The 3-2-1 backup rule every business should follow

In this article14 sections

1. What is the 3-2-1 backup rule?
2. How Nigerian businesses actually lose data
3. What should you back up? (and what you can skip)
4. Choosing storage for your 3-2-1 backup rule: what to buy and what it costs
5. Cloud backup is not the same as Google Drive syncing
6. Set up a 3-2-1 backup in one weekend
7. How often should you back up? Thinking in plain numbers
8. Test your backups: the step almost everybody skips
9. Protect your backups from ransomware, theft and staff mistakes
10. What to do when the data is already gone
11. Common backup mistakes and a simple checklist
12. Key takeaways
13. Frequently asked questions
14. Your next step: build your 3-2-1 backup this week

Funke runs a small architecture office in Wuse 2, Abuja. Three years of drawings, client contracts and invoices lived on one desktop computer. She was careful: every Friday she copied the important folders to an external hard drive. One evening an overloaded extension board sparked, a small fire started under her desk, and the desktop and the external drive, sitting side by side, were both ruined. Her “backup” had been in the same place as the original. She spent four months rebuilding drawings from client emails and old WhatsApp files. It would not have happened if she had followed the 3-2-1 backup rule.

The 3-2-1 backup rule is a simple habit: keep three copies of your data, on two different kinds of storage, with one copy stored away from your office. That is all. It costs less than most people expect, and it protects you from theft, fire, flood, power surges, dead hard drives, ransomware (malware that locks your files and demands money) and honest human mistakes.

I have spent eight years setting up computers, networks and business software in Nigeria, and I have recovered data for clients who had no backup and for clients who had one that had never been tested. In this guide I will explain the rule in plain English, what you should back up, what to buy and what it costs in naira as at 2026, how cloud backup differs from Google Drive syncing, how to set everything up in a weekend, and how to test that it works. By the end you will have a plan you can start today.

What is the 3-2-1 backup rule?

The rule is widely credited to a photographer, Peter Krogh, who wrote it for other photographers who could not afford to lose their work. It has lasted because it is easy to remember and easy to follow, even for a small business with no IT department. Each number stands for one simple idea.

3 copies of your data

The first copy is your working data, the files you use every day on your laptop or server. The other two are backups. Why three? Because any single copy can fail. If each copy has a small chance of failing on any given day, the chance of all three failing at once is tiny. One backup alone is risky: it can be stolen, forgotten, or fail on the very day you need it.

2 different types of storage

Do not put all your copies on the same kind of device. If your laptop and your backup are both on hard drives from the same shop, bought the same day, they may fail in a similar way. Use two types of storage: for example, the laptop’s internal drive, an external hard drive, and a cloud service. If one type fails, the other is unaffected.

1 copy off-site

At least one copy must be somewhere else: not in the same room, not in the same building. If thieves take everything from the office, or a fire or flood hits the building, the off-site copy survives. A cloud backup is the easiest off-site copy. An external drive kept at a trusted person’s house also counts, if it is updated regularly.

A modern upgrade: 3-2-1-1-0

Security experts now add two more numbers. The extra 1 means one copy that is offline or cannot be changed, so ransomware cannot reach it. The 0 means zero errors: you test your backups so you know they restore properly. You do not need this on day one, but keep it in mind, because I will return to both ideas later in this guide.

Why “I have a copy on my laptop” is not a backup

A copy on the same device is not protection. If the laptop is stolen in traffic or the drive fails, both are gone. A copy on a USB flash drive left in the same bag is not protection either. Neither is a folder called “Backup” on the same computer. A real backup is a separate copy on separate storage that is updated regularly.

How Nigerian businesses actually lose data

When I ask business owners how they think they might lose data, they say “hackers”. In real life, most of the losses I see are far more ordinary.

The everyday causes

• Failing hard drives. Mechanical hard drives wear out. Many fail within three to five years, often without warning.
• Power problems. NEPA cuts, generator surges and bad extension boards damage drives and corrupt files being saved at that moment.
• Theft. Laptops are stolen from cars, offices and even from restaurants. The backup drive is often in the same bag.
• Fire and flood. Office fires from overloaded sockets, and flooding in places like Lagos, Port Harcourt and Calabar in the rainy season.
• Human mistakes. Someone deletes the wrong folder, overwrites a spreadsheet or formats the wrong drive.
• Ransomware and viruses. These often arrive through fake emails, cracked software and unsafe downloads.
• Staff leaving. A disgruntled employee deletes files or takes the only copy of the customer list. Someone japas and leaves passwords behind, locked.
• Lost or reset phones. Many Nigerian businesses run on WhatsApp Business, and a lost phone can take years of customer chats with it.

