Choose a small-business backup by how you will recover files, not by storage capacity alone. A removable drive can provide a disconnected copy, a network-attached storage device (NAS) can centralise local backups, and a managed cloud service can automate off-site copies for distributed devices. Whichever route you use, keep a copy separate from live systems, protect access to it and test that essential files can be restored.
If customer records, invoices, documents or email are essential to the business, define what must be backed up and practise restoring it. The National Cyber Security Centre advises small businesses to back up essential information regularly and test that backups work.
Several office computers can use a shared local backup destination, but a NAS needs access controls, upkeep and another copy elsewhere. Synology's backup guidance warns that drive failure or a RAID failure can still cause data loss.
Businesses with laptops in different locations may prefer automated off-site copies and central administration. If a provider processes personal information for the business, check its contract, account-recovery arrangements and relevant data flows before committing.
For work files that may include personal information, decide what must be recoverable and how quickly, then choose a destination that will remain accessible if the live system fails. The National Cyber Security Centre advises keeping removable backup storage disconnected when it is not in use and testing backups regularly.
Consider it when: One or a few computers need a local copy that someone can disconnect and store separately.
Trade-off: Its protection depends on a reliable copying, disconnection and storage routine.
Consider it when: Several office devices need a central local backup destination.
Trade-off: It needs administration and a separate backup destination; multiple disks alone do not provide that separation.
Consider it when: Devices are spread across locations and automated off-site copies matter.
Trade-off: Recovery depends on the service, account access and internet arrangements, while retention and provider terms need review.
| Concern | What to check | Who this matters to |
|---|---|---|
| Restoring essential work | Which files and systems are covered; whether older versions can be restored; how to run a restore test. | If an invoice or customer file disappears, I need to know I can retrieve a usable copy without disrupting current work. Around 31% of consumers would put proven recovery first. |
| Separation from live systems | Whether a copy can be disconnected or kept at another destination; who can alter or delete backups. | When a computer or account is compromised, I do not want the same access to put every backup at risk. Roughly 31% of consumers would make separation their primary concern. |
| Central local backup | How many devices can be backed up; model-specific versioning and access controls; the destination for a second copy. | With files across several office computers, I want a shared local place to back them up and recover them. Around 23% of consumers would prioritise that central arrangement. |
| Automated off-site copies | Device coverage, account recovery and retention; provider terms and data flows if personal information is involved. | When laptops move between locations, I need backups to run without someone rotating a drive at the office. About 15% of consumers would put off-site automation first. |
Malicious software affecting a computer may also affect connected storage, according to the National Cyber Security Centre.
Set a routine for copying files, disconnecting the drive and storing it securely when it is not needed.
A NAS is useful as a local destination, but Synology warns that RAID and drive failures can still cause data loss. A problem affecting the NAS may also affect copies stored only on it.
Keep another copy at a separate destination and test restoration from that copy.
Broad administrative access can undermine a backup if someone can change retention settings or erase restore points.
Check administrator roles, multi-factor authentication, deletion controls and any supported immutable-retention option before choosing a service.
Where a provider processes personal data for a business acting as controller, the Information Commissioner's Office explains that UK GDPR processor-contract requirements apply. International-transfer rules depend on the actual organisations and data flows involved.
Identify the provider entities, processing terms, data locations and access arrangements; seek tailored advice if the business cannot determine which obligations apply.
A NAS and backup-software route for businesses considering a central local destination.
A NAS route for comparing shared local storage with a managed backup service.
A managed backup route for businesses assessing central administration and protected restore points.
A managed cloud-backup route for considering off-site copies of business devices.
A managed cloud-backup route for smaller teams comparing off-site services.
These removable drives and one NAS address local-copy or central local-backup needs. Plan how each would produce a separate, restorable copy; the products shown do not replace a decision about off-site backup or a managed cloud service.
No image available
Consider this removable drive for a local copy from a computer that can be disconnected and stored separately. Its stated capacity is 2TB; check the backup software's version-retention and restore options before depending on it for recovery.
No image available
This 5TB removable drive is a local-copy option for a Mac-based workflow. Check compatibility with every computer that needs access, confirm the applicable warranty and test the intended restore routine.
No image available
Consider this removable storage for a local copy that can be kept apart from the working device. The listed connection is USB 3.2 Gen 2x2; check the host port, backup scheduling and version-retention requirements for the intended workflow.
No image available
Consider this NAS when several office devices need a central local destination. Confirm compatible drives, what the bundle includes and usable capacity; arrange another backup destination and test restores from it.
No image available
This 1TB removable drive could hold a separate local copy if its capacity fits the files being protected. Before storing personal information on it, confirm the encryption and password-protection arrangements, then plan how copies will be made and restored.
No: the Information Commissioner's Office says UK GDPR does not specifically require encryption of all personal information. Security measures must be appropriate to the risk, and the ICO advises using encryption to protect personal information on computing devices and removable media.
Yes, where the business acts as controller and the provider processes personal data as its processor, UK GDPR Article 28(3) requires a written contract or other legal act. The Information Commissioner's Office sets out required details of the processing and processor terms; check the provider's agreement against the actual service arrangement.
It may be possible, but the business must assess the actual transfer. The Information Commissioner's Office says a restricted transfer depends on whether UK GDPR applies, the business initiates a transfer to an organisation outside the UK and the recipient is a separate legal entity; a restricted transfer must be covered by UK adequacy regulations, appropriate safeguards or an applicable exception. Check provider entities, support access and data flows.
No: local storage or disk redundancy alone does not provide a separate recovery copy. Synology warns that RAID and drive failures can still cause data loss; back up the NAS to another destination and test a restore from there.
Test restores regularly, using a schedule that reflects how much data loss and downtime the business can tolerate. The National Cyber Security Centre advises regular backups of essential information and regular checks that they work; include representative critical files or systems in the test.