For a small charity, a disconnected physical drive stored away from the original device can suit a team able to rotate copies and test restores; cloud backup can suit a team with reliable internet that checks coverage, version history and account access. Combining independent local and cloud copies can address different recovery risks, but requires managing both routines. A NAS needs its own separate backup, rather than being treated as a backup simply because it stores files.
If you need to restore documents, contacts or financial records after a device or site incident, plan independent copies and test that you can restore them. The National Cyber Security Centre advises regular backups and restore tests; NCVO recommends keeping physical copies in a different location from devices holding the same data.
If your charity holds supporter, volunteer or beneficiary details, consider who can access a portable or cloud copy and how an authorised person would recover it. The Information Commissioner’s Office says encryption may be an appropriate security measure depending on the information and processing risks.
If several people depend on the same files, check what is covered, who can access it and where a separate recovery copy will be kept. Synology describes backup destinations and versions for its Hyper Backup package, which a team must configure for its own setup.
For a small charity, start with the files and recovery situations that matter most, then compare the access, storage and restore routine each option requires.
| Concern | What to check when buying | Who this matters to |
|---|---|---|
| Recovery after an incident | Check that a physical copy can be disconnected and stored elsewhere, and plan a restore test. | If losing a device, site or account could interrupt essential work, I want a copy I can actually restore. Around 33% of consumers put recovery after an incident first. |
| Personal-record protection | Assess encryption and access controls for the information, and plan how authorised staff can recover credentials. | When a backup contains personal details, I want to limit who can read or change it without blocking an authorised recovery. Around 27% of consumers prioritise protecting personal records. |
| Capacity and ongoing use | Measure files across the relevant devices and services, including the versions you want to retain; check cloud retention settings where applicable. | If our files and retained versions need to fit a sustainable arrangement, I want to size the backup against what we actually keep. Around 20% of consumers put capacity and ongoing use first. |
| Shared-team continuity | Check which file sources are covered, who has access and whether network storage has a separately configured backup destination. | When several authorised people rely on the same files, I want a recovery process the team can manage rather than a copy only one person can reach. Around 20% of consumers prioritise shared-team continuity. |
A connected copy may be affected alongside the original, while a local incident can put both copies at risk.
Plan how the copy will be disconnected and stored at a different location before choosing the drive or NAS.
A physical backup also needs a separate place to store it and time for staff to rotate or configure the copy.
Coverage and version retention depend on the service and its settings. Backblaze, for example, states that version history defaults to 30 days and that an administrator can change the business setting.
Check the service’s coverage, version settings, permissions and restore process, then test a real restore.
Encryption helps address confidentiality, but it does not create another copy or ensure that staff can restore files if credentials are unavailable.
Decide who controls the credentials and how an authorised replacement can regain access before using encrypted storage.
The Expansion Portable line is a capacity-led external-drive option for charities able to rotate physical copies and store them off-site.
IronKey Vault Privacy 50 is a portable encrypted-USB option for a smaller physical copy with controlled access.
Computer Backup offers a cloud route for covered computers where account administration and file-version recovery matter.
DiskStation models with Hyper Backup may suit teams prepared to administer network storage and a separate backup destination.
These Joybuy options are physical external storage for charities considering a local backup copy, including portable encrypted drives and higher-capacity external drives. Plan a separate, disconnected copy, store physical backups away from devices holding the same data and test that files can be restored.
No image available
A portable encrypted drive may suit a charity making a physical copy of essential or sensitive files.
The title specifies a 4 TB external portable SSD with USB Type-C and USB 3.2 Gen 2x2. Its description states AES 256-bit hardware encryption and password authentication.
No image available
A keypad USB drive may suit a charity needing a small portable copy for sensitive records, provided its capacity fits the backup set.
The description specifies 16 GB, USB Type-A, an integrated keypad, XTS-AES 256-bit hardware encryption and PIN protection, with separate administrator and user PIN options.
No image available
A desktop external drive may suit a charity measuring a larger local backup set and able to manage a separate physical copy.
The title specifies 22 TB, USB 3.0, password protection and hardware encryption. Its description also identifies backup software.
No image available
A portable external drive may suit a charity planning to carry a physical copy between storage locations.
The description specifies 4 TB, a USB 3.2 Gen 1 interface and an included USB-A cable.
No image available
A portable drive may suit a charity making a local copy of essential files, including records needing access protection.
The description specifies 2 TB storage, 256-bit AES hardware encryption, password protection and scheduled local file backups.
Not if the drive stays connected or is stored alongside that computer. Disconnect it after copying, store the physical backup in a different location and test that essential files can be restored, as NCVO and the National Cyber Security Centre advise.
Inventory essential documents, contacts, financial records and databases wherever they reside, then measure the files and decide which earlier versions you need. Test restoring representative files: a local copy does not rely on an internet connection for that restore, while a cloud restore depends on service access and connectivity.
The ICO does not prescribe one drive model in its guidance. Where a charity processes personal information, UK GDPR requires security measures appropriate to the risk; the ICO identifies encryption as one possible measure. Consider access controls and how authorised staff can recover credentials.
If the provider acts as your processor, the ICO says the controller–processor relationship needs a written contract or other legal act with required terms. Check which files and devices the service covers, version retention, account access and restoration, and assess whether a restricted international transfer occurs.
No: an accessible NAS at the same site does not meet the separate-location and disconnection conditions for a physical backup. Synology describes Hyper Backup destinations, but your charity must configure and test an independent copy.