How to Back Up Your Business Files: A Simple 3-2-1 Plan

Most business owners only think about backups on the day they need one: a laptop is stolen, a hard drive stops working, a phone falls in water, or a virus locks every file on the computer. On that day, the only question that matters is whether a recent copy of your work exists somewhere else.

A good backup plan does not need to be expensive or technical. It needs to be automatic, stored in more than one place, and tested from time to time. This guide walks through a simple plan any small business can set up in an afternoon.

Start with what you cannot afford to lose

Before choosing any tool, make a short list of the information your business depends on. For most small businesses, it looks something like this:

• Accounting and invoices: spreadsheets, accounting software data, receipts and tax documents.
• Customer information: contact lists, order histories, contracts and quotations.
• Working documents: proposals, templates, price lists and staff records.
• Design and media files: logos, product photos, videos and brand files.
• Email: especially if important agreements only exist in your inbox.
• WhatsApp Business chats: many orders and customer conversations now live only on a phone.
• Your website: its files and database, if you manage the hosting yourself.

Next to each item, write where it currently lives: one laptop, a shared computer, a phone, a USB stick in a drawer. This simple exercise usually reveals the weak points straight away, such as all the accounts living on one person's laptop.

The 3-2-1 rule, explained simply

The 3-2-1 rule is the most widely used guideline for backups because it protects against almost every common problem:

• 3 copies of your important data: the original plus two backups.
• 2 different types of storage, for example the computer itself and an external drive, or an external drive and the cloud.
• 1 copy kept somewhere else: off the premises, usually in the cloud, so a fire, flood or burglary at the office cannot destroy everything at once.

You do not have to follow it perfectly from day one. Even moving from one copy to two is a big improvement. But 3-2-1 is the target to work towards.

Option 1: Cloud storage and sync

Services such as OneDrive (included with Microsoft 365), Google Drive (included with Google Workspace) and Dropbox keep a copy of your files online and on your devices. When set up properly, they are the easiest way to get an off-site copy.

The advantages are clear: files are saved automatically, they are available from any device, and a stolen laptop no longer means lost work. Many services also keep previous versions of files and a recycle bin, so you can recover a document someone overwrote or deleted.

There are two things to understand, though:

• Sync is not the same as backup. If a file is deleted or damaged on your computer, the change is copied to the cloud too. Version history and the recycle bin protect you, but only for a limited period, so check how long your plan keeps them.
• Make sure the right folders are included. A common mistake is syncing the Documents folder while staff save everything on the Desktop or in a Downloads folder. On Windows, OneDrive can protect the Desktop, Documents and Pictures folders automatically; turn this on.

If you are still deciding between the two main business suites, our comparison of Microsoft 365 and Google Workspace covers storage and sharing in more detail.

Option 2: An external drive

An external hard drive or SSD gives you a fast local copy that does not depend on your internet connection. That matters when your connection is slow or expensive, or when you have large files such as photos and videos that would take a long time to upload.

On Windows, File History can back up your folders to an external drive automatically, keeping older versions of each file. On a Mac, Time Machine does the same job. Both are built in and free to use.

A few practical rules make external drives far more reliable:

• Use a drive only for backups, not for carrying files around.
• Label it clearly with the computer name and the date it was set up.
• Do not leave it plugged in all the time. If ransomware infects the computer, it can also encrypt any drive that is connected. Connect it, let the backup run, then unplug it.
• Keep it away from the computer itself, ideally in a different room or location.
• Replace drives every few years, and immediately if they start making unusual noises or showing errors.

Don't forget phones and WhatsApp

For many small businesses, the most important customer records are on a phone. If that phone is lost, so are the conversations, orders and contacts.

• WhatsApp Business: turn on chat backup to Google Drive on Android or iCloud on iPhone, choose a daily backup and include videos only if you need them. Our WhatsApp Business guide explains the rest of the setup.
• Contacts: make sure contacts are saved to your Google or Apple account, not only to the SIM card or the phone.
• Photos: product photos and receipts can be backed up automatically with Google Photos or iCloud Photos.

Make it automatic

A backup plan that depends on someone remembering to copy files every Friday will fail eventually. People get busy, travel or leave the company. Wherever possible, choose options that run by themselves:

1. Cloud sync running all the time on every work computer.
2. File History or Time Machine set to run every day or every hour.
3. Automatic WhatsApp backup set to daily.
4. A short reminder in your calendar once a week to connect the external drive, if you use one that you unplug.

Also decide who is responsible. In a small business, that might be the owner or one trusted staff member. Their job is not to copy files manually, but to check each month that the automatic backups are still running.

Protecting backups from ransomware

Ransomware is malicious software that encrypts your files and demands payment to unlock them. Modern ransomware also tries to find and encrypt backups, because that removes your easiest way to recover.

The best defences are simple:

• Keep at least one backup that is not connected to your computer most of the time, such as an external drive that you unplug.
• Use cloud services that keep version history, so you can roll files back to before the attack.
• Protect your cloud accounts with two-step verification, so an attacker who steals a password cannot delete your backups.
• Keep Windows, your browser and your antivirus updated, so the infection is less likely in the first place.

Our small business cybersecurity checklist covers these and other everyday protections step by step.

Test your backups

A backup you have never restored is only a hope. Every few months, do a short test:

1. Pick a few important files from different folders.
2. Restore them from your cloud service and from your external drive into a test folder.
3. Open them and check that they are complete and up to date.
4. Write down how long it took and anything that was confusing.

Once a year, ask a bigger question: if this laptop disappeared today, how long would it take to get someone working again on a new one? If the honest answer is several days, your plan needs work, and it is much better to discover that during a test than during a crisis.

A simple plan you can copy

For a typical small office with a few computers and phones, this plan covers almost everything:

• Every computer syncs Desktop, Documents and Pictures to OneDrive or Google Drive.
• Every computer also backs up to an external drive weekly with File History or Time Machine, and the drive is unplugged and stored separately afterwards.
• Business phones back up WhatsApp, contacts and photos automatically every day.
• All cloud accounts use two-step verification.
• One named person checks backups monthly and tests a restore every three months.

Getting help

Setting up backups properly is one of the most valuable things a small business can do for its IT, and it only needs to be done once. If you would like it set up and checked for you, our IT support service covers backups, security and device management for small businesses. You can also read what reliable IT support should include, or contact us to talk about your setup.