Choose a backup service when essential files are spread across devices or business cloud apps, provided it protects those specific files and offers a workable restore method. A separately stored external drive suits a business that can maintain and test a copying routine; combining it with online backup gives you both off-site access and a copy that is normally disconnected. Check account protection, coverage and retention before relying on either route.
If a compromised computer could alter your only backup, you need to consider a copy kept disconnected between uses. The National Cyber Security Centre advises against leaving a backup device permanently connected to the original device or its local network.
When essential work sits on several laptops, mailboxes or cloud services, list each system before choosing a service. A provider’s restore features apply to its stated workloads, not automatically to every file the business uses.
Copies containing personal information need appropriate security and retention decisions. The Information Commissioner’s Office advises businesses to document retention periods and assess supplier contracts and relevant international transfers.
Choose it when: Staff need to restore files from different locations or devices and the service covers the systems they use.
Accept the trade-off: A remote copy still needs protected accounts, controlled access and suitable restore and retention settings.
Choose it when: You can assign someone to make, store and test a removable copy that stays disconnected outside use.
Accept the trade-off: Keeping that copy current depends on a reliable routine and secure physical handling.
Choose it when: Essential files call for both an off-site recovery route and a normally disconnected copy.
Accept the trade-off: Both copies need their own schedule and restore checks; having two does not settle customer-data obligations.
For each route, start with the files and systems the business must recover, then check whether the proposed arrangement can restore them after a loss. The National Cyber Security Centre recommends testing backups rather than assuming a completed copy is usable.
| Concern | What to check when buying | Who this matters to |
|---|---|---|
| Recovery after malware or device loss | Check whether a copy can stay separate from the original system, and test a restore. | If my main computer is compromised, I need a copy it cannot routinely alter. Around 36% of consumers would put recoverability after that kind of disruption first. |
| Access across devices and services | List the laptops, mailboxes and cloud apps to protect; check coverage and restore destinations. | Work spread across devices must remain accessible if one device or location is lost. For around 29% of consumers, restoring work across those systems would be the main concern. |
| Routine backup administration | Check what is backed up automatically and who can manage or start a restore. | I cannot depend on staff remembering to copy files after every change. Around 21% of consumers would chiefly want a manageable routine that protects their working files. |
| Customer-data retention | Review retention and deletion controls alongside supplier terms for personal information. | Customer information needs a retention period and supplier arrangements I can justify. That would be the primary concern for around 14% of consumers. |
A drive permanently attached to the original device or local network may be exposed alongside it. The National Cyber Security Centre advises keeping backup devices from remaining permanently connected.
Set a backup routine, disconnect and separately store the drive outside backup or recovery sessions, and test that you can restore files from it.
Services differ in the workloads and types of restoration they offer. For example, Microsoft describes Microsoft 365 Backup for specified SharePoint, OneDrive and Exchange Online data, while Backblaze describes its Business Backup as protecting computer endpoints.
List the systems holding essential files and check the chosen service’s coverage, restore method and retention terms against that list.
Keeping more versions can affect how long backed-up customer information remains available. The Information Commissioner’s Office advises documenting retention periods that reflect business needs and legal requirements.
Set retention against that schedule, then check how the provider deletes or returns information when it is no longer needed.
Unlike a removable drive, an online backup cannot be protected simply by unplugging it. The National Cyber Security Centre recommends two-step verification for important online accounts.
Use two-step verification where available and limit which accounts and devices can change or remove backup copies.
Microsoft 365 Backup is relevant when essential records are held in supported SharePoint, OneDrive or Exchange Online workloads.
Backblaze Business Backup is an endpoint-focused option for businesses with working files on staff Macs or PCs.
Google Workspace is relevant when Drive and Gmail hold substantial operational files and email-related data.
These removable drives are options for making a local copy that can be stored separately from the main computer. Choose capacity and device connections for your files, then arrange backup software or a copying routine, disconnect the drive between uses and test a restore. An external drive does not provide the off-site access of a cloud service on its own.
No image available
A removable local-copy option for a business that can keep a backup drive separately stored. This portable external hard drive has a stated 2 TB capacity. Check that your chosen backup workflow covers the required files, and test a restore before relying on the copy.
No image available
A removable-copy option for a Mac-based business that can maintain a separate drive. This portable external hard drive has a stated 5 TB capacity; Windows use is stated to require a downloadable HFS+ driver, so check compatibility if your team uses both systems. Confirm backup coverage and test restoration.
No image available
A removable local-copy option when the business needs a stated 4 TB capacity. Check that your devices and backup workflow suit this USB-C 3.2 Gen 2x2 model. Keep the copy disconnected outside use and test that the required files can be restored.
No image available
A removable copy for working files where a stated 2 TB capacity fits the planned backup. Check device connections and the backup method for this USB-C 3.2 Gen 2x2 model. Store it separately between sessions and test a restore.
No image available
A portable local-copy option if a stated 1 TB capacity covers the files you plan to protect. Check the backup workflow and device compatibility. Password protection and encryption require software setup; confirm that the software works with your devices, then test a restore.
A cloud storage label alone does not establish that you can restore every essential file. Check the workloads covered, available restore points and restore method, then test recovery; the National Cyber Security Centre advises regular restore testing.
Not permanently if you are relying on it as a separate copy against malware. The National Cyber Security Centre advises that a backup device should not remain connected to the original device, physically or over a local network; store it separately when it is not in use.
Use two-step verification where the service supports it. The National Cyber Security Centre recommends it for important online accounts because a password alone may not protect access to the backup.
Set a period for each category of information according to the business’s needs and applicable requirements, rather than using one period for everything. The Information Commissioner’s Office advises documenting those periods in a retention schedule; check the obligations relevant to your business before configuring the service.
Check the provider’s role, security measures, contract terms and where the information will be accessible. The Information Commissioner’s Office says a controller using a processor needs a written contract, and a restricted international transfer needs an applicable transfer mechanism; whether those requirements arise depends on your data flows and provider configuration.