sync tools often happily sync that deletion or corruption everywhere too. Proper backup services keep historical versions you can roll back to, which sync alone usually doesn't guarantee for long.

Backing up the device, not the business

A backup of one laptop misses anything stored in cloud services, shared drives, or other people's devices. A proper backup plan covers everywhere your business's actual data lives, not just the computer that's easiest to plug a drive into.

No backup for email

Email often holds years of contracts, invoices and conversations that would be painful to lose, yet it's frequently left out of backup planning because it "lives in the cloud already". Most email providers have limited retention for deleted items, so a proper backup of your mailbox is worth including specifically.

A simple backup checklist

• Do you know, right now, where your backups actually are?
• Do backups run automatically, without anyone needing to remember?
• Is at least one copy stored somewhere physically separate from your main location?
• Does your backup cover email, shared drives and cloud services, not just one laptop?
• Have you actually tried restoring a file from backup in the last few months, rather than assuming it works?
• Would you know who to call if your main system failed today?

Backups and security work together

Backups are part of a wider security picture, not a replacement for it. Multi-factor authentication, careful password practices and keeping devices updated all reduce how often you need to rely on a backup in the first place, and a good backup is what saves you when prevention fails anyway, for example after a ransomware attack that encrypts your working files. Our guide on a cyber security checklist for small businesses covers that wider picture, including Cyber Essentials. If IT problems in general keep interrupting your work, our solution for IT headaches looks at the broader fix, and our example of a physio clinic setting up secure Microsoft 365 and patient data properly shows what a properly secured setup tends to look like alongside backup.

What proper backup setup costs

Most backup setup is a one-off piece of work: choosing the right service for how your business stores data, setting it to run automatically across your devices and cloud services, and testing that a restore actually works. Guide prices for a security and backup check, including setting this up properly, start from around £400, with ongoing IT support available from around £75 a month if you'd rather have someone checking it periodically rather than relying on a "set and forget" assumption; see pricing for the full range.

If you'd rather not do this yourself

We'll check what's actually being backed up today, fix the gaps, and set it running automatically across your devices, email and cloud services, then confirm a real restore actually works. Have a look at our IT support and security service, or tell us what you're currently relying on and we'll take a look on a free call.