Most small businesses discover their backup was broken at the worst possible moment, because nobody ever tried to restore it. A backup that has never been tested is an assumption rather than a protection, and the difference only becomes apparent when the accounting data, the customer list or the quotes you have not invoiced yet are gone.
The discipline is simple and almost nobody follows it.
Back up what you could not reconstruct
Accounting data, customer records, contracts, quotes not yet invoiced, designs and photographs, and anything holding your operating history. Equipment can be replaced; five years of records cannot.
Include what sits on individual laptops and phones. Business-critical information is frequently on a device belonging to one person and backed up nowhere.
Follow the three-two-one rule
Three copies of the data, on two different types of storage, with one held off-site. Cloud storage handles the off-site copy automatically, which is why it suits small businesses with no technical staff.
Off-site matters because fire, flood and theft take everything in one place. A backup drive sitting next to the computer it backs up protects against almost nothing.
Automate it, then test the restore
Manual backups stop happening within weeks. Whatever you use should run automatically and alert you when it fails.
Then restore a file, deliberately, at least once. This is the step everyone skips and it is the only one that proves the system works. Diarise it quarterly.
Protect against ransomware and meet your obligations
Ransomware encrypts current data and any backup it can reach, which is why at least one copy should be offline or otherwise not writable from the machines being backed up.
Backups containing customer information carry the same duties as the original data under the Protection of Personal Information Act, overseen by the Information Regulator: keep them secure and access-controlled. Tax records must also be retained for a set period, and the requirement is published by the South African Revenue Service.
Frequently asked questions
What should a business back up?
Anything you could not reconstruct: accounting data, customer records, contracts, unbilled quotes, designs and operating history.
What is the three-two-one rule?
Three copies, on two types of storage, with one off-site. Cloud storage handles the off-site copy automatically.
Why does testing matter so much?
Because an untested backup is an assumption. Restoring a file is the only thing that proves the system works.
How does ransomware affect backups?
It encrypts any backup it can reach, so at least one copy must be offline or not writable from the machines being backed up.
Do backups carry legal obligations?
Yes. Backups holding personal information carry the same data protection duties as the original, and tax records have retention requirements.
Originally published in May 2018. Updated September 2026 into practical guidance on backing up a small business.
