Business Data Backup: A Plan a Small Team Can Actually Follow

Cloud sync is not a backup. If a file is deleted, encrypted by ransomware or corrupted on your laptop, Google Drive and OneDrive faithfully propagate that change to every device and every colleague within seconds. Sync keeps copies identical; a backup keeps copies of the past. They solve different problems, and confusing them is why so many businesses discover they have no backup at the exact moment they need one.

The good news is that a genuinely adequate backup setup for a small business takes an afternoon and costs very little. Most of the work is deciding what matters, which is the part people skip. This guide covers the rule worth following, what small Indian businesses actually lose, and a concrete plan.

Why is sync not a backup?

In fairness, the major cloud services do keep version history and a recycle bin, and for a single accidentally-overwritten document that is usually enough. What they are not designed for is bulk recovery: thousands of files encrypted at once, or a folder deleted sixty days ago that nobody noticed. Retention windows are limited, restoring at scale is awkward, and an account compromise can wipe the history too.

What is the 3-2-1 rule?

Three copies of your data, on two different kinds of storage, with one copy off-site. It is decades old, predates the cloud, and is still the standard because the logic is about independence rather than technology: you want the failure that destroys one copy to be unable to touch the others.

The off-site copy is the one small businesses skip, and in India it is the one that most often matters. A shop or office with the server, the backup drive and the laptops all in the same room has one copy, not three, as far as fire, flooding or a break-in is concerned. A cloud backup service satisfies “off-site” for most purposes and costs very little at small-business volumes.

Many practitioners now add a further digit — one copy immutable or offline, meaning something ransomware cannot reach even with full access to your network. An external drive that is unplugged when not in use satisfies this cheaply. It is low-tech and effective.

What do you actually need to back up?

Backing up everything is how plans become unmanageable and get abandoned. The useful exercise is to list what you could not rebuild, because that is the real exposure. Most small businesses find the list is shorter than they expected — and that two or three items on it are not backed up at all.

Two entries there catch people out repeatedly. Your web host’s backups are not your backups — they exist for the host’s convenience, retention is often short, and if your hosting account is suspended or compromised you may lose access to the site and its backups together. Keep your own copy somewhere else.

And a cloud mailbox is not backed up by default. Google and Microsoft protect their infrastructure, not your content from your own mistakes. If an employee deletes a mailbox or an account is closed, the standard retention window is measured in weeks. For a business whose records live in email, that is worth a dedicated backup.

A plan you can set up this afternoon

1. List what you cannot rebuild. Fifteen minutes with the table above. Write it down; this becomes the thing you verify against later.
2. Put the live copy somewhere shared. If critical files sit on one person’s laptop, move them to your business cloud storage first. Sync is not a backup, but it does end the single-device risk.
3. Add a cloud backup service with version history of at least 30 days, pointed at your files and your mailboxes. This is your off-site copy and it runs unattended.
4. Add an external drive that one named person connects weekly, copies to, and unplugs. Unplugged is the point — it is your ransomware-proof copy.
5. Back up your website separately with a plugin or your host’s tool, downloading a copy you hold yourself, monthly at minimum.
6. Write the plan on one page. What is backed up, where, how often, by whom, and how to restore. Put it somewhere two people can find.
7. Test a restore. Pick a file and actually recover it. Then do it again in six months.

Step seven is the one that separates a backup plan from a backup hope. Plenty of businesses discover at the worst possible moment that the backup had silently stopped running months earlier, or that the archive is corrupt, or that nobody knows the password to the encrypted drive. An untested backup is a belief, not a safeguard.

How often should backups run?

Work backwards from one question: how much work can you afford to redo? If losing a day of invoices would be painful but survivable, daily is fine. If losing an hour of order entries would cause real problems, you need something continuous. That number has a name — recovery point objective — and you do not need the jargon, only the honest answer.

Automation matters more than frequency. A daily backup that runs by itself beats an hourly one that depends on someone remembering. The only manual step worth keeping is the unplugged external drive, and that is because being manual is the feature.

What about the legal side?

Two considerations apply to Indian businesses and both are easy to get wrong in opposite directions. Tax and company law require certain records to be retained for a number of years, so your backup retention should not be shorter than your obligation — a 30-day window does not satisfy a multi-year record-keeping requirement, and that means archives, not just backups.

At the same time, backups of customer personal data are themselves personal data, which means they fall under your data protection obligations: kept secure, encrypted where practical, not retained indefinitely without purpose, and deleted when a retention period ends. A forgotten drive of customer records in a cupboard is a liability, not a safeguard.

This is general information rather than legal advice, and specific retention periods depend on your business and registrations — worth a conversation with your accountant, who will know the applicable periods for your records.

None of this is complicated work, and that is rather the point. The businesses that lose data are almost never the ones that evaluated options and chose badly — they are the ones that assumed sync was enough and never tested a restore. One afternoon, one page of notes, one test, and the problem is mostly solved.

If you are setting up the surrounding stack, Google Workspace vs Microsoft 365 covers where your files and mail will live, and GST-ready accounting software covers the records most expensive to lose — particularly if yours are currently in a local file on one computer. For customer data specifically, a CRM moves contacts off individual phones, which solves a backup problem as a side effect. More in the technology section.