Why Small Businesses Need Data Backup Built into Their Software

Cloud storage and business backup solve related but different problems. A synchronised cloud folder makes files available across devices and can help colleagues collaborate on current work. A recoverable backup preserves a separate usable copy when a file, account, device or service fails. Treating the first as proof of the second creates an avoidable risk. For a small UK company, the right design depends on what information the business must recover, how long it can be unavailable and which failures might affect both the original and its copies.

An office might store proposals in shared cloud folders, customer cases in a CRM and financial evidence in an accounting application. Each service may offer its own recycle bin, version history or export process. Those controls need to be checked individually. A supplier marketing its service as cloud-based does not automatically promise that all historical records, linked attachments and administrator settings can be restored after an account compromise. Start by defining recovery requirements, not selecting the cheapest storage allowance.

Inventory the information needed to continue service

List active customer enquiries, appointment information, approved documents, business email, financial records and essential configuration. Name the person responsible for each system. Consider what happens if the company cannot access one of those services for a day. An expired draft might be recreated, while a current booking or legally relevant transaction history can be much harder to reconstruct. Prioritise according to real business consequences instead of treating every file as equally important.

Make the inventory understandable to non-technical managers. Record where each category resides, whether the business can export it, who can restore it and how the recovered information will be checked. Avoid storing administrator passwords in a widely shared inventory. Review the list whenever the company adopts new software or changes supplier, because a backup plan that excludes a new customer platform may look complete while leaving a critical gap.

Understand what synchronisation does

Synchronisation updates files across a connected account or group of devices. It is useful for making changes visible and allowing people to work from more than one location. It may also spread an accidental deletion, unwanted overwrite or malicious change. A recycle bin and version history can offer recovery for some events, but the exact coverage, duration and permissions vary by service and plan. The business should test its actual subscription instead of relying on a generic assumption about cloud storage.

Imagine a colleague deletes a folder while reorganising a shared workspace. If that deletion propagates, every synchronised device may show the same absence. The correct question is which independent recovery point remains and whether an authorised person can restore the right version. If the original account is compromised, a copy controlled by the same credentials might also be at risk. Synchronisation and independent backup may coexist, but they should have distinct purposes.

Plan independent copies for correlated failures

The National Cyber Security Centre recommends backing up important data and checking restoration. Separating at least one copy from ordinary access reduces the possibility that the same incident will affect every location. Depending on the business, that could involve a suitably protected separate service, an isolated backup arrangement or carefully managed removable storage. No one medium is automatically best. The organisation must evaluate confidentiality, restore speed, physical protection and maintenance.

Where a removable drive is used, it should not remain casually connected to a compromised computer, and its physical custody matters. Where an online backup is used, review identity, access separation and supplier retention. The business also needs to confirm that a copy includes the required application data rather than just exported filenames. Backup success indicators are useful, but they are not substitutes for inspecting an actual restored customer case or document.

Decide how much data and downtime are acceptable

Two practical questions guide backup frequency: how much newly entered information could the business afford to lose, and how long could an important process remain unavailable? A fast-changing booking system might require more frequent recoverable points than a library of rarely changed templates. The answers should come from the people accountable for customer service and financial operations, supported by technical advice where needed.

Document a recovery order. If email is unavailable, staff might need an approved alternative contact route. If the CRM is restored from an older copy, employees must reconcile enquiries and appointments created since that point. Do not automatically send confirmation messages from recovered data until the current state is checked. A sensible recovery plan states who can approve restoration and who explains any service interruption to customers.

Check what hosted applications actually export

A business application may allow export of contacts but not attached documents, activity history or custom workflow configuration. Those missing relationships can be material. Test exports of a representative customer case, including an open task, an approved file and the relevant owner. Verify whether a colleague can understand the output without the original application. A table of names is not the same as a usable business archive.

Read supplier terms on version history, end-of-contract data access and retention. Where the business uses more than one service, examine integration dependencies and which system is authoritative for each field. A restored CRM must not silently overwrite a newer accounting or scheduling state. Maintaining trustworthy customer records can require a documented reconciliation step after technical recovery.

Protect customer privacy within backup material

Backups often contain broad collections of personal data. Limit recovery access and maintain appropriate security according to the information and circumstances. The ICO's organisational guidance describes relevant data protection duties, including confidentiality and storage limitation. A file being a backup does not make unlimited access or indefinite storage automatically appropriate. Define who can retrieve an archive, where it may be stored and how unnecessary copies are handled.

Consider the effect of restoring old records after an authorised correction or deletion. A recovered copy can reintroduce information that the business has since updated. The recovery process should reconcile those differences, preserving legitimate evidence where required without treating every historical value as current. This is especially important when a contact preference or confidential detail has changed.

Test a practical restore before depending on it

Use suitable test records to simulate deletion, a lost device and temporary loss of an administrator. Retrieve the required material, open its attachments and ask operational staff whether the information is usable. Record the recovery steps, time, missing elements and actual verification. Where a full restoration exercise is impractical, describe honestly which subset was tested. Revisit the test after important system changes rather than relying on a successful result from years earlier.

Make sure a second authorised person understands the recovery procedure. If the only copy of the instructions is inside the inaccessible service, the plan fails at the critical moment. Maintain supplier contact information through an appropriate separate route. Train employees to report suspicious events before restoring files into a potentially compromised environment, where containment or specialist investigation may be needed first.

Maintain backup responsibility as a routine operation

A designated owner should review failed backup events, changes to data sources, access permissions and periodic restore tests. Subscription charges alone do not indicate the strength of protection. A low-cost approach can work for a modest business when it is managed and tested; an expensive enterprise product may still fail if no one knows how to restore meaningful records. Define the evidence management wants to see, such as the date and outcome of a successful representative restore.

The best arrangement gives employees convenient access to current files while preserving a separate path to recover important information. Treat cloud collaboration as a working service and backup as a tested resilience control. Select each according to the actual customer and operational consequences, and avoid promises that a single connected folder can withstand every incident.

Sources: NCSC: backing up data for small organisations; Microsoft: OneDrive deleted-file recovery (vendor-specific); ICO: organisational data protection guidance. Exact restoration windows and features must be verified for the purchased plan.