Why backups matter
Data can be lost in many ways: a failed drive, a stolen laptop, an accidental deletion, a software fault, a fire or flood, or a malicious attack. A backup is a separate copy of data made so that it can be restored if the original is lost or damaged. It does not prevent these events, but it can turn a permanent loss into an inconvenience.
The need applies to individuals, with family photos and documents, as much as to organizations with customer records and financial files. This article is general information and not tailored IT advice.
What to back up
Start by asking what would hurt to lose. Typical candidates include documents, photos, email, contact lists, databases, financial records, website content and configuration settings. It is easy to overlook data held only on phones, in cloud accounts or on one person’s laptop. Files stored with an online service are not automatically backed up: if you delete a file, or if the account is locked or compromised, it may be gone. Under the shared responsibility model, cloud customers generally remain responsible for ensuring their own data can be recovered, though specifics depend on the service.
The 3-2-1 rule of thumb
A widely cited guideline is the 3-2-1 approach:
- 3 copies of your data: the original plus two backups.
- 2 different types of storage, such as an internal drive and an external drive or cloud storage, so a single kind of failure does not affect all copies.
- 1 copy offsite, in a different physical location, so that a fire, flood or theft at one place does not destroy everything.
Some people extend this with an extra copy that is offline or unchangeable, which helps against attackers who try to delete or encrypt backups. It is a guideline, not a guarantee, and needs adapting to the amount of data and risk involved.
Types of backup
- Full backup: a complete copy of everything. Simple to restore from, but slow and space-hungry.
- Incremental backup: copies only what changed since the last backup of any kind. Fast and compact, but restoring may need several pieces.
- Differential backup: copies what has changed since the last full backup. A middle ground.
- Snapshot or versioning: keeps earlier states of files, so you can go back to yesterday’s version if today’s was corrupted.
Frequency should reflect how much recent work you could stand to redo. If data changes constantly and losing a day would be painful, backups need to be much more frequent than for files that rarely change.
Offsite and cloud storage
Offsite storage may be a drive kept at another location or a cloud backup service. Cloud backups are convenient and automatic, but consider:
- Security: is the data encrypted, and who holds the keys? Are accounts protected with multi-factor authentication?
- Restore speed: getting large volumes back over a home or office connection can take a long time.
- Cost: pricing may depend on storage volume, retrieval and duration.
- Location and rules: where data is held may matter for legal or contractual reasons, including data sovereignty.
- Provider dependence: moving to another provider later can be difficult, a vendor lock-in concern.
Test your restores
The most common backup failure is discovering, at the worst moment, that the backup does not work: it was incomplete, corrupted, out of date, or encrypted with a lost password. To avoid this:
- Periodically restore a sample of files, and sometimes a whole system, to a different location.
- Check that the restored files open and are complete.
- Time the process so you know how long a real recovery would take.
- Confirm that backup jobs are running, using alerts or logs, since silent failures are common.
- Store passwords and recovery keys for encrypted backups separately and safely.
- Write down the restoration steps so someone else could follow them.
A backup that has never been restored is an assumption, not a safeguard.
Backup versus archive versus disaster recovery
These terms are often mixed up, but they serve different goals.
- Backup: a recent copy of active data, kept so it can be restored after loss or damage. Backups are usually kept for a limited time and overwritten by newer ones.
- Archive: long-term storage of data that is no longer in daily use but needs to be kept, for example for record-keeping or historical reasons. An archive is the primary record of that information, not a safety copy, and it follows data retention rules. Deleting something from live systems because “it’s in the archive” is fine only if the archive is itself protected.
- Disaster recovery: a broader plan for restoring entire systems and operations after a major disruption, including where and how things will run in the meantime. Backups are one ingredient, but disaster recovery also covers infrastructure, people and procedures, and sets targets for how quickly and how completely service returns.
Syncing is another look-alike. Services that mirror a folder across devices copy deletions and corruption as well, so syncing is not the same as backing up.
Backups and security
Backups hold the same sensitive information as the originals and need similar protection, including encryption and access control. They also play a key role against ransomware: offline or immutable backups make it possible to recover without negotiating. Attackers increasingly try to find and destroy backups first, so keep at least one copy out of reach of everyday accounts. Retention matters too: keeping backups indefinitely can retain data that you meant to delete, which may conflict with privacy duties such as a right to erasure request, so the policy should consider both recovery needs and deletion obligations.
Simple habits
For a household: use automatic backup for phones and computers, keep an external drive that is not always plugged in, add a cloud copy for the most important files, and check it a few times a year.
For a small organization: document what is backed up and how often, keep one copy offsite and offline, restrict who can alter or delete backups, test restores on a schedule, and include backups in the incident response plan.
No backup approach is perfect, and storage media can fail too. The point is to have more than one way back, and to know that it works before you need it.