Written by the GR.IT Consultancy team. GR.IT is a UK managed IT provider with more than 25 years of experience supporting businesses across London, Kent and the South East.
The short answer
Data backup and recovery is the practice of copying your business data so it can be restored quickly after loss, corruption, ransomware or hardware failure. Backup is the copy you keep. Recovery is the process of putting that copy back into use. A strong setup for a UK small business follows the 3-2-1 rule (three copies of your data, on two types of media, with one copy held offsite), is automated and monitored, includes at least one immutable or air-gapped copy to defeat ransomware, and is tested on a regular schedule so you know it actually works when you need it.
This guide explains what data backup and recovery means, the difference between backup, disaster recovery and business continuity, the backup types available, how to set realistic recovery targets, and how to build a plan that keeps a London or Kent business trading through an incident.
What is data backup and recovery?
Data backup is the process of creating and storing additional copies of your files, applications, systems and databases. Data recovery is the process of restoring those copies after an event that makes the original data unavailable. The two work as a pair. A backup has no value on its own; it only matters when you can recover from it, in the timeframe your business can tolerate.
In plain terms, a backup answers the question “do we still have a copy of this?” and recovery answers “how fast can we get it back and how much work will we lose?” Getting both right is what separates a minor disruption from a business-ending event.
Backup vs disaster recovery vs business continuity
These three terms are often used interchangeably, but they describe different things. Understanding the distinction helps you buy the right level of protection.
| Term | What it covers | Question it answers
|
|---|---|---|
| Data backup | Copies of your data stored safely so they can be restored. | Do we have a clean copy of our data? |
| Disaster recovery (DR) | The tools and plan for restoring systems and data after a major outage, including servers, applications and infrastructure. | How do we get our systems running again, and how quickly? |
| Business continuity (BC) | The wider plan that keeps the whole business operating during and after disruption, including people, premises, communications and processes. | How does the business keep trading through an incident? |
Backup is a component of disaster recovery, and disaster recovery is a component of business continuity. Most small and mid-sized businesses start with reliable backup, then add a disaster recovery capability as they grow more reliant on their systems.
Why data backup and recovery matters for UK businesses
The threat picture for UK businesses has grown sharper, not softer. According to the UK Government’s 2025 Cyber Security Breaches Survey, 43% of UK businesses reported a cyber security breach or attack in the previous 12 months, and a fifth of those went on to lose data or assets. The National Cyber Security Centre has warned that ransomware activity against UK organisations continues to rise, and small businesses are far from immune.
Ransomware in particular now targets your safety net directly. Industry research in 2025 found that attackers attempt to reach backup repositories in the large majority of ransomware cases, and that most affected organisations had their backups deliberately targeted. That single fact reshapes what “good backup” looks like: if your only copy sits on the same network the attacker controls, it can be encrypted or deleted alongside your live data.
For a London or Kent business, the cost of getting this wrong is rarely just the lost files. It is the lost billable hours while systems are down, the missed orders, the reputational damage, and the potential regulatory exposure under UK GDPR if personal data is involved. Backup and recovery is not an IT nicety. It is basic operational resilience.
What are the main types of data backup?
There are two questions to answer: what method do you use to capture changes, and where do you store the copies.
Backup methods
| Method | What it does | Best for
|
|---|---|---|
| Full backup | Copies all selected data every time it runs. | A complete baseline; simplest to restore from, but storage heavy. |
| Incremental backup | Copies only the data that changed since the last backup of any type. | Fast, storage efficient daily backups; restores need the full plus each increment. |
| Differential backup | Copies everything changed since the last full backup. | A balance between speed and simpler restores. |
| Continuous data protection | Captures changes almost in real time. | Systems where losing even an hour of data is unacceptable. |
Where backups are stored
| Location | Strengths | Watch-outs
|
|---|---|---|
| Local (on-site) | Fast restores over your own network. | Exposed to the same fire, flood, theft or ransomware as your live data. |
| Cloud (offsite) | Held away from your premises; scalable; accessible from anywhere. | Restores depend on your internet speed; choose a UK or EU data region for compliance. |
| Hybrid | Combines fast local restores with an offsite cloud copy for resilience. | Slightly more to manage, which is where a managed provider adds value. |
For most UK small businesses, a hybrid approach delivers the best of both worlds: quick recovery from a local copy for everyday mishaps, and a protected cloud copy for the serious events.
What is the 3-2-1 backup rule?
The 3-2-1 rule is the long-standing benchmark for resilient backup, and it is the simplest way to sanity-check your setup.
- 3 copies of your data, including the live version.
- 2 different types of storage media, so a single technology fault cannot take out everything.
- 1 copy kept offsite, away from your premises.
Because ransomware now hunts for backups, many providers extend this to the 3-2-1-1-0 rule: the same three, two and one, plus 1 copy that is immutable or air-gapped (it cannot be altered or deleted once written), and 0 recovery errors confirmed through regular testing. Immutable storage is one of the most effective defences against a modern ransomware attack because the attacker cannot encrypt a copy they are not able to change.
