Choose backup storage by what your small business needs to recover, not by capacity alone: cloud services can support shared access, a disconnected external drive can provide a separate copy, and a NAS can centralise local backups if someone can manage it. The National Cyber Security Centre advises considering both online and external storage; whichever arrangement you choose, protect access and test restoration. If your business is a controller using a provider to process personal data, the Information Commissioner's Office says a written contract or other legal act is required.
If staff need shared files away from one office PC, consider how a cloud service manages permissions, administrator access and earlier file versions. Reliable internet access still matters, and synchronised files should not be assumed to cover every recovery need.
If ransomware, device loss or hardware failure could interrupt access to customer records, prioritise a copy that cannot readily be deleted or overwritten through the primary device. The National Cyber Security Centre also recommends protecting backup administration; test whether the files can actually be restored.
If internet access is unreliable or several devices hold work files, removable storage or a managed on-premises system may be worth considering. Account for physical security, who maintains the backups and whether another copy will remain available if the local equipment is affected.
For a small business protecting customer records and work files, establish what must be restored and how quickly before comparing storage capacity. Then decide who needs access and whether a separate copy can be kept beyond the primary device or account.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recoverability | Check which earlier versions or deleted files can be restored, who can remove backups and how a full restore will be tested. | If ransomware, deletion or device failure interrupts work, I need a usable earlier copy rather than only the latest file. Around 33% of consumers put recoverability first. |
| Shared access | Check named-user permissions, administrator roles, two-step verification and access from the devices staff use. | When colleagues work away from the original PC, I need them to reach shared files without giving everyone unrestricted control. Controlled access is the primary need for around 27% of consumers. |
| Local management | Identify the PCs or servers to protect, calculate data volume and growth, and check hardware compatibility and administration needs. | With several local devices or unreliable connectivity, I need a manageable place for their backups. Around 20% of consumers prioritise local capacity and central management. |
| Removable copies | Define the essential files, a repeatable backup schedule and secure storage for a device that can be disconnected. | If I only need to copy a defined set of essential files, I want a device I can secure between backups. That practical removable-copy need comes first for around 20% of consumers. |
A synchronised cloud file can also reflect an unwanted change or deletion. Recovery depends on the service's actual version history, retention and protection against destructive actions.
Before relying on synchronisation as your only backup, check which folders are covered and practise restoring an earlier version and a deleted file.
The National Cyber Security Centre warns that malware on an infected computer can also affect connected storage devices. A removable drive provides separation only when its handling supports that purpose.
Set a backup routine, disconnect the drive when it is not needed, and store it securely.
Enough space for today's files does not establish whether the business can retrieve the right historic version or resume work in time.
List the data sources, how much recent work the business can afford to lose, the required recovery time and how long earlier copies must remain available.
If a compromised account can also change or delete backup data, a separate copy may offer less protection than expected. The National Cyber Security Centre recommends separate administrator credentials for on-premises backups.
Restrict backup administration, use separate credentials where practical and review access to destructive actions.
Relevant when a business already works with Windows and Microsoft 365, but its folder-sync and dedicated backup services cover different data.
Relevant when shared files and business-account administration centre on Google Drive, Gmail and Workspace.
Relevant to teams considering managed file sharing and recovery of previous file versions within Dropbox for Teams.
Relevant to businesses assessing a centrally managed NAS backup system for supported computers and servers.
These external drives are options for a removable local copy; the diskless NAS is hardware for a centrally managed local setup. For either route, decide how files will be backed up, kept separate and restored before choosing a device.
No image available
Consider this portable drive for a removable copy of a defined set of work files. Its stated capacity is 2TB; check the backup schedule, earlier-version recovery and restore procedure needed for your files. Disconnect and secure it between backups.
No image available
Consider this removable drive if its 5TB stated capacity fits the files you intend to copy. Check host and file-system compatibility for the intended computers, as well as the recovery procedure and applicable warranty terms. Store the drive securely when disconnected.
No image available
This removable device may suit a defined set of local files if 4 TB meets the required capacity. The title specifies USB 3.2 Gen 2x2; check the host connection and establish backup scheduling and restoration separately. Keep the device secure and disconnected when it is not in use.
No image available
This removable device is an option for a defined file set if its stated 2 TB capacity is sufficient. The title specifies USB 3.2 Gen 2x2; confirm the intended host connection, then set a backup and restore routine. A disconnected copy still needs secure storage.
No image available
Consider this NAS if the business can manage a local backup system rather than just a removable device. It is a two-bay diskless model, so choose compatible drives and establish usable capacity for the intended configuration. Confirm compatibility with the backup software you plan to use, restrict administration and maintain another isolated or off-site copy.
It can be part of the arrangement, but do not rely on cloud storage alone without checking what can be restored after deletion, an unwanted change or account compromise. The National Cyber Security Centre advises considering online storage alongside an external storage device and protecting cloud backups from destructive actions.
Yes, the National Cyber Security Centre identifies both as backup routes, including where reliable internet access is unavailable. Define which files are copied, store the device securely and disconnect it when it is not needed; a connected device may also be affected by malware on the computer.
Set the backup interval by how much recent work your business can afford to lose, then test that the required files can be restored within the time you need. The Information Commissioner's Office says measures for personal data should enable timely restoration after an incident and that their effectiveness should be tested.
Where the business is a controller and the provider processes personal data on its behalf, the Information Commissioner's Office says a written contract or other legal act is required. Check the provider's role and terms for processing, security, sub-processors, assistance, end-of-contract handling and audits in relation to your particular data.
The Information Commissioner's Office describes risk-based security measures rather than a universal encryption rule for every backup; encryption and/or pseudonymisation should be considered where appropriate. For customer-related information, assess encryption alongside account permissions, physical security and the ability to restore access.