How to Back Up Business Data: The 3-2-1 Rule and a Restore Test You Can Run This Afternoon

How to back up business data still comes down to the 3-2-1 rule: three copies, two different kinds of media, one copy kept outside the office. Most offices already have two — files on a working machine, and a folder that syncs to the cloud — then stop. The two parts that decide whether you recover are the missing ones: a copy that survives the building, and proof it still opens. A backup nobody has ever restored is not a backup. It is a pile of files.

Every price and time limit below was read off the provider’s own page on 11 October 2026.

Two numbers to decide before you choose any tool

First: how many hours of recent work you can afford to lose. Second: how long the business can sit still while data is restored. Those two numbers decide what the plan contains. The brand on the hardware does not.

Take a building-materials distributor in Candi, Sidoarjo. Stock and sales data live on one PC in the admin room. If it dies on a Monday, sales cannot issue delivery notes and the trucks outside do not leave. The owner answered in two sentences: one lost working day is survivable, four hours of standing still is not. A daily backup is enough — but one living on that same PC is no backup.

Without them, every backup conversation drifts toward capacity and brand names. With them, the choice narrows on its own.

How to back up business data with the 3-2-1 rule

The rule came out of photography and survived because you can audit it by counting.

• Three copies. One you work in every day, and two spares that are never worked in.
• Two kinds of media. An external disk and cloud storage, say. Two disks of the same model bought the same day are not two kinds — drives from one batch tend to fail at a similar age.
• One copy off site. A different building, a different city, or the cloud. The copy that survives a fire, a flood, or a laptop walking out of the door.

One addition the original rule never had, and close to mandatory now: at least one copy must be impossible to delete or overwrite from a machine that is already compromised. Unplugging the disk after each backup does it. So does cloud storage that keeps old versions and holds delete requests.

For an office under twenty people, the sensible combination is row one plus row three: one disk unplugged after each backup, one copy in the cloud. A NAS earns its place once the data runs to terabytes, or a dozen machines need backing up at once.

A currency detail that surprises people when the first invoice lands: the Google Workspace pricing page served for Indonesia quotes US dollars, not rupiah — Starter is $7 per user per month, 30 GB pooled per person. So the annual budget moves with the exchange rate, which belongs in the plan from the start.

Syncing is not backup

This is the most common misunderstanding and the most expensive. Google Drive, OneDrive and Dropbox are sync tools: they make every device match the latest state. Delete a file on the laptop and it leaves the cloud too. Let ransomware encrypt a synced folder and the encrypted version uploads within minutes — not because the service is poor, but because that is what it does.

The recovery windows are finite. Google’s Drive help page states that files moved to the Trash are deleted forever after 30 days. For a deleted staff account, an admin has up to 20 days to restore it and its data; past that, no button helps. Both limits came from Google’s own pages on 11 October 2026.

A restore test you can run this afternoon

About an hour, and nothing you do not already have. Run it now, not once everything else is tidy.

1. Pick data people actually use. One important document and one application database — last month’s sales data, say. Not a sample file made for the test.
2. Have somebody else do it. Pick someone who never handles backups. If only one person in the office can restore anything, that is your first finding, and the most serious.
3. Restore to a different machine. Not the one the data came from. Many backups fail precisely here, because the restore needs a licence or an application version that exists on only one computer.
4. Open the result and check inside it. A file of the right size that will not open is still a failure. So is a database that opens but stops at last month.
5. Write down how many minutes it took. From the start until the data is usable again. Compare it against the "how long can we stop" number you set earlier.

If the result runs far past what you can tolerate, the problem is rarely the software. It is the procedure: nobody knows the password, the files are encrypted with no spare key, or the sequence was never written down. Procedures are cheaper to fix than hardware is to replace.

Repeat every three months and write the date somewhere easy to find. That date is the only evidence the plan is still alive.

What offices forget to back up

Document folders are usually safe, because they are visible. What gets missed is data that does not look like a file on screen:

• The database behind the POS or accounting app, which often sits in a program folder rather than Documents.
• Email, if the office still runs POP3 and the only copy sits on one machine.
• Product photos and original design files, which exist only on the laptop of whoever made them.
• The website itself: theme, plugins and database, not just the uploads folder.
• Contacts and chat history on the company WhatsApp Business number.

And one item that is not a file: the note explaining how to restore. The backup password, the order of the steps, who to call at midnight. If that lives in one head, what you have is not a backup plan. It is one employee who still works there.

In our experience, an office under twenty people needs no dedicated backup hardware in year one. One unplugged disk, one cloud account, one quarterly test. What deserves money earlier is making sure the cybersecurity side is sound, because a backup that can be deleted from a machine already under someone else’s control helps nobody.

Two honest trade-offs sit underneath this. Cloud backup means a bill that never stops and a dependency on office internet — on a modest connection the first upload can take days. A disk you unplug is immune to ransomware, but stakes the data on somebody remembering it weekly. Pick the weakness you can live with.

Once the data outgrows one disk, or an application must keep serving through a power cut, the conversation moves to cloud infrastructure and the arithmetic there is different.

And if the order is what remains unresolved — back up first, fix the network, or replace the application — an hour with an IT consultant in Sidoarjo usually costs less than buying three devices and shelving two of them.