Choose a backup arrangement around the files you must restore, where staff work and who can manage the process: a rotated portable drive provides a separately stored copy, a NAS gives several devices a local destination, and a cloud service provides an off-site route. A hybrid arrangement can combine local recovery with location separation, but every route needs a recoverable copy protected from the risks affecting live files; a NAS or drive kept only at the main workplace does not provide that separation.
If theft, damage or destructive activity could interrupt essential work, the priority is a copy that can be restored even when the main workspace or live files are unavailable. The Information Commissioner’s Office advises keeping an external backup device away from the main workplace.
When files are used at the office, at home and on mobile devices, the decision turns on which devices and folders are protected and how staff would retrieve priority files if the office were unavailable.
Backups containing customer or employee information need security and retention arrangements suited to that data. Information Commissioner’s Office guidance highlights appropriate protection for stored personal information and timely restoration.
Start with the files and devices that need protection, then decide how quickly they must be restored and where an independent copy will live.
Consider it when: One person can make backups, disconnect the drive and keep it securely away from the workplace; choose an encrypted removable option when the contents and risks call for it.
Trade-off: The business must manage rotation, physical security, passwords where used and restore tests.
Consider it when: Several devices need a central local backup destination and someone can manage the networked equipment.
Trade-off: A NAS at the main workplace still needs a separately protected off-site copy.
Consider it when: Files spread across working locations need an off-site service and the plan covers the required devices and accounts.
Trade-off: The business must configure and monitor recovery and security controls; the National Cyber Security Centre says cloud backups are not ransomware-resistant by default.
Consider it when: The business wants a local restore route as well as a separately protected copy outside its premises.
Trade-off: Two destinations mean more setup, monitoring and restore-testing work.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recoverability and separation | Can you restore priority files from a copy separate from live data and the main workplace? Test the restore against your acceptable downtime. | If my working files are lost or damaged, I need an independent copy that actually opens. Roughly 33% of consumers put recoverability and separation first. |
| Coverage across locations | Check the required devices, folders and cloud applications, and how staff can start a restore when the office is unavailable. | Files change wherever my team works, so I need those working locations covered. Around 27% of consumers make cross-location coverage their primary concern. |
| Personal-data security | Check encryption setup, authorised recovery access and controls for retained versions and deletion. | When backups hold personal information, I need to protect the copy without losing the ability to recover it. Approximately 20% of consumers prioritise this security and retention need. |
| Local capacity and control | Size the protected data and retained versions, then establish who will maintain and rotate the local equipment. | I can manage local hardware, but it must hold the copies I intend to keep and fit the work involved. About 20% of consumers put local capacity and control first. |
A copy still connected to live files can be affected by destructive activity; one kept at the same workplace can be lost in the same site incident.
Keep at least one recoverable copy separate from live data and away from the main workplace, then test that you can restore it. The Information Commissioner’s Office advises both checking backups and separating an external device from the workplace.
A drive’s stated capacity alone does not account for the files selected, growth and the versions you plan to retain.
List priority devices, folders and other file locations before checking usable capacity and retention settings for the exact hardware or service plan.
Growth or longer version retention can mean expanding the storage arrangement later.
Encryption features may need setup and a managed password. Seagate, for example, says its One Touch with Password security requires Toolkit setup.
Check the exact product’s setup procedure, enable the protection you intend to use and arrange authorised recovery access separately from the device.
The National Cyber Security Centre says neither cloud nor on-premises backups are ransomware-resistant by default.
Check the actual plan’s version restoration, deletion and alteration protections, alerts and administrator controls, then test the recovery path.
A NAS option for teams considering a central local destination.
Removable storage for a business able to rotate backup media securely.
Desktop external storage for a locally managed backup route.
A business backup service to assess when integrated data-protection features are relevant.
A managed off-site service route for businesses assessing backup coverage.
These portable drives and a diskless NAS are local destinations to consider within an off-site backup plan. A portable drive needs a managed disconnection and storage routine; a NAS at the main workplace needs another protected copy elsewhere.
No image available
A portable choice if someone can disconnect the backup and keep it away from the main workplace.
2TB capacity. If the copy will contain personal information, check the encryption setup and how authorised staff would regain access.
No image available
Consider this portable drive when a managed off-site rotation suits the business and the intended computers can use the Mac variant.
5TB capacity. Confirm compatibility, recovery access and the applicable warranty before purchase; test a restore before relying on the drive.
No image available
A portable destination for a backup routine in which someone disconnects the drive and stores it elsewhere.
4TB capacity; the product name specifies USB 3.0. Check formatting for the computers you will use, along with any encryption or automated-backup requirements.
No image available
This portable capacity is worth assessing for a smaller protected file set if the business can rotate a copy away from the workplace.
1TB capacity. Allow for growth and retained versions, check formatting for the intended computers and establish whether the required security features are available.
No image available
A network-attached storage option to assess when several devices need a central local destination and the business can manage its setup.
Two-bay, diskless configuration: choose compatible storage drives and check usable capacity, device coverage and restore behaviour. Add a separately protected off-site route.
No, not when the aim is recovery after the main workplace becomes unavailable. The Information Commissioner’s Office advises keeping an external backup device away from that workplace; use a NAS as a local destination alongside an independently protected off-site copy.
Restore priority files and check how long the process takes, including whether staff can use it when the normal workplace or live system is unavailable. The Information Commissioner’s Office advises checking backups and says security measures should support timely restoration of personal data.
No. The National Cyber Security Centre says cloud and on-premises backups are not ransomware-resistant by default. Check the service plan’s protection against deletion or alteration, available earlier versions, alerts and administrator controls, then test a restore.
Assess it against the information stored and the risks of loss or unauthorised access. The Information Commissioner’s Office advises security appropriate to the processing risk and identifies encryption as protection for personal information on backup media; check that any chosen encryption is enabled and that authorised staff can recover the data.
Set retention according to the business purpose and applicable legal requirements rather than leaving copies in place without a plan. The Information Commissioner’s Office advises documenting retention periods and what happens to personal information afterwards, such as deletion, archiving or anonymisation.