Which part of the rule protects you from what

Why this matters in Nigeria

In a country where power is unstable, laptops get stolen, and businesses run on one person’s memory, backups are not a luxury. There is also a legal side. The Nigeria Data Protection Act 2023 expects organisations that hold customer personal data to protect it with appropriate security measures. Losing customer records, or letting them be stolen unencrypted, can become more than an embarrassment. If you handle customer data, treat backup as part of your duty of care. My article on cybersecurity basics for Nigerian small businesses explains the rest of the picture.

What should you back up? (and what you can skip)

You do not need to copy everything on your computer. Programs and Windows can be reinstalled. What you cannot reinstall is your own work. Start with this list.

Business-critical data

• Accounting files and exports (Excel sheets, QuickBooks, Sage or any other software data file).
• Customer lists, contact sheets and sales records.
• Contracts, quotations, invoices and tax documents.
• Design files, drawings, photographs, videos and project folders.
• The database of your POS or stock software.
• Emails and attachments, including your business email.
• Website files and database, if you manage your own site.
• Staff records, payroll files and school results.
• WhatsApp Business chats, photos, and the phone contacts of your customers.

Where files hide

Many people are surprised at where their important work actually lives. Look at the Desktop, Downloads, Documents, Pictures, WhatsApp Web downloads, browser bookmarks, saved passwords and any folder created by your accounting or POS program. Ask your staff where they save things. In one Lagos office I visited, the main customer database was in a folder called “New folder (3)” on the desktop of the sales assistant’s laptop.

Instagram vendors, PoS agents and market traders

Not every business has an office. Many Nigerian sellers run everything from a phone: customer orders in WhatsApp chats, product photos in the gallery, payment screenshots and a notebook of debtors. If that phone falls in a gutter or gets stolen at a bus stop, the business stops. If this is you, turn on phone backup today: WhatsApp chat backup, automatic photo backup, and contacts synced to your Google or Apple account. Photograph or type your debtors list into a spreadsheet once a week and email it to yourself. PoS agents should also keep a copy of daily transaction records outside the terminal, because disputes with customers and banks can come months later.

What you can safely skip

You usually do not need to back up Windows itself, installed programs, temporary files or downloaded installers. Keep a list of the programs you use and their licence keys, so you can reinstall them. If you want a full system image (an exact copy of the whole computer) for faster recovery, that is a bonus, but data comes first.

How much data do you have?

Add up the size of your important folders. Right click a folder, choose Properties, and note the size. For a small office, 50GB to 300GB is common. Designers, photographers and video producers may have 1TB or more. This number decides how big your external drive should be, and how long your first cloud upload will take.

Choosing storage for your 3-2-1 backup rule: what to buy and what it costs

You have several options, and the best plan usually mixes two or three. Here is an honest comparison, with prices as at 2026 in Nigeria. Prices move with the exchange rate, so confirm before you buy.

External drives: a good start, not the whole answer

An external hard drive is the simplest first backup, and it is a fair choice for the second copy. But do not leave it plugged in and forgotten beside the computer. Plugged-in drives are hit by the same power surge and the same ransomware. Connect it, run the backup, and store it separately. Better still, keep two drives and rotate them: one at the office, one at a trusted person’s home. Swap them every Friday.

How to pick a good external drive

Buy a well known brand from a seller who gives a receipt and a warranty, not from a roadside table. Very cheap drives with huge capacities are sometimes fakes that show 2TB on the label but hold much less, and they corrupt files once the real space runs out. After you buy, copy a large test folder onto the drive and check that every file opens. A 2.5 inch portable hard drive is fine for a desk. If the drive travels a lot, or lives in a bag on a motorcycle taxi or a bumpy Lagos commute, a portable SSD survives knocks much better because it has no moving parts.

A NAS for offices

A NAS (network attached storage) is a small box with two or more disks that sits on your office network. Every computer can save to it automatically. If one disk fails, the other keeps your data. It is excellent for offices with five to thirty staff, but remember that it is still one device in one building. It counts as your second copy, not your off-site copy. Pair it with a cloud backup.