What are RTO and RPO, and why do they matter?
Two targets define how good your recovery needs to be. Setting them is a business decision, not just a technical one.
- Recovery Time Objective (RTO): how quickly a system must be back up and running after an incident.
- Recovery Point Objective (RPO): how much data, measured in time, you can afford to lose. An RPO of one hour means you back up at least hourly.
| System | Typical SME RTO | Typical SME RPO
|
|---|---|---|
| Email and core productivity | 1 to 4 hours | Under 1 hour |
| Line-of-business or finance system | 4 to 8 hours | 1 to 4 hours |
| File shares and archives | 8 to 24 hours | 4 to 24 hours |
Tighter targets cost more because they need more frequent backups and faster recovery infrastructure. The right answer is the one that matches what your business can actually tolerate, which is a conversation worth having before an incident forces the issue.
How to build a data backup and recovery plan
A workable plan does not need to be complicated. It needs to be deliberate, documented and tested.
- Identify what matters. List your critical data and systems, including cloud services such as Microsoft 365. Many businesses wrongly assume Microsoft backs up their data in full; the shared responsibility model means protecting your own content is your job.
- Set your RTO and RPO for each system, based on business impact rather than convenience.
- Choose your approach. Apply the 3-2-1 or 3-2-1-1-0 rule, with a hybrid of local and cloud copies and at least one immutable copy.
- Automate and monitor. Manual backups get forgotten. Automated, monitored backups with alerting catch failures before they matter.
- Secure the backups. Encrypt data in transit and at rest, restrict access, and keep an air-gapped or immutable copy out of reach of ransomware.
- Test recovery, not just backup. Run restore tests on a regular schedule. A backup you have never restored is an assumption, not a safety net.
- Document and review. Write down who does what during an incident, and review the plan as your systems and headcount change.
Common data backup mistakes to avoid
- Only one copy, on one device. A single external drive left plugged in is not a backup strategy.
- Never testing restores. Most recovery failures are discovered during a real emergency, which is the worst possible time.
- Forgetting cloud data. Microsoft 365, Google Workspace and SaaS apps need their own backup.
- No offsite or immutable copy. On-site only backups fall to the same fire, flood or ransomware as the originals.
- No monitoring. A backup that silently failed three weeks ago offers zero protection today.
Backup, UK GDPR and compliance
UK GDPR requires businesses to protect personal data against loss, destruction or damage using appropriate technical measures, and backup is explicitly part of that. Being able to restore access to personal data in a timely manner after an incident is a stated expectation. For most UK businesses this means keeping backup data within the UK or EU, encrypting it, controlling who can access it, and being able to demonstrate that your recovery process works. A managed provider can help you map your backup setup to these obligations so compliance is built in rather than bolted on.
How GR.IT helps London and Kent businesses stay protected
Backup and recovery is one of those areas where a small gap stays invisible until the day it costs you everything. GR.IT builds and manages resilient backup and recovery for businesses across London, Kent and the South East, so you are covered by design.
Our managed cloud hosting services provide secure, UK-based offsite backup and rapid recovery, while our managed IT support services handle the day-to-day monitoring, testing and restores so nothing is left to chance. Because ransomware targets backups directly, our managed cyber security services add the immutable and air-gapped protection that keeps your safety net out of an attacker’s reach. If you want to understand the wider budget picture first, our guide to the cost of IT support for small businesses in the UK is a useful starting point.
Want to know whether your current backup would actually survive a ransomware attack or a failed server? Book a free backup and recovery review with GR.IT and get a clear, honest assessment.
Frequently asked questions
What is the difference between backup and data recovery?
Backup is the act of creating and storing copies of your data. Data recovery is the process of restoring those copies after loss, corruption or an attack. You need both: a copy you can rely on, and the ability to restore it within a timeframe your business can tolerate.
How often should a small business back up its data?
It depends on how much data you can afford to lose, known as your Recovery Point Objective. Most UK small businesses back up critical systems at least daily, and often hourly or continuously for email and finance systems where losing even a few hours of work is costly.
Is cloud backup safe for business data?
Yes, when it is set up properly. Choose a provider that stores data in the UK or EU, encrypts data in transit and at rest, controls access tightly, and offers an immutable or air-gapped copy. Cloud backup also protects you from local risks such as fire, theft and flooding at your premises.
Does Microsoft 365 back up my data for me?
Not in the way most people assume. Microsoft protects its own infrastructure, but under the shared responsibility model your data and its recoverability remain your responsibility. A dedicated Microsoft 365 backup protects you against accidental deletion, ransomware and retention gaps.
What is the 3-2-1 backup rule?
Keep three copies of your data, on two different types of storage media, with one copy held offsite. Many providers now add a fourth and fifth element, an immutable or air-gapped copy and zero recovery errors verified by testing, known as the 3-2-1-1-0 rule.
How much does business data backup cost in the UK?
Cost depends on data volume, how fast you need to recover and the level of management involved. It is usually bundled into a managed IT or cloud hosting package rather than priced alone. Our UK IT support pricing guide explains how these packages are typically structured.
