Business Data Backup: Why It Matters and What Good Looks Like
Every business runs on data: customer records, accounts, contracts, email, designs, stock systems. Losing it, even for a few days, can stop work, damage customer trust and create problems under UK GDPR. A reliable backup is what turns a potential disaster into an inconvenience.
This guide covers why businesses lose data and what a good backup arrangement looks like.
Why businesses lose data
Ransomware and cyber attacks
Cyber attacks are common. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of businesses and 28% of charities had a breach or attack in the previous 12 months, with phishing reported by 38% of businesses. The NCSC handled 429 incidents in its 2025 annual review period, 204 of them nationally significant, about four a week.
Ransomware deliberately looks for backups it can reach and encrypts or deletes them. A backup that is always connected to your network may not survive an attack. Our ransomware guide covers preparation and response in more detail.
Hardware failure
Hard drives wear out, and SSDs can fail suddenly with no warning at all. Servers and NAS boxes contain several drives, and RAID only protects against some of the ways they fail.
Human error
Files get deleted, overwritten or saved in the wrong place. Sync services then copy that mistake to every device.
Theft, fire and flood
Laptops get stolen, offices flood and fires happen. If every copy of your data is in the same building, a single event can take all of it.
What good looks like
Follow the 3-2-1 rule
A widely used rule of thumb is to keep three copies of important data, on two different types of storage, with one copy off-site. For a small business that might be the live data on a server or cloud platform, a local backup to a NAS or backup appliance, and a separate cloud backup.
Keep one copy offline or immutable
At least one copy should be out of reach of an attacker: either physically disconnected (an external drive or tape rotated and taken off-site) or held in an immutable backup that cannot be changed or deleted for a set period, even by an administrator account. This is the copy that gets you back on your feet after ransomware.
Versioning
Keep multiple restore points, not just last night’s copy. Problems are often only noticed days later, and ransomware may have been encrypting files quietly before anyone saw it.
Cloud backup, done properly
The same survey found 74% of businesses use secure cloud backup. Cloud backup is automatic and off-site, but check that it is a true backup with version history, not just file sync, and that the account is protected with multi-factor authentication. Understand how long a full restore would take over your internet connection, and what the provider’s terms say about access to your data.
Automate it
Manual backups get forgotten, especially when the person who does them is on holiday or leaves. Schedule backups and set up alerts if a job fails.
Test restores
A backup you have never restored from is a hope, not a plan. Regularly restore individual files and, periodically, a whole system, and time how long it takes.
Watch drive health
Monitoring tools on servers and NAS units can warn of failing drives (using SMART data) so they can be replaced in good time. Don’t rely on it alone: many failures, particularly on SSDs, give no warning.
Write an incident plan and name who is responsible
Only 25% of businesses in the survey had a formal incident response plan. Write down what is backed up, where, how to restore it, who to call and in what order systems should come back. Name a person responsible for backups and a deputy. Include what to do about ransomware: isolate affected machines, don’t rush to pay, and report it to Action Fraud and the NCSC.
When backups fail
Sometimes the backup turns out to be incomplete, or the NAS or server holding it fails. If that happens, power the equipment down rather than repeatedly restarting it or rebuilding a RAID array, and get specialist advice. See our page on RAID, server and NAS recovery. For broader protection beyond backups, read our data protection best practices.
Data Retrieval Ltd offers an emergency service for business-critical systems, a free initial assessment and a fixed, no-obligation quote before work starts. We are ICO registered and handle data under UK GDPR. Call 020 7064 4996 or submit a case.
Sources
- GOV.UK, Cyber Security Breaches Survey 2025/2026 (30 April 2026)
- NCSC, UK experiencing four nationally significant cyber attacks every week (14 October 2025)
- NCSC, Backing up your data