Choose a removable drive when you need a local copy that staff can disconnect and store separately; consider a cloud backup service when you need an off-site route for covered devices. Using both can reduce reliance on either one, but only if you check device and file coverage, access controls, version retention and a test restore. A drive left connected or an ordinary synchronised cloud folder should not be assumed to be an offline backup.
You need important operating files recoverable if a workplace device and a nearby copy are both affected. Compare a separately stored removable copy with protected cloud backup, or consider how the two routes could work together. The National Cyber Security Centre and Information Commissioner's Office provide guidance on backup separation and storage security.
You handle customer or other personal information and need to consider encryption, authorised access, credential recovery and retention when choosing a drive or service. The Information Commissioner's Office advises organisations to consider security measures in light of their processing risks.
You need to establish what is backed up from Windows laptops, Macs and mobile devices rather than assume one drive or desktop backup application covers them all. Microsoft and Apple describe different backup and file-transfer workflows across their platforms.
For UK small organisations, the National Cyber Security Centre and Information Commissioner's Office highlight the importance of separate copies, secure storage and a workable recovery process. Decide what must be restored and how the copy will be protected before comparing capacity or interfaces.
| Concern | What to check when buying | Who this matters to |
|---|---|---|
| Separate recovery copy | Where each copy is stored; when a drive is disconnected; cloud access and version controls; whether a test restore works. | If I need a copy that is less exposed to an incident affecting the workplace or connected devices, I will check how it is separated and restored. Around 33% of consumers prioritise having a separate recovery copy. |
| Confidentiality and access | Whether encryption is available and enabled; who holds recovery credentials; whether authorised staff can restore files. | When backups contain customer or other sensitive records, I need to restrict access without locking out the people responsible for recovery. Around 27% of consumers put sensitive-record protection first. |
| Device coverage | Which computers, folders and phones are covered; required formats, ports, cables or apps; how each workflow restores files. | If my team uses more than one operating system or backs up phones as well as laptops, I need to check each device's actual backup route. Around 20% of consumers prioritise mixed-device coverage. |
| Capacity and local restore | Current data volume and retained versions; usable destination space; connection requirements and a trial restore. | When I need room for backup history and a practical local restore, I will check the planned capacity and test representative files. Around 20% of consumers prioritise local capacity and restoration. |
A cloud location that remains accessible may be affected alongside live files, just as a connected USB drive can be. Physical distance alone does not make a copy digitally separate.
Check who can modify or delete cloud copies, whether earlier versions can be restored and whether at least one planned copy is genuinely disconnected from the live environment.
A separate backup configuration and restore testing may take additional staff time.
A Windows-formatted disk cannot be used unchanged for Time Machine, and Seagate says its Expansion drives do not include backup software. A drive being recognised by a computer does not mean the intended backup is configured.
Check the exact drive's format and ports, configure the operating system's backup tool, then restore a test file. Reformatting can erase existing contents.
An unsuitable connector or missing software can add setup work.
Encryption can restrict access, but losing the password or recovery key can also prevent an authorised restore. Kingston describes access and recovery options for its IronKey Vault Privacy 50 series; the organisation still needs a workable credential process.
Document who can unlock each backup, how credentials are retained and how another authorised person would test a restore.
Credential administration and maintaining a separate recovery copy require staff time.
Backblaze says that with its default 30-day version history, data from an external drive disconnected for more than 30 days may be removed from that backup.
If using Backblaze with removable drives, check the selected version-history setting against the drive-rotation schedule.
The Expansion portable HDD line is relevant when you want removable local storage for backups.
The Portable SSD T7 line is relevant when carrying a backup drive or transferring large files affects your choice.
IronKey Vault Privacy 50 removable USB storage is relevant for smaller sensitive-file sets where managed access matters.
Business Computer Backup is a cloud-route example for organisations backing up Windows and Mac endpoints.
These Joybuy choices cover removable backup storage: portable SSDs, external hard drives and encrypted USB storage. They do not represent cloud backup services, so compare them with your chosen backup workflow and recovery requirements.
No image available
A portable local-drive option when you need a removable destination for backup files.
4 TB; USB Type-C; USB 3.2 Gen 2. The listing says encryption needs to be set up using Samsung software; do not assume it is enabled by default.
No image available
A portable local-copy option when you may need to carry the drive between locations.
1 TB; USB 3.2 Gen 2. The listing says encryption needs to be set up using Samsung software and that IP65 protection does not permit submersion.
No image available
A portable HDD option when the planned backup files and retained versions fit the listed capacity.
5 TB; USB 3.0. The listing describes use with Windows without additional software installation.
No image available
A portable local-drive option when scheduled backups suit the organisation's workflow.
2 TB. The listing describes scheduled backup software and AES 256-bit hardware encryption with password protection; check setup and credential recovery before relying on these features.
No image available
A smaller-capacity removable option when you need to carry a selected set of sensitive files between compatible devices.
256 GB; USB-A and Type-C interfaces; the product name states fingerprint encryption and read/write speeds of 550/500 MB/s. Check that the capacity and interfaces suit the files and devices you intend to use.
No: do not treat a drive as an offline copy while it remains connected. The National Cyber Security Centre advises disconnecting storage when it is not in use, and the Information Commissioner's Office advises keeping external storage separate from the main workplace, encrypting it and checking that it works.
No: a shared connector does not establish that one backup workflow covers every device. Microsoft describes Windows File History using a selected external or network destination; Apple says Time Machine cannot use a Windows-formatted disk unchanged. Apple also documents separate iPhone file-transfer and computer-backup methods, so check the process for each device and operating system.
The Information Commissioner's Office says UK GDPR requires appropriate technical and organisational security measures, but does not specifically mandate encryption of all personal information. The ICO advises considering encryption in light of processing risks and specifically recommends encrypting external backup storage; keep the credentials needed for authorised restoration.
The Information Commissioner's Office says there is no universal retention period in data protection law: keep personal information only as long as needed for its purpose and justify the period. Check whether the backup service's version history and deletion controls can implement the organisation's retention policy and any other applicable record-keeping requirements.
If the provider processes personal information for your organisation, assess the applicable controller–processor contract, security, access and retention terms. If the arrangement involves a restricted international transfer, assess the relevant UK transfer rules rather than assuming that UK-only hosting is always required or that any overseas arrangement is permitted.