How to back up a small business properly
Why cloud sync is not a backup, what a working backup for an Indian small business covers, and the restore test that tells you whether it is real.
You probably do not have backups
Most small businesses believe they are covered because their files are in cloud storage. Sync is not backup. A synchronised folder copies your mistakes as faithfully as it copies your work. Delete a folder on the laptop and it disappears from the cloud within seconds. Encrypt the laptop with ransomware and the encrypted versions travel upwards too.
The second gap is bigger. The data that would actually close your business is rarely in the synced folder. Accounting data sits in a file on one machine in the back office. The customer list lives inside a software product. Design files sit on a designer's desktop. Nobody has considered what happens when that machine fails and nobody will until it does.
What a backup covers and what it does not
A backup does not cover anything you have not identified. That is the whole exclusion and it accounts for most failures. Data inside third-party software is not backed up because the files sit on someone else's servers, and whether you can export it depends on the product rather than on your diligence. Email is usually not backed up either, since a provider's retention is not a backup and a deleted mailbox goes with the account. Configuration is almost never backed up. Rebuilding a point of sale system takes days even with every file intact.
The direct cost is small. External drives are inexpensive and cloud backup services charge by capacity. The real cost is an hour each month to verify the thing works and a half-day once a year to practise a restore. Businesses skip both and then discover their position during an incident, which is the most expensive moment to learn anything.
Who needs what
Any business where a lost week of records would mean a lost month of revenue needs a real backup. Anyone running accounting software locally needs it urgently, because that file is both irreplaceable and stored on a single machine in a dusty room.
Do not buy a managed backup service if you are a sole consultant with documents and a mailbox. Cloud storage with version history plus one external drive kept at home will serve you and the monthly fee will not. Do not buy server backup software if you have no server. And do not spend on backup at all while your staff share one password and nobody has multi-factor authentication switched on. Backup protects you from accident and hardware failure. It does nothing against someone who is logged in as you and deletes things deliberately.
How to set it up
Start by listing what would be unrecoverable. Accounting data and GST records. The customer and supplier list. Contracts and invoices. Website files and its database. Payroll records. Original design and photography files. Anything a regulator or a client could ask you to produce. If it is not on the list it is not protected.
Then apply the long-standing three-two-one approach. Three copies of the data. Two kinds of storage. One copy kept away from the premises. In practice that means the working copy, an external drive on site, and a cloud backup. Insist on version history so you can retrieve a file as it was a fortnight ago. Keep at least one copy that the working machines cannot write to, because a backup drive left permanently connected is another folder for ransomware to encrypt. Automate the schedule. A backup that depends on somebody remembering stops in the second week.
How to know it is working
There is one metric and it is the restore. Pick a file at random each month and recover it. Once a year recover something substantial such as the accounting data onto a different machine and time how long it takes. That number is your real exposure and it is usually longer than anyone guessed.
The metric that flatters is the success notification. Backup software reports completion enthusiastically and will report success while silently skipping a locked file, an excluded folder or a drive that was full. A green tick is a claim. A recovered file is evidence.
The common mistake
Never testing a restore. The backup has run nightly for two years and nobody has taken anything out of it. Then the machine fails and the archive turns out to be unreadable, or password protected by someone who left, or missing the one folder that mattered because it was moved in March. A backup you have not restored from is a belief rather than an asset.
The costly variant is keeping the only spare copy in the same building. A drive in the cupboard beside the server survives a disk failure and does not survive a fire, a flood or a theft. Monsoon water damage does not discriminate between the computer and the cupboard.
A note on retention
How long to keep records is not purely a technical choice. Indian company law and GST rules both set minimum periods for retaining books and supporting documents, and sector rules may add more. Those periods run longer than most backup software retains data by default, so a tidy automatic deletion policy can quietly destroy something you are obliged to hold. A qualified professional should confirm which periods apply to your business before you set a retention rule.
This guide explains how something works. It is not legal, tax or financial advice, and rules change. Confirm anything regulatory with a qualified professional before you act on it.