Cloud storage and cloud backup

Cloud services store your files in professional data centres. They cost a monthly fee, and many quote in dollars, so your naira bill may rise if the exchange rate moves. If you are already paying for Microsoft 365 or Google Workspace, you may have plenty of storage included. My review of Microsoft 365 Business Standard shows what a small team gets with the subscription.

Three sample budgets

• Freelancer or solo business (100GB to 500GB): one 1TB external drive (about ₦60,000), plus a personal cloud plan (about ₦2,000 to ₦5,000 a month). Total setup under ₦70,000.
• Office with 5 staff: a 2TB external drive or small NAS (about ₦120,000 to ₦350,000), plus a business cloud backup (about ₦15,000 to ₦30,000 a month).
• Office with 20 staff: a proper NAS with mirrored disks (about ₦450,000 to ₦900,000), off-site cloud backup (about ₦40,000 to ₦60,000 a month), a UPS for the NAS, and a written procedure.

Compare that with the cost of losing three years of records. It is a small price.

Cloud backup is not the same as Google Drive syncing

This is the most common misunderstanding I meet. A client tells me, “We are safe, everything is on Google Drive.” It is not the same thing as a backup, and here is why.

What syncing does

Syncing keeps a folder identical on your computer and in the cloud. That is useful for sharing. But it means that if you delete a file, it is deleted everywhere. If ransomware encrypts your files, the encrypted versions sync to the cloud and replace the good ones. If a staff member drags a whole folder to the wrong place, the mistake travels to every device. Sync is a mirror, not a safety net.

What a real backup does

A real backup keeps versions and holds on to older copies. You can go back to how a file looked last Tuesday, or restore a folder deleted a month ago. Good cloud backup tools also work in the background, encrypt your data before it leaves your computer, and tell you if a backup has failed. Many cloud storage services now offer version history and a “recycle bin” period. That helps, but read the settings, because the default period is sometimes only 30 days.

Internet limits and data costs in Nigeria

The first upload can take days if you have 300GB and a slow line. Plan for it. Start the upload on a Friday evening and let it run through the weekend, on a stable connection, not on your MTN or Airtel mobile data, which could use up an expensive bundle. After the first upload, backups only send changes, so daily uploads are small. If your office has a weak line, schedule uploads at night. For a wider view of how cloud services work and where they can go wrong, read my article on cloud computing explained for Nigerian business owners.

A design studio in Lagos told me their work was “safe on the cloud”. A staff member cleaned up the shared folder and deleted eight months of client projects. Because the cloud only mirrored the deletion, nothing was left. We recovered most of it from the trash within the retention window, but only because someone happened to notice within days. A backup with versions would have made it a five minute fix.

Set up a 3-2-1 backup in one weekend

You do not need to be technical. Here is the step by step method I use with small offices. Set aside a Saturday and a quiet Sunday.

Step 1: List what matters

Write down the folders and systems you cannot afford to lose, using the list from earlier. Also write down who owns each one and where it is stored today.

Step 2: Choose your three copies

For most small businesses, a good setup is: copy one is the working files on the computer, copy two is a local backup on an external drive or NAS, and copy three is a cloud backup or an off-site drive. If money is tight, start with the external drive and add the cloud after the first month.

Step 3: Turn on automatic backup

Never rely on memory. On Windows, use File History or the Windows Backup app to copy folders to the external drive on a schedule. On a Mac, use Time Machine. For the cloud, install the backup client of your chosen service, or use the desktop folder backup feature of your cloud storage plan. Set it to run daily, and hourly for very active data.

Step 4: Handle phones and other systems

Do not forget the phone. In WhatsApp, open Settings, Chats, Chat backup, and set a daily backup to your Google Drive account or iCloud. Consider turning on end-to-end encrypted backup. Enable photo backup, and back up your contacts to your Google or Apple account. For POS and accounting software, look for an automatic export or backup option in the program, and send it to a backed up folder. If your website is managed by someone else, ask how often it is backed up and where the copies are stored. My article on why your website needs regular maintenance covers this.

Step 5: Encrypt and protect

Turn on encryption for drives that leave the office. On Windows, BitLocker (if available on your edition) or Device Encryption does this. On a Mac, use FileVault. Choose a strong password and store it somewhere safe. If a backup drive is stolen, encryption means the thief cannot read your customer data.

