Choose backup storage according to where essential data lives and what you need to restore: endpoint cloud backup can serve staff computers, while a multi-user cloud workspace addresses shared-file access but needs its own recovery checks. Removable storage can provide a disconnected copy, and a NAS can provide central local storage if you configure a separate backup destination. For any route, confirm the data covered, earlier-version retention and access controls, then test a restore before relying on it.
If losing invoices, customer details, email or documents would interrupt work, prioritise a copy you can restore rather than simply more file space. The National Cyber Security Centre identifies these kinds of information in its guidance for small organisations.
When several staff members use the same documents, check named accounts, administrator roles and what happens to access when someone leaves. Google Workspace documents differentiated roles for Shared Drives; recovery coverage needs a separate check.
A removable copy may matter when internet access is unreliable or files need to be kept separately from the working device. The National Cyber Security Centre advises secure storage, disconnection when the device is not in use and regular checks that backups work.
Decide which files and services must be recoverable, then compare routes on restoration, access and the practical work of maintaining a separate copy.
Consider it when: staff need copies of files held on separate Mac or Windows computers.
Check: the plan’s device and folder coverage, deleted-file retention and restore process.
Consider it when: staff need controlled access to shared operational documents.
Check: collaboration permissions do not, by themselves, establish independent backup coverage for email, endpoints or other systems.
Consider it when: you need a local copy that can be disconnected between backup runs.
Allow for: secure storage and a routine for making and testing copies.
Consider it when: several people need central local storage and someone can manage its configuration.
Remember: the NAS needs a separate backup destination; the device alone is not an off-site copy.
| Concern | What to check | Who this matters to |
|---|---|---|
| Recoverability | Confirm which data and earlier versions can be restored, how long they remain available and how to run a test restore. | If I discover a deleted or damaged file late, I need a usable earlier copy rather than a record that a backup job ran. About 36% of consumers put recoverability first. |
| Shared access | Check named-user roles and administrator controls, including access changes when staff leave. | When colleagues share operational documents, I need to control who can use them as responsibilities change; for about 22% of consumers, that is the primary concern. |
| Capacity and retention | Measure the data to protect and check capacity limits and the available version-retention period. | As our files grow, I need enough room for the required copies and a recovery window that covers delayed discoveries. Capacity and retention come first for about 21% of consumers. |
| Local and offline copies | Check the connection needed, secure storage arrangements and whether the copy can stay disconnected between uses. | If connectivity is unreliable or I want a copy separate from the working computer, local access and disconnection matter most. About 21% of consumers prioritise that need. |
A deletion or overwrite can affect the current copy. Recovery depends on whether a suitable earlier version is covered and still within its retention period.
Check backup coverage and previous-version recovery for each service, then restore a test file. The National Cyber Security Centre recommends regularly testing backups.
The National Cyber Security Centre warns that malware affecting a computer can also affect connected storage.
Set a documented backup routine, disconnect the device when it is not in use and store it securely. Consider a separate off-site copy as well.
Space for today’s files does not establish how long changed or deleted files will remain recoverable. Version history depends on the service and its settings.
List the devices and services to protect, allow for data growth and check the retention window and restoration steps before choosing storage.
Encryption or a provider’s compliance statement does not determine how an organisation should control access to personal data, retain it or arrange recovery.
For a UK organisation handling personal data, use Information Commissioner’s Office guidance to assess the actual arrangement. Document retention and, where a provider acts as a processor, put the required written contract in place.
Microsoft 365 Backup is a route to consider for organisations protecting supported Microsoft 365 workloads.
Shared Drives address team access to files through named members and differentiated roles.
Its NAS software may suit an organisation prepared to manage local storage and configured backup jobs.
Its business computer-backup offering focuses on files held on Mac and Windows endpoints.
These products cover central local storage through a diskless NAS and removable copies through external SSDs or a USB flash drive. Choose a backup routine and test recovery separately from choosing the device.
Image unavailable
Consider this for central local storage if your organisation can install drives and manage its backup setup.
The two-bay unit is diskless, so check drive compatibility and the resulting usable capacity before buying. Configure a separate backup destination, confirm version retention and test a restore.
Image unavailable
This removable SSD can hold a separate local copy for an organisation whose protected files fit its stated capacity.
Its listing specifies 1 TB and USB Type-C connectivity. Decide how backups will be made, keep the drive disconnected when it is not in use and test restoration.
Image unavailable
Consider this removable drive when you need a local copy and want the listed password-security feature for stored files.
The listing describes 1 TB capacity, AES 256-bit hardware encryption and USB-C-to-C and USB-C-to-A cables. Check that capacity covers future copies, establish a backup routine and test a restore.
Image unavailable
This compact removable option is worth considering for selected business files if they fit within its stated capacity.
The listing describes USB-A and Type-C interfaces, AES-256 encryption and fingerprint access. Check the amount of data to protect, establish how copies will be made and test recovery.
No. Check which files and services are covered, whether earlier versions remain recoverable and how a restore works. Microsoft Learn documents distinct Microsoft 365 Backup restoration capabilities for OneDrive, SharePoint and Exchange; that does not establish coverage for every business system.
Test regularly, on a schedule that reflects how quickly essential files change and how much interruption the organisation can tolerate. The National Cyber Security Centre advises regular daily or weekly copies of essential information and regular checks that a backup works, rather than one testing interval for every organisation.
Disconnect it when it is not in use. The National Cyber Security Centre warns that viruses can also affect storage connected to an infected computer; store the drive securely and test that its copy can be restored.
No product feature alone establishes UK GDPR compliance. For personal data, the Information Commissioner’s Office advises assessing security and restoration arrangements and documenting retention; where a provider processes that data on the organisation’s behalf, the controller must have a written processor contract.
Check where personal data can be accessed, who processes it and whether the arrangement creates a restricted transfer under UK GDPR. The Information Commissioner’s Office explains that overseas access can raise transfer questions; the answer depends on the actual organisations and arrangement, not the storage product’s name.