Choose a managed cloud or SaaS-specific backup service when staff work across devices and need central administration or remote recovery; choose an external drive or NAS when a local recovery copy, offline storage or on-site control matters more. A layered arrangement can combine routes: identify essential data, keep separate copies, protect online accounts with two-step verification and test restores regularly, as advised by the National Cyber Security Centre.
For organisations using Microsoft 365 or Google Workspace for documents, mail and customer records, where centrally managed backup and a defined restoration window may suit the workflow better than relying on individual staff accounts. Microsoft Learn and Google Workspace describe workload-specific recovery controls.
For teams with essential files on local PCs, a file server or an office network, particularly where internet reliability is limited or a local external drive or NAS could provide access to a recovery copy. The National Cyber Security Centre advises regular backup copies and restore testing.
For small organisations whose backups contain personal information and need to assess processor terms, access controls and applicable international-transfer arrangements before choosing a cloud provider. The Information Commissioner’s Office covers these responsibilities for UK organisations.
Start with the data that would interrupt operations if it disappeared, then assess recovery, separation, account control and the ongoing workload of the route you choose.
| Priority | What to check | Your needs |
|---|---|---|
| Recoverability | Match backup frequency to the maximum acceptable loss of work; check granular and full restore options; run periodic restore tests. | I need to know where essential data is held, how often it is copied and whether a usable restore can be completed. National Cyber Security Centre guidance recommends regular copies and restore testing. |
| Separate copies | Keep copies on separate routes; consider a securely stored offline or disconnected copy for critical data; set versioning or protected retention where appropriate. | I do not want the only backup to remain on the same computer or storage path as the original data, especially if device failure or destructive account access would disrupt work. |
| Shared access | Check administrator roles and delegated restore permissions; enable two-step verification for backup accounts; review processor terms where personal information is involved. | I need designated staff to restore data without giving every user unrestricted access, and I need to understand who processes or can access customer information. |
| Cost and administration | Compare per-device, per-user or usage-based charges with hardware, replacement-drive, off-site-copy and staff-management requirements; confirm retention and restore terms. | I need a route whose recurring charges and maintenance work fit the organisation, rather than choosing solely by advertised storage capacity. |
A large drive or cloud quota does not show that essential email, shared files, contacts or documents can be restored when needed. The National Cyber Security Centre recommends regularly testing that backups work.
List critical data and its locations, then test a representative restore before treating the route as operational backup.
Malware or destructive account access can affect accessible backup copies. National Cyber Security Centre guidance calls for a recent offline backup of important data and protection against deletion or overwrite.
Keep at least one separate recovery route. For critical data, use a securely stored offline or disconnected copy, or a service with retention and access controls suited to the risk.
Recovery windows and retention controls differ by service and configuration. Google Workspace and Microsoft Learn describe product-specific restoration and recovery settings for their supported workloads.
Document the retention period, recovery point and restore scope required, then confirm the exact plan, workload coverage and administrator procedure before purchase.
Where personal information is processed, controller-processor contract requirements apply. The Information Commissioner’s Office also notes that making information accessible outside the UK can be a restricted transfer.
Review processing terms, sub-processors, access locations, security measures and applicable transfer arrangements for the chosen supplier and plan before onboarding.
Relevant where shared operational data is primarily held in Microsoft 365, including Exchange Online, OneDrive and SharePoint.
Relevant where essential email and shared files are primarily in Gmail and Google Drive.
Relevant for small organisations seeking centrally managed backup for remote Windows and Mac endpoints rather than a local shared-storage appliance.
Relevant for organisations considering a NAS-based local backup platform for PCs, servers or selected SaaS workloads, with an option for an off-site copy.
Relevant for an external-drive route where a small organisation needs a portable or desktop storage copy for essential files.
Joybuy product options for the external hard drive or SSD backup route, suitable as a separate local copy within a wider backup arrangement.
Image unavailable
For a separate local copy of essential documents and project data when a named person can disconnect and store the drive securely.
Stated specifications include 4 TB capacity, USB-C, USB 3.2 Gen 2x2, password authentication and AES-256 hardware encryption.
Check the backup software, schedule, version retention and restore procedure before relying on it for operational backup. Password protection and encryption require setup through the relevant software.
Image unavailable
For portable local backup of substantial working files when the organisation needs a designated storage destination away from the primary device.
Stated specifications include 2 TB capacity, USB-C, USB 3.2 Gen 2x2, password authentication and AES-256 hardware encryption.
Confirm the intended software can schedule backups, retain versions and support a tested restore workflow. Configure password protection and encryption before storing sensitive files.
Image unavailable
For a smaller essential-data set that needs a portable, separately held local copy.
Stated specifications include 1 TB capacity, USB-C, USB 3.2 Gen 2, IP65 resistance and stated read and write speeds of 1,050 MB/s and 1,000 MB/s.
Compare the 1 TB capacity with essential data and planned retention. Check backup scheduling, version history and the restore process, and use a secure disconnection and storage routine for an offline copy.
Yes. National Cyber Security Centre guidance for small and medium-sized organisations recommends making regular copies of essential information and testing that the backup can restore it. Test the items the organisation depends on, such as a shared document, mailbox, contact list or device image, and record who can perform the restore.
Use cloud backup where reliable internet access and remote recovery suit the workflow, and use an external device where a local copy or recovery during unreliable connectivity is important. The National Cyber Security Centre advises considering both online and storage-device backups so that one lost, stolen or failed route is not the only recoverable copy.
For an organisation’s most important data, National Cyber Security Centre ransomware guidance says a recent offline backup is essential. The method depends on the workflow: an external drive may be disconnected and stored securely, while another setup may use protected retention and separated access controls alongside cloud backup.
If the organisation is a controller using a provider as a processor, the Information Commissioner’s Office says there must be a written contract or other legal act covering the processing arrangement. Check processing terms, sub-processors, security measures, end-of-contract data return or deletion provisions and account-access controls; where personal information is accessible outside the UK, assess whether a restricted transfer occurs and arrange an applicable transfer mechanism if needed.
They can be useful recovery and retention controls, but their capabilities and time windows are product-specific. Microsoft 365 Backup offers configurable recovery windows for supported workloads, while Google Workspace describes administrator restoration windows and Vault retention; confirm coverage, retention, restore scope and administrator access for the organisation’s own tenant before relying on either route.