At a Glance: Cloud Backup and Data Protection
| Core rule | The 3-2-1 backup rule: three copies of your data, on two different types of storage, with one copy stored offsite |
| Relevant law | The Privacy Act 1988 and its Notifiable Data Breaches (NDB) scheme, overseen by the OAIC |
| Who the NDB scheme covers | Generally businesses with annual turnover above $3 million, plus some smaller businesses handling health records or tax file numbers |
| Biggest mistake | Treating “syncing to the cloud” as the same thing as having a real backup |
| Related reading | See our guide to the Essential Eight cybersecurity framework |
Why Backups Have Become Non-Negotiable
For a long time, backups were treated as a background IT chore — something set up once and rarely revisited. That’s changed for two reasons. First, ransomware has made data loss an active threat rather than an occasional accident; a well-tested backup is often the difference between paying a ransom and simply restoring from yesterday’s copy. Second, Australian businesses now operate under real regulatory pressure to protect personal information, with financial and reputational consequences when they don’t.
A backup that hasn’t been tested isn’t really a backup — it’s an assumption. Many businesses discover this the hard way, only finding out a backup was incomplete or corrupted at the exact moment they needed to restore it.
The 3-2-1 Rule, Explained
| Element | What it means | Why it matters |
|---|---|---|
| 3 copies | Your original data plus at least two backup copies | One failure point can’t wipe out everything |
| 2 storage types | For example, a local network drive and a cloud backup service | Different failure modes rarely hit both at once |
| 1 offsite copy | At least one copy stored somewhere physically or logically separate from your main systems | Protects against theft, fire, flood, or ransomware spreading across your network |
The “offsite” copy is the part businesses most often get wrong. A backup drive sitting next to the server it’s backing up offers almost no protection against ransomware that can encrypt anything connected to the network, or against a break-in or fire that affects the whole office.
Backup Types Compared
| Type | Best for | Watch out for |
|---|---|---|
| Local backup (external drive, NAS) | Fast restores of recent files | No protection if the office is compromised, damaged, or the drive stays connected to an infected network |
| Cloud backup | Offsite protection, accessible from anywhere | Restore speed depends on your internet connection; ongoing subscription cost |
| Hybrid (local + cloud) | Balancing fast recovery with genuine offsite protection | More moving parts to configure and monitor correctly |
| File sync services (e.g. general cloud storage/sync tools) | Everyday file sharing and collaboration | Not a true backup on their own — a deleted or encrypted file often syncs everywhere, including your “backup” |
Sync is not backup. If a ransomware attack encrypts a file on your laptop and it syncs to the cloud, you now have an encrypted file in two places instead of one, unless the service keeps genuine version history you can roll back to.
Data Sovereignty: Does It Matter Where Your Backup Is Stored?
An increasing number of Australian businesses — particularly those working with government, healthcare or financial clients — are asked where their data is physically stored. Storing backups with a provider that keeps data within Australia can simplify compliance conversations and reduce exposure to foreign legal jurisdictions that might otherwise be able to compel access to your data. It’s not a legal requirement for most small businesses, but it’s increasingly a competitive and contractual expectation, particularly for anyone bidding on government or enterprise work.
What the Notifiable Data Breaches Scheme Means for You
Under the Privacy Act 1988, businesses covered by the Notifiable Data Breaches scheme must tell affected individuals and the OAIC when a data breach is likely to cause serious harm. The scheme generally applies to businesses with annual turnover above $3 million, along with some smaller businesses that handle health information or tax file numbers. Even businesses below that threshold often choose to follow the same standard voluntarily, since customers increasingly expect it regardless of legal size thresholds.
A solid backup strategy doesn’t remove your notification obligations if personal information is exposed, but it dramatically reduces the odds you’ll face a total data loss on top of a breach — and demonstrating good data protection practices can support your case that you took reasonable steps to prevent harm.
Choosing a Backup Provider: A Practical Checklist
| Question to ask | Why it matters |
|---|---|
| Where is the data physically stored? | Relevant for data sovereignty and compliance conversations with clients |
| How is the data encrypted, and who holds the keys? | Determines who can technically access your data, including the provider itself |
| How far back does version history go? | Determines whether you can recover from an attack discovered days or weeks later |
| How long does a full restore actually take? | A backup that takes a week to restore may not save your business from a ransomware event |
| Is restore testing included or an extra service? | Untested backups fail more often than tested ones, at the worst possible time |
Common Backup Mistakes
- Never testing a restore. Run a real test restore at least twice a year, not just a “backup completed successfully” notification.
- Backing up to a drive that’s always connected. If it’s always plugged in, ransomware can usually reach it too.
- Assuming cloud storage equals backup. Check whether your provider keeps genuine version history, not just the latest synced copy.
- Forgetting about cloud-based data. Email, CRM records and cloud accounting software also need a backup plan — most platforms don’t guarantee indefinite recovery of deleted data.
- No documented recovery process. Write down who does what during a restore, so it doesn’t rely on one person’s memory during a stressful incident.
Frequently Asked Questions
Is cloud storage like Google Drive or OneDrive a proper backup?
On its own, not fully. These tools are excellent for collaboration and file access, but they sync changes (including deletions and encryption from ransomware) rather than keeping a fully independent backup unless you specifically enable and check version history retention.
How often should backups run?
For most small businesses, daily automated backups of critical systems are a reasonable baseline, with more frequent backups for data that changes constantly, such as transactional databases.
Does my business legally need to report every data breach?
No. Only breaches assessed as likely to cause serious harm need to be reported under the Notifiable Data Breaches scheme, and not every business is covered by the scheme in the first place — though many follow its standards voluntarily.
How does backup relate to the Essential Eight?
Regular backups are one of the eight core strategies in the ACSC Essential Eight framework, specifically covering the “recover” goal after an incident has already occurred.
Final Thoughts
A backup strategy is only as good as its weakest untested assumption. Following the 3-2-1 rule, checking where your data is actually stored, and running real restore tests turns a backup from a line item on an invoice into something that will genuinely save your business on the day you need it.
