What is a data backup?

Keeping a separate copy of important files is called a backup. You can restore the copy if the original is lost, stolen, broken or locked. The NCSC says a backup is usually kept in cloud storage. It can also be kept on removable media such as a USB stick, SD card or external hard drive. ¹

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

Back up anything you would miss: photos, documents and contacts. For a small organisation, the small-organisations guide mentions examples such as websites, email, invoicing, documents and customer information. ¹²
You might need a copy after a new device, loss or theft, a broken device, or accidental deletion. Malware such as ransomware can also lock or erase files. ¹
NCSC suggests, as a tip, using both an online copy and a storage device, and protecting online backups with 2-step verification. After you make a backup, check that you know how to restore it and that it contains the files you care about. ¹²

How it can look

Cloud backups can often run on a schedule, without you starting each copy. They need a reliable internet connection. A removable drive should be kept safe and should not stay connected when it is not in use. The small-organisations guide notes that some malware can also affect a drive that is left plugged into an infected computer. ¹²

Warning signs

Important photos, documents or business files exist only on one device. ¹²
A removable backup drive is left plugged into a computer that might be infected. ²
You have made a copy, but you have not checked that you can restore it, or that it contains the files you care about. ¹³

What to do now

Copy the files you would miss to a separate place, such as cloud storage or a USB stick, SD card or external hard drive. ¹
Keep a removable drive safe, and unplug it when it is not in use. If you also keep an online copy, protect that account with 2-step verification. ²¹
Check that you know how to restore the backup, and that it contains the files you care about. ¹³

UK reporting and support

NCSC family guidance is at Backing up your data (opens in a new tab). ¹
Small organisations can also use Backing up your data (opens in a new tab) and Back up your organisation's critical data (opens in a new tab). ²³
If ransomware or another crime is involved, use Report Fraud (opens in a new tab) in England, Wales or Northern Ireland. In Scotland, call Police Scotland on 101. ⁴⁵⁶⁷

How to protect yourself

Keep a separate copy of anything you would miss, and consider using both an online copy and a storage device. ¹²
Protect online backups with 2-step verification. ²
Do not leave a removable backup drive connected when it is not in use. ²

Frequently asked questions

Why should I back up my photos and documents, and where should I keep the copy?

You can restore a copy if the original is lost, stolen, broken, deleted or locked, including by malware such as ransomware. The NCSC says a backup is usually kept in cloud storage. It can also be kept on removable media such as a USB stick, SD card or external hard drive. ¹

Should I leave an external drive plugged in?

The small-organisations guide says a removable drive should not stay connected when it is not in use. Some malware can also affect a drive that is left plugged into an infected computer. ²

What files should I back up?

Back up anything you would miss, such as photos, documents and contacts. For a small organisation, the guide mentions examples such as websites, email, invoicing, documents and customer information. ¹²

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

NCSC, Backing up your data (opens in a new tab). Accessed 10 November 2026 (Europe/London).
NCSC, Backing up your data (small organisations guide) (opens in a new tab). Accessed 10 November 2026 (Europe/London).
NCSC, Back up your organisation's critical data (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Report Fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Guide to reporting cyber crime and fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Police Scotland, How to report a crime - Police Scotland (opens in a new tab). Accessed 10 November 2026 (Europe/London).
Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud (opens in a new tab). Accessed 10 November 2026 (Europe/London).