Ask twenty small business owners whether they back up their data and most will say yes. Ask them when they last tried restoring from that backup and the room goes quiet. We’ve sat through enough of those conversations over the years to know the gap between “we’ve got a backup” and “we’ve tested a restore” is where most Australian small businesses actually lose their data, not in some dramatic ransomware headline.
A proper small business data backup plan isn’t complicated, but it does need to be deliberate. Too many businesses end up with backups by accident: a folder synced to the cloud because someone set it up in 2019, an external drive that hasn’t been plugged in since the last office move. That’s not a strategy. It’s a hope.
Why this matters more than owners think
The Australian Cyber Security Centre’s guidance for small and medium businesses consistently lists ransomware and accidental deletion among the most common ways Australian organisations lose access to their own files. Insurance brokers will tell you the same thing from the claims side: a seized hard drive, a stolen laptop, a staff member who deletes the wrong folder on a Friday afternoon. None of these require a sophisticated attacker. They just require a business with no working copy of its files sitting somewhere else.
For a sole trader running invoicing off a laptop, losing that data might mean a stressful weekend. For a business with staff records, customer payment details or health information, it can trigger obligations under the Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner, depending on what was lost and how. That’s a conversation nobody wants to have with a regulator while also trying to rebuild a client database from memory.
Our take: the cost of doing this properly is almost always smaller than owners assume, and the cost of not doing it is almost always bigger. It’s one of the few areas of small business IT where the maths is genuinely lopsided.
The 3-2-1 rule still holds up
It’s an old rule, older than cloud computing as we know it, and it hasn’t needed replacing. Keep three copies of your data, on two different types of storage, with one copy somewhere physically separate from your premises. The logic hasn’t changed since backup tapes were the norm: if a fire, flood, theft or hardware failure takes out your office, it shouldn’t also take out your backup sitting on the shelf next to the computer it’s backing up.
In practice for a small business in 2026 that usually looks like this: your working files live on your computer or server, a second copy syncs automatically to a cloud service, and a third copy sits on an external drive or a second cloud account that isn’t tied to the same login as your daily one. The “different login” part trips people up. If someone compromises your main Microsoft 365 or Google Workspace account and that’s also where your only backup lives, you haven’t actually got a second copy. You’ve got one copy with two names on it.
What small businesses actually need to back up
It’s worth sitting down for twenty minutes and actually listing what you’d be devastated to lose, because most businesses back up the obvious stuff and miss the boring stuff that matters just as much.
- Financial records and accounting software data, including anything not stored natively in the cloud
- Customer and supplier contact databases, CRM exports and invoicing history
- Staff records, contracts and anything covered by your privacy obligations
- Website and e-commerce store data, including product images and order history, which owners routinely forget because “the website people handle that”
That last one catches out more businesses than you’d think. We’ve seen retailers assume their web host automatically backs up their store, only to find out the hosting agreement covers uptime, not data recovery. Worth checking your hosting contract rather than assuming.
Cloud backup versus local backup
Cloud backup services have genuinely improved the baseline for small business, and we’d recommend most businesses use one as at least part of their setup. Services built into Microsoft 365 and Google Workspace plans, along with dedicated backup products, now offer reasonably priced automated backup that doesn’t need anyone to remember to plug in a drive. For a small business paying somewhere in the range of $10 to $40 a month depending on storage needs, that’s cheap insurance.
Here’s our mildly contrarian bit: we think most small businesses over-index on cloud-only backup and under-value having a local copy they physically control. Cloud services are reliable, but they’re also a single point of dependency on a company’s servers, billing system and terms of service. If your account gets suspended, disputed, or the provider has an outage, you want something that doesn’t depend on anyone else’s uptime. An external drive that’s updated weekly and kept off-site, even in someone’s home, costs under $150 and doesn’t care whether your internet is working. It’s not glamorous, but neither was keeping a spare set of keys, and that habit never went out of fashion either.
Automate it, or it won’t happen
Manual backups fail for the same reason gym memberships lapse: good intentions don’t survive a busy Tuesday. Whatever system you choose, the backup itself needs to happen without a human remembering to start it. Most modern operating systems and backup software let you schedule this entirely, running overnight or during a lunch break when it won’t slow anyone down.
If your business runs on Windows machines, it’s also worth checking what state those machines are actually in before you build a backup plan around them. Microsoft ended free support for Windows 10 in October 2025, and while the consumer Extended Security Updates programme now runs through to October 2027, business devices still on unsupported or soon-to-be-unsupported systems are a weak link worth fixing alongside your backup rollout, not after it.
Test the restore, not just the backup
This is the step almost everyone skips, and it’s the one that actually matters. A backup that’s never been restored is a theory, not a safety net. We’d suggest picking a random file or folder every few months and actually pulling it back from your backup system, start to finish, timing how long it takes. If it takes four hours to recover a single invoice folder, that’s useful information to have now rather than during an actual emergency with a client on the phone.
It’s a bit like a tradie checking their smoke alarm actually sounds rather than assuming the battery’s fine because it’s new. Cheap to check, expensive to skip.
Ransomware and why backup timing matters
Ransomware changes the calculation slightly, because a straightforward sync-based backup can quietly back up encrypted, useless files if the sync happens after the attack. This is why version history matters: a backup system that keeps multiple previous versions of a file, not just the latest one, lets you roll back to before the problem started rather than just preserving a corrupted copy. Most decent cloud backup products now include this, but it’s worth confirming rather than assuming.
The ACSC’s ReportCyber service exists for exactly this kind of incident, and it’s worth having that bookmarked before you need it rather than searching for it mid-crisis. Small businesses that have good backups tend to treat a ransomware attack as an inconvenience. Businesses without them tend to treat it as an existential threat, and some genuinely don’t recover.
Getting the basics right without overspending
None of this requires enterprise-grade infrastructure or a dedicated IT contractor on retainer, and we’d push back gently on anyone trying to sell a five-person business a backup solution built for a five-hundred-person one. A sensible setup for most small Australian businesses looks like automated cloud backup for day-to-day files, a periodic local copy kept off-site, version history switched on, and a restore test marked on the calendar every quarter. That’s achievable in an afternoon for most businesses, and it’s cheaper than a single bad week without your customer records.
If your business has started leaning on AI tools for admin, invoicing or customer service, as plenty now are according to the patterns we’ve covered in our rundown of AI tools Australian small businesses are using, it’s worth remembering those tools often create new data too, chat logs, generated documents, draft content, that’s easy to forget belongs in the backup plan as well.
Our verdict on small business backup
The technology here isn’t the hard part. Cloud storage is cheap, external drives are cheap, and the software to automate all of it is mostly included in subscriptions businesses already pay for. The hard part is discipline: setting it up once properly, then actually testing it instead of trusting it. If you take one thing from this, make it the restore test, because a backup nobody has ever opened is really just a file taking up space and giving you false confidence.
We’d also suggest reviewing your wider security setup while you’re at it. If passwords and account access are still a mess at your business, our rundown of password managers Australians should actually use is a reasonable place to start, and if you’re worried about what happens the moment something does go wrong, we’ve written about the first hour after a data breach notification in more detail than fits here.
Set it up, automate it, test it, and don’t let the cloud versus local debate become an excuse to do nothing. Most businesses we talk to already know this. Fewer have actually done it.
— Dale Whitfield, Founding Editor, Tech Geek
