Keep a usable local copy of financial records alongside a separate off-site copy, with at least one backup disconnected when it is not being updated. The National Cyber Security Centre warns that ransomware can affect connected backup drives as well as the original files. An external hard drive can hold a local archive, a portable SSD is compact, and encrypted USB storage can hold selected sensitive files; cloud storage adds off-site access, but account security and file-recovery limits still need checking.
If statements, receipts and PDFs support a Self Assessment return, the copies need to stay readable and recoverable for the applicable retention period. HM Revenue & Customs sets different record-keeping conditions according to the tax circumstances.
Scanning documents frees space, but a folder on one laptop remains vulnerable to device failure or loss. The National Cyber Security Centre advises keeping a backup offline so an incident affecting the everyday computer does not reach every copy.
A small set of financial documents may need to travel on removable storage or be kept apart from the main computer. Encryption and a workable password-recovery plan both matter if that device is lost or access fails; the Information Commissioner's Office explains the protective role of encryption for stored personal information.
Decide how copies will survive a device or home-level incident before choosing a drive. Then check whether the storage method fits the amount of material, the devices used and the routine you can maintain.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recovering files after a failure | Check that a copy can be stored away from the computer and that you can restore an earlier or deleted file where the service offers that option. | If my laptop or a drive fails, I need statements and scans that I can still retrieve from another place. About 31% of consumers put recovery across separate copies first. |
| Keeping portable files private | Check the encryption method and how access and recovery work if a password or PIN is forgotten. | When I carry a copy of sensitive documents, I want someone who finds the device to be unable to open them. For about 25% of consumers, preventing unauthorised access is the primary need. |
| Maintaining cloud-account access | Check two-step verification, account-recovery details and private sharing settings. | If my off-site files depend on an online account, I need to retain control of that account and a way back in. Continued access is the first concern for about 25% of consumers. |
| Keeping backups up to date | Check device compatibility and whether you can update the backup and restore a test file as part of a regular routine. | A backup I forget to update will miss newer documents, so I need a process I can keep using. A maintainable routine comes first for about 19% of consumers. |
The National Cyber Security Centre has seen ransomware affect original files and connected USB or network backup drives in the same incident.
Keep at least one copy disconnected when it is not being updated, and avoid having every backup destination attached at once.
Synchronisation can copy unwanted changes. Microsoft Support says deleted files in personal OneDrive accounts can be restored within 30 days; Google Drive Help says files stay in Trash for 30 days before permanent deletion.
Check the chosen account's version and deletion-recovery terms, and retain another independent copy of long-term records.
Encryption protects stored information from unauthorised access, but the owner also needs the correct password or recovery method. Kingston Technology says its IronKey Locker+ 50 can lock a user out or erase data after repeated incorrect password entries.
Check the access rules for the exact device, keep recovery information separately and do not put the only copy of important documents on an encrypted drive.
A completed transfer does not show that every document is legible or can be restored. Records supporting a tax return also need to remain available for the applicable HM Revenue & Customs retention period.
Use clear filenames and folders, and periodically restore and open a document rather than checking only that a backup ran.
Its portable SSD range is relevant when a compact local copy is easier to store or carry.
Its encrypted USB products offer device-level access controls for selected files stored apart from a main computer.
Its external drives are a reference point for directly attached local archives.
This cloud-storage service is relevant when copies need to be available from more than one device.
These drives provide local storage options for a household document archive or a smaller separate set of files. Whichever format fits your routine, keep another independent copy in a different location.
No image available
Consider this for a local archive of household statements and scans if 2TB fits the files you plan to retain. Check the setup needed for your computer and how you will protect access to sensitive documents; keep a separate copy elsewhere.
No image available
A compact local-drive option if you move an archive between devices. The product name specifies USB Type-C 3.2 Gen 2; check the connection and password setup for the devices you use, and retain another independent copy.
No image available
Consider this AES-256 encrypted USB drive for a selected set of sensitive files that fits within 16GB, rather than an entire household archive. Check how access is restored after a forgotten PIN and what happens after incorrect attempts; keep another copy.
No image available
This compact option has USB-A and Type-C connections for moving a selected file set between suitably equipped devices. Its name describes fingerprint encryption; check fallback access and reset behaviour before relying on it, and keep an independent copy.
No image available
Consider this USB 3.0 external drive if your local archive needs 4TB of storage. Check formatting and compatibility with your computer, choose appropriate protection for sensitive files and store another copy separately.
For a personal Self Assessment return sent on or before the deadline, HM Revenue & Customs says to keep the supporting records for at least 22 months after the end of the tax year the return covers. Other filing circumstances and self-employed business records can have different requirements, so check the rule that applies to your records.
Do not rely on a single synced folder as your only copy: unwanted changes or deletions may synchronise too. Check the service's version and deletion-recovery options, secure the account and keep an independent copy.
Encryption is a useful protection when a laptop or removable drive containing sensitive records could be lost or stolen, as the Information Commissioner's Office explains in its storage-security guidance. Plan how you will retain access to the password or recovery method; encryption does not replace a backup.
Use a unique strong password, enable two-step verification where available and review both sharing settings and account-recovery details. The National Cyber Security Centre recommends two-step verification for important accounts; protect the email account used for recovery as well.
Update it as often as needed to capture newly added records, then periodically restore a non-sensitive test file and open it. This checks more than whether a transfer finished: it also shows whether you can use the necessary account, device and password.