Choose backup storage according to how your organisation would recover its data: cloud backup suits reliable connections and dispersed computers, while a removable device provides an offline route when the connection is unreliable. A combined arrangement can provide an independent copy, but either route needs a workable restoration process. For customer information, assess access and retention controls and, if using a cloud supplier, its data-processing arrangements.
If documents, invoices, emails or contacts are needed to keep working, check how they would be restored after deletion, device loss or ransomware. The National Cyber Security Centre advises keeping an independent copy of critical data rather than relying only on a working service.
Backups of customer records need appropriate access, security and retention decisions. If a cloud supplier processes personal data on the organisation’s behalf, the Information Commissioner’s Office also calls for a written controller–processor contract.
When the connection cannot reliably support online backup and recovery, an external storage device offers a local route. The National Cyber Security Centre advises disconnecting removable backup media when it is not in use.
Start with the files and systems you must restore and the time your organisation can manage without them. Then decide whether connectivity, customer-data protection or the number of devices makes cloud backup, disconnected storage, centrally managed network-attached storage (NAS), or a combination more practical.
| Concern | What to check | Who this matters to |
|---|---|---|
| Restoration | Check which files and systems are covered, how to restore them, and whether earlier versions remain available for the retention period you choose. | If work stops after a deletion or device failure, I need to know that the required records can actually be restored. Around 36% of consumers put recoverability and restoration testing first. |
| Customer-data protection | Review who can access or delete backups, whether encryption fits the risk, and the processing and transfer arrangements of any cloud supplier. | When customer records are involved, I need authorised colleagues to retrieve them without leaving the backup open to inappropriate access. For around 29% of consumers, protecting and governing that information is the primary concern. |
| Connectivity and independence | Check whether uploads and restores work with your connection; for removable media, plan disconnection and separate, secure storage. | An unreliable connection could leave me waiting when I need a copy, so I want a backup I can hold locally. Around 21% of consumers prioritise an internet-resilient, independent copy. |
| Managing multiple systems | Identify the devices and shared folders to cover, then check supported endpoints, monitoring and the need for another independent copy. | If several staff devices need protection, I need to see which backups ran and who can restore them. Central management is the leading need for around 14% of consumers. |
The National Cyber Security Centre recommends external storage where internet access is unreliable and an independent copy for critical data. NAS can centralise backup tasks, but the Centre’s guidance on ransomware-resistant backups makes clear that a store on the same network is not isolated simply because it is a separate device. Encrypted portable storage addresses a different question—access to the media—and can be used alongside a drive, NAS or cloud arrangement rather than replacing the need to plan recovery.
Previous versions and deleted-file recovery may be time-limited. The National Cyber Security Centre advises organisations to keep an independent copy of critical data even when they use a cloud service.
Check how to export and restore essential files, how long recoverable versions remain, and where the independent copy will be kept.
A device left attached to the working computer can be affected by malware. The National Cyber Security Centre advises against keeping a backup device permanently connected.
Connect it for the backup, then safely disconnect it and store it securely.
Encryption does not replace decisions about authorised users, retention and restoration. The Information Commissioner’s Office describes encryption as a measure to assess against the risk, not a requirement for every item of personal information.
Decide who controls the PIN or recovery credentials, restrict access and test a restore by an authorised person.
If recovery credentials are lost, an otherwise intact backup may be inaccessible.
The National Cyber Security Centre’s ransomware guidance addresses how attackers may reach or destroy backups through accounts and network access; using a separate service or box does not settle that risk.
Review separate backup administration, access restrictions, protection against deletion and an additional independent copy.
Synology’s Active Backup for Business is a NAS-based option for centralising backup of compatible computers and other supported systems.
Backblaze offers cloud backup for business computers, including Mac and Windows endpoints.
Kingston’s DataTraveler 2000 illustrates a keypad-protected removable option for a limited offline copy of sensitive files.
These products are removable storage options for a local copy or selected files. Choose capacity and connection for your actual devices and data, then set a backup schedule, test restoration and disconnect the device when it is not in use; the storage device alone does not establish that process.
No image available
A removable local-copy option when an online connection is unreliable or an independent copy is needed.
Check that 2 TB accommodates the files and retained copies you plan to keep, and confirm compatibility and restoration steps with your devices.
No image available
Consider this removable-copy option if your selected data and retention plan call for 4 TB of listed capacity.
Check the USB Type-C connection against your devices and establish how backups will be scheduled and restored.
No image available
This is a removable-copy option for a plan that fits within its listed 2 TB capacity.
Check the USB Type-C connection against your devices, and plan backup frequency, retained copies and restoration before relying on it.
No image available
Consider it for an offline copy of selected files rather than assuming 256 GB will accommodate the organisation’s full dataset.
The title specifies a USB 3.2 Gen 1 and Type-C dual interface. Check device compatibility and how an authorised person would regain access and restore the files.
No image available
This removable-copy option is worth considering if the selected files and retention plan fit within its listed 1 TB capacity.
Confirm USB Type-C compatibility and assess any encryption requirement separately; also establish the backup and restore procedure.
Use a removable device when internet access is not reliable enough for the backup route you need, as the National Cyber Security Centre advises. Keep it secure and disconnect it when it is not being used for backup; decide separately whether an online copy would also help your recovery plan.
No: storing or syncing files in a cloud service does not by itself establish an independent, restorable copy. The National Cyber Security Centre advises checking that essential data can be exported and restored, rather than relying solely on version history or deleted-file recovery.
Test them often enough to confirm that your organisation can restore the data it needs. The Information Commissioner’s Office advises periodic review and testing of continuity plans; assign responsibility and repeat a restore test when the systems or recovery requirements change.
No. The Information Commissioner’s Office states that UK GDPR does not specifically require encryption of all personal information; choose appropriate security measures for the circumstances and risk. Portable media and the way credentials are managed should form part of that assessment.
Check the supplier’s access and recovery arrangements and how it processes the customer data. The Information Commissioner’s Office says a written controller–processor contract is required when a supplier processes personal data on your behalf; assess any access or transfer to a separate organisation outside the UK against the applicable international-transfer rules.