Choose a backup arrangement around where your operational data lives and what you need to restore: managed endpoint backup can cover distributed computers, while a compatible NAS can centralise local backups. An encrypted removable drive is better treated as a deliberately disconnected secondary copy, not the only backup. If the data includes personal information, check retention, deletion, supplier terms, access and any international-transfer implications before deciding that a setup meets your organisation’s obligations.
If business documents sit on staff Windows or Mac computers, centrally managed endpoint backup may reduce reliance on each person copying files manually. Backblaze describes automatic computer backup and central administration for this use, but you still need to check what data is covered and how a replacement device would be restored.
A locally administered backup target may suit an organisation with computers, file servers or virtual machines to protect. Synology lists those workloads for Active Backup for Business on supported NAS hardware; the organisation must also maintain the hardware and protect a separate copy.
Customer or staff records bring decisions about retention, deletion, access and supplier arrangements alongside recovery. The Information Commissioner’s Office gives guidance on encryption, processor contracts and international transfers, but the appropriate setup depends on the organisation’s data and obligations.
For a small organisation protecting operational data, define what must be recovered before choosing storage. Then check coverage across devices and services, whether an incident could reach every copy, and who controls any personal information in the backups.
| Concern | What to check | Who this matters to |
|---|---|---|
| Restore scope and speed | List critical files, devices and services; establish acceptable downtime and test the restore method you would actually need. | If a failed device would interrupt invoicing, I need to know whether I can recover the required files or the whole system. Around 25% of consumers put restore scope and speed first. |
| Remote-device coverage | Confirm supported operating systems, included data and how an administrator restores a replacement computer. | When staff keep work on separate laptops, I need those devices protected without relying on manual copying. Around 25% of consumers prioritise remote-device coverage. |
| Separation from live systems | Check whether a copy can remain offline or digitally disconnected and who can change or delete backups. | If an incident reaches our live systems, I need a backup it cannot alter at the same time. Around 33% of consumers put separation first. |
| Personal-data governance | Review retention and deletion arrangements, supplier terms and data locations; identify who controls access and recovery keys. | When customer or staff records are backed up, I need the arrangement to fit our retention and supplier obligations. Around 17% of consumers put personal-data governance first. |
The National Cyber Security Centre advises keeping at least one backup offline or digitally disconnected. A managed cloud service can address distributed computers, a compatible NAS can provide a central local target, and dedicated software may be needed when critical records are held in a service such as Microsoft 365. None of these choices removes the need to test a restore or assess the particular data being protected.
The National Cyber Security Centre describes incidents in which connected USB and network-storage backups were compromised. Keeping every copy accessible through the live environment can leave recovery dependent on the same systems affected by an incident.
Plan for at least one offline or digitally disconnected copy when it is not in use, and restrict the accounts that administer cloud backups.
A folder restore, a whole-device restore and recovery of records held in an online service are different tasks. Storage alone does not establish that a chosen product supports the workload or recovery process you need.
Inventory critical data and systems, decide how much interruption is tolerable, confirm supported restore methods and perform a test restore.
The Information Commissioner’s Office identifies encryption as a way to protect stored personal information, but retention, deletion and applicable processor-contract or international-transfer requirements still need attention.
Before deployment, establish the organisation’s roles and retention requirements, then review supplier terms, access, data locations, deletion procedures and recovery-key ownership.
Backblaze says an account’s selected region determines which data centres may store its data. Moving to another region requires a new account and re-uploading the data.
Check storage-location and supplier-access requirements before onboarding data, and establish how a later move would work.
A region change can mean repeating the upload and managing the move between accounts.
A cloud endpoint-backup option for organisations protecting distributed Windows and Mac computers.
A NAS-based approach to centrally administered local backups on compatible hardware.
Backup software relevant when an organisation needs separately managed protection for Microsoft 365 data.
Encrypted removable storage that can form part of a controlled secondary-copy process.
Choose by data source and restore task rather than capacity alone. Managed endpoint backup can cover distributed computers, a compatible NAS can centralise local backups of supported systems, and a removable drive can provide a deliberately disconnected secondary copy; check coverage and test recovery before relying on any route.
No: encryption protects access to stored information but does not make a connected backup immune to deletion or an incident affecting live systems. The National Cyber Security Centre advises maintaining an offline copy; keep its recovery credentials accessible to authorised people and test that the data can be restored.
Set retention against your organisation’s documented business needs and applicable requirements, not simply a provider default. The Information Commissioner’s Office advises documenting how long each category of personal information is kept and why; include backup copies in planning what happens when that period ends.
Where your organisation acts as a controller and uses a supplier as a processor, the Information Commissioner’s Office says a written contract must bind the processor to the controller and contain the applicable Article 28 terms. Establish the parties’ roles and review the actual supplier arrangement before relying on the service.
Storage location alone does not settle whether a service is suitable. The Information Commissioner’s Office advises organisations to determine whether their arrangements involve a restricted international transfer and which requirements apply; check storage and support-access locations and any sub-processors against your organisation’s circumstances.