Step 6: Store the off-site copy properly

If you use a drive as your off-site copy, keep it at a trusted place away from the office, such as the director’s home. Update it every week. A drive that sits at home for eight months is not a current backup.

Step 7: Test the restore, then write it down

Restore a few files from each copy and open them. Then write a one page procedure: what is backed up, where, how often, who is responsible, and how to restore. Print it and keep it where more than one person can find it.

How often should you back up? Thinking in plain numbers

Two questions decide your backup schedule. The first is: how much work can I afford to lose? If your last backup was at 8pm last night and the drive dies at 4pm today, you lose a whole day of work. That gap is called the recovery point. The second question is: how long can I afford to be stuck? If it takes three days to get your files back, can the business survive? That is the recovery time.

Special cases: schools, pharmacies and churches

Some organisations have peaks when losing data hurts most. A school should take a full copy before results are entered and again before the term ends. A pharmacy with a POS system that tracks expiry dates should back up the database several times a day, because stock, batch numbers and customer credit change constantly. A church or NGO that keeps membership, donation and donor records should keep a copy with a trusted board member, so the data does not sit in one volunteer’s laptop. In all three cases, write down who is allowed to restore data, so the decision does not wait for one absent person.

Full, incremental and versions

A full backup copies everything. An incremental backup copies only what has changed since the last one, which is faster and lighter on your data. Most tools do a full backup first, then incremental ones, and keep versions so you can go back in time. You do not need to manage this yourself. Just make sure the tool you choose keeps at least 30 days of versions, and longer for financial records.

How long to keep backups

Keep daily versions for about a month, weekly versions for three to six months, and yearly archives for records you need for tax or legal reasons. Ask your accountant how long you must keep financial records. Keeping old backups costs storage, but deleting too early can be worse.

Test your backups: the step almost everybody skips

A backup you have never restored is a hope, not a plan. I have visited offices whose backup software had been showing a red warning for eleven months. I have also found backups that were faithfully copying an empty folder. Nobody had ever tried to open a file from them.

A monthly restore test

Once a month, pick three files at random: one from last week, one from last month, and one large file. Restore them from your backup to a different folder, and open them. If they open and look right, your backup is alive. Write the date and result in a small log. It takes ten minutes.

The yearly fire drill

Once a year, pretend the main computer has been stolen. Take a spare computer, or a clean laptop, and try to bring the business back from the backups alone. How long does it take? What is missing? Which passwords or licence keys did you forget? This test is uncomfortable, and that is the point. Better to learn the gaps on a quiet Sunday than in a real crisis.

What a failed test teaches you

A failed restore test is not a disaster. It is the cheapest lesson you will ever buy. The problems I see most often are these: the backup is missing a folder nobody added to the list, the password or encryption key cannot be found, the backup only contains a shortcut instead of the files, the drive is full and the tool silently stopped, or the cloud account was suspended because a card expired. Fix each one the same day, then run the test again until it passes.

Assign an owner

Backups fail when nobody is responsible. Name one person to check and one deputy to cover them. If you use a support partner, this belongs in your written agreement. This is one of the reasons I recommend a proper IT maintenance plan for your office, where testing backups is a monthly task with a written report.

Protect your backups from ransomware, theft and staff mistakes

Backups are valuable, so they can become targets. Attackers know that if they can destroy your backups first, you are more likely to pay them. Protect them as carefully as the original data.

Keep one copy offline or unchangeable

Ransomware searches for connected drives and shared folders and encrypts those too. So keep one copy that the computer cannot reach all the time. That can be an external drive that is only plugged in during the backup, a rotated second drive kept elsewhere, or a cloud service that keeps unchangeable versions. This is the extra “1” in the modern 3-2-1-1-0 version of the rule.

Lock down access

Use strong, unique passwords on cloud backup accounts, and turn on two-step verification. Do not share the admin login with every staff member. Restrict who can delete backups. When a staff member leaves, remove their access on the same day. If you want a full list of what to do, see my guide to cybersecurity basics for small businesses.

Encrypt anything that leaves the building

An unencrypted drive lost in a taxi or a stolen laptop can expose customer names, phone numbers and financial details. Under Nigerian data protection expectations, that is a real problem for your business. Encryption costs nothing on most modern computers, and it turns a serious breach into a minor inconvenience.

Keep backup hardware healthