For essential home-business files, cloud backup offers an off-device copy when internet access is dependable; a removable drive gives you a local copy that should be disconnected between backups. Using both reduces dependence on one device or connection, but neither route replaces checking that you can restore the files and earlier versions you need. The National Cyber Security Centre also cautions that backups are not ransomware-resistant by default.
If current documents, invoices or contacts become unusable, you need a way to restore a workable copy. Check recovery steps, earlier versions and whether another copy remains separate from the main computer. The National Cyber Security Centre advises small organisations to back up essential data.
If uploads or downloads cannot be relied on, keep a secure removable or local copy alongside any cloud backup. The National Cyber Security Centre advises external storage where a reliable internet connection is unavailable.
If copies contain customer or employee information, assess security against the processing risk and check how promptly you could restore access. The Information Commissioner's Office also advises reviewing supplier responsibilities and potential international data flows where relevant.
Choose where recoverable copies will live, then decide how backups will run and how you will test a restore. Automatic software can help maintain either a cloud or local route; it is not a substitute for a separate copy.
Consider it when: Your connection is reliable and you need an off-device copy of changing files.
Trade-off: Uploads and many restores depend on connectivity, while recovery options and version retention depend on the service.
Consider it when: Internet access is unreliable or you need a locally held recovery copy.
Trade-off: You must complete the backups, disconnect the drive afterwards and protect it from loss or damage.
Consider it when: Losing access to essential files would interrupt work and you need more than one recovery route.
Trade-off: Both copies need a workable schedule and occasional restore checks so that neither becomes stale.
| Concern | What to check | Who this matters to |
|---|---|---|
| Restoring essential work | Check file-level and earlier-version recovery; if you need to rebuild a computer, check full-device restore requirements. Test a representative restore. | If a device fails or files are corrupted, I need a usable copy before work can resume. Around 30% of consumers put recovery of essential work first. |
| Connectivity and separation | Check whether uploads can resume after an interruption, the drive's usable capacity and where a disconnected copy will be kept. | When my connection is unreliable, I cannot depend on a cloud restore alone and want a copy away from the live computer. For around 30% of consumers, that independence is the primary concern. |
| Personal-data protection | If backups contain personal data, assess security and account access controls; where a supplier processes it on your behalf, review its processor terms. | With customer or employee information in my backups, I need to understand who can access it and how it can be recovered. Around 20% of consumers place those responsibilities first. |
| Keeping backups current | Check what automatic backups include, how failures are reported and how long earlier versions remain available. | If I am likely to miss manual copies, I need backups to run routinely without losing the option to recover an older file. That is the leading need for around 20% of consumers. |
The National Cyber Security Centre warns that viruses can affect storage attached to an infected device. A permanently connected drive may be exposed during the same incident as the computer.
Disconnect removable media when a backup finishes, store it securely and keep another separate copy of essential files.
The National Cyber Security Centre says cloud and on-premises backups are not ransomware-resistant by default. Earlier recovery points may be at risk if an account or backup controls are compromised.
Check prior-version recovery, protection against deletion or alteration, account access controls, alerts and retention before relying on a service.
Storage space alone does not tell you whether you can retrieve a deleted file, an earlier version or a whole computer. Backblaze, for example, documents a default version history of 30 days for its computer-backup service, with longer-history options.
Compare what is backed up, how long versions remain available and whether the restore method covers the incident you need to prepare for.
If a cloud supplier processes personal data on your behalf, its marketing does not establish that the arrangement meets your responsibilities. The Information Commissioner's Office says a controller using a processor needs a written contract or other legal act.
Review the processing terms, security measures, sub-processors, data return or deletion terms and any relevant international-transfer arrangements.
A cloud computer-backup service to consider when automatic off-device copying and file history matter.
Backup and cyber-protection software for businesses considering configurable storage and recovery points.
A local NAS and backup-software route for businesses prepared to manage their own storage.
A configurable backup platform for businesses with the technical capacity or support to manage its storage setup.
A separate removable copy is worth considering for essential files, particularly if internet access is unreliable or you need another recovery route. The National Cyber Security Centre advises disconnecting storage devices when they are not in use; keep the drive secure and check that both copies can be restored.
No: the National Cyber Security Centre says cloud backups are not ransomware-resistant by default. Check whether earlier versions and recovery points are protected against unauthorised changes or deletion, and how long they remain recoverable.
Assess security against the risk to the personal data and make sure the arrangement supports timely restoration. The Information Commissioner's Office says that, where a supplier processes personal data on your behalf, a written controller–processor contract or other legal act is required; review its processing and security terms before choosing the service.
Its location alone does not settle the question. If personal data may be transferred outside the UK, map the actual data flow and check the Information Commissioner's Office guidance on whether the arrangement is a restricted transfer and what safeguards may be needed.
Set a documented test schedule around how often essential files change and how long your business could manage without them. Restore a representative file, and test any full-device recovery route you intend to rely on; the Information Commissioner's Office advises testing the effectiveness of security measures where personal data is involved.