Choose a backup route around where essential data lives and how quickly each business process needs to return. Endpoint cloud backup can suit staff PCs and Macs, Microsoft 365 Backup is specific to supported Microsoft 365 workloads, and separately stored removable media or NAS can add a local recovery copy; for important records, a hybrid arrangement avoids relying on one connected copy, but still needs tested restores, controlled administrator access and documented retention.
Suitable where invoices, contacts, documents and email-related files sit across a small number of employee PCs or Macs and need a recoverable copy after loss, theft, hardware failure or malware. The National Cyber Security Centre highlights these operational data types in its small-organisation guidance.
For teams whose essential records are mainly held in Exchange Online, OneDrive and SharePoint and need workload-specific backup and restoration rather than a device-only approach. Microsoft describes restore options for these Microsoft 365 workloads.
For offices that need an offline or locally held copy because internet reliability is limited, recovery should not rely on one cloud account, or shared files need local storage. Separation and restore testing remain important.
Start by mapping essential records and where they are stored, then match the backup route to recovery, retention and access-control requirements.
| Priority | What to check | Your needs |
|---|---|---|
| Recovery coverage | List where contacts, invoices, documents, email and shared files are held. Check that the chosen service or device covers each location, supports earlier restore points where needed, and allows a representative restore test. | I need the files and services that keep work moving to be recoverable after disruption, not simply a copy of one computer. |
| Protection from deletion | Use separate backup administration credentials and MFA for destructive actions. For removable media, disconnect and store it separately; for cloud services, check version recovery and documented deletion controls. | I do not want one compromised everyday account or connected device to reach every recovery copy. |
| Retention and personal data | Calculate capacity for protected data, growth, backup frequency and version history. Set and review retention by data type, and check the processor contract when a supplier handles personal data. | I need backup history that supports recovery without keeping staff, customer or contact data longer than necessary. The ICO says retention must be justifiable. |
| Access and supplier location | Check role-based access, separate accounts, MFA and the provider’s processing and support locations. Review transfer documentation if a separate organisation outside the UK can access personal data. | I need authorised staff to restore data without giving unnecessary access to backup contents or administration settings. |
A lost, failed or infected device can leave an organisation without a usable copy, and ransomware may target backups and infrastructure. The National Cyber Security Centre notes that cloud and on-premises backups are not ransomware-resistant by default.
Map essential systems and storage locations, then maintain at least one separately protected recovery copy. Disconnect removable media when it is not being written to, and restrict administration of NAS or cloud backup systems.
Storage sized only for today’s live files may not allow for historical versions, growth or a full recovery copy. Retention also matters when backups contain personal data.
Plan capacity around current protected data, expected growth, backup frequency, version history and required retention. Document why each category of personal data is retained and review the schedule.
The organisation remains responsible for assessing appropriate security. Where a backup supplier acts as a processor, the ICO requires a written contract; access by an organisation outside the UK can also require a restricted-transfer assessment.
Review the provider contract, sub-processors, security controls, end-of-contract data handling, administrator access and processing or support locations before procurement.
Quoted SSD speeds can depend on a compatible host, cable and interface. A fast portable drive remains vulnerable if it is the only copy or stays connected to a compromised computer.
Check the computer’s USB capability, included cable and backup-software compatibility. Use transfer speed as one planning input, retain a separate backup location and test an actual restore.
Microsoft 365 Backup is a workload-specific route for organisations using Exchange Online, OneDrive and SharePoint within a Microsoft 365 tenant.
Backblaze Business Backup is an endpoint-cloud-backup option for organisations seeking centrally managed protection for Mac and Windows computers.
Samsung Portable SSD T7 is a removable-storage component for an offline or separately stored backup rotation, rather than a complete backup arrangement by itself.
Joybuy product options for local NAS and separately stored external backup copies within a small-organisation backup arrangement.
No image available
For a small office that needs centralised storage for shared operational files and a local backup destination.
Stated features include granular access controls, audit logs, automated backups and snapshots. Check installed drives, RAID configuration, backup destination, restore procedures and administrator safeguards; retain a separate offline or offsite copy.
No image available
For rotating a portable, separately stored copy of documents and operational files between locations.
2TB capacity, USB 3.2 Gen 1, USB bus power and scheduled local backups through Acronis software are stated. The listing states Windows 10+ compatibility and macOS 11+ use with a downloadable driver; check device compatibility and capacity for retained versions.
No image available
A compact option for a disconnected additional copy moved between compatible PCs and Macs.
Stated specifications include 1TB capacity, USB 3.2 Gen 2 Type-C connectivity, IP65 protection and drop resistance. Confirm host USB capability, backup scheduling, retention, encryption setup and restore workflow before deployment.
No image available
For a fixed office location that needs a higher-capacity local backup or archive copy.
The drive has stated 12TB capacity, USB 3.2 Gen 1 connectivity, an external power supply and a USB cable. It is pre-formatted for Windows, so macOS use requires reformatting; set a backup process and maintain a second protected copy.
No image available
Best suited to a portable additional copy for supported phone media alongside laptop transfers, rather than a general office backup system.
Stated features include 1TB storage, USB 3.2 Gen 2x2 connectivity and IP65 protection. The Lexar App auto-backup is for media and does not support iCloud backup; check document coverage, host compatibility and restoration procedures.
There is no single UK GDPR backup-retention period. The organisation should justify how long personal data is retained for its purposes, use standard retention periods where appropriate, review data periodically, and erase or anonymise it when it is no longer needed; separate legal or contractual duties may require different retention for business records.
Yes, where the organisation is a controller and the backup supplier processes personal data on its behalf as a processor. The ICO says a written contract or other legal act is required and should cover processing details, security, sub-processors, assistance, end-of-contract handling and audits or inspections.
Not necessarily, but the organisation must assess the arrangement. The ICO explains that making personal data accessible to a separate organisation outside the UK can be a restricted transfer, so check processing locations, support access and transfer documentation before signing.
Test restores regularly and match the interval to how quickly essential processes must resume and how often their data changes. The National Cyber Security Centre advises daily or weekly copies of essential information and regular testing that a backup can restore it.
No. An external SSD can be a useful separately stored copy, particularly where cloud-only backup is unsuitable, but it should not be the only recovery copy. Keep it secure and disconnected when not in use because connected devices can be affected by malware.