The backup and restore checklist
A backup is a copy you have restored at least once. This card sets out the copies we recommend: encrypted before they leave the business, kept with a second provider in the UK or the EU, protected from deletion, and proved by restoring them.
A two-page A4 PDF to print and keep, free, with no email asked for. Edition 1, November 2026, reviewed every 12 months.
Who the card is for
For a business that has backups, or thinks it has, and wants to know they would work. It sets out the copies we recommend, encrypted on your own machines before they leave, kept with a second provider based and storing data in the UK or the EU, and protected from deletion, and then the restore tests that prove them.
4 parts, on two pages
- 01What to back up
- 02How the copies are kept
- 03The restore test
- 04Every month
Read it here
The same words as the PDF, with its sources at the end.
What to back up
- All the data the business needs to operate: email, documents, invoicing, contacts, customer records and the website [1].
- What a restore needs besides the data: settings, licence details, the list of accounts and how each is recovered, and the backup’s own encryption key, kept apart from the backup.
- Every new system, added to the backup the week it starts holding data.
How the copies are kept
- More than one copy, in more than one place. The NCSC suggests both an online backup and a storage device, in case one is lost, stolen or fails [1].
- Encrypted before it leaves the business, with a key you hold and the backup provider does not. The provider then stores data it cannot read. UK GDPR names encryption among the measures for keeping personal data secure [3].
- With a second provider, not the one that runs the system it protects, so a lockout or a deleted account cannot take the system and its backup together.
- In the UK or the EEA. Copies kept in the UK stay inside the UK, and every EEA country has full UK adequacy, so neither needs a transfer safeguard for the copies [4].
- Protected from deletion: versions that cannot be changed or deleted for a period you set, or deletions that can be undone, so an attacker who gets in cannot destroy the backups [2].
- Behind a separate sign-in, with two-step verification, not shared with the everyday administrator accounts [1, 2].
- A storage device unplugged when it is not in use: some viruses also reach devices connected to an infected computer [1].
- Alerts when a backup fails, and when someone tries to delete or change backups or their settings [2].
The restore test
- Restore one folder and one person’s email to a different place, open them, and check they hold what you expected [1].
- Restore from an older version too, not only the latest, in case the latest copy is already damaged [2].
- Once a year, restore a whole system and time it, from start to working: that time is your real recovery time.
- Check you could reach the backup, and its key, if the office, your main email and your own laptop were all out of action [2].
- Write down each test: the date, what was restored, how long it took and what went wrong. UK GDPR asks for the ability to restore personal data in a timely manner, and for a process for regularly testing your security measures [3].
| Test date | What was restored | How long it took | What went wrong, and the fix |
|---|---|---|---|
Every month
- Read the backup reports, and look into any failure or warning.
- Check that the newest backup is from when you expect.
- Check that the people who can sign in to the backup are still the right people.
Sources
- [1] NCSC, Small organisations guide to cyber security: backing up your data, published 9 April 2026, reviewed 21 July 2026, checked 10 November 2026 · ncsc.gov.uk
- [2] NCSC, Principles for ransomware-resistant cloud backups, published 22 November 2024, checked 10 November 2026 · ncsc.gov.uk/guidance/principles-for-ransomware-resistant-cloud-backups
- [3] UK GDPR, Article 32, Security of processing, paragraph 1, checked 10 November 2026 · legislation.gov.uk/eur/2016/679/article/32
- [4] ICO, Is the restricted transfer covered by adequacy regulations?, checked 10 November 2026 · ico.org.uk
The things people ask
Is a file sync service a backup?
Not on its own. A sync service copies deletions and damaged files as faithfully as good ones. A backup is a separate copy, with older versions, that the sync cannot overwrite.
Why encrypt the backup before it leaves the business?
So the provider holding the copy stores data it cannot read. UK GDPR names encryption among the measures for keeping personal data secure, and holding the key yourself means a problem at the provider does not expose the contents. Keep the key where you can reach it when your own systems are down.
Why a second provider in the UK or the EU?
A copy kept with the provider that runs the system it protects can be lost with it, in a lockout or a deleted account. A second provider based and storing data in the UK or the EEA also keeps the copies inside the UK or under UK adequacy regulations, so no transfer safeguard is needed for them.
Where to go next
- Backups, disaster recovery and failover
- Backup and recovery plans that fail when you need them
- Every free and paid guide
Would you rather have it done for you? The free review, done remotely: what you run, what is exposed, and where the risk actually sits, written down. The document is yours regardless of what happens next. Book the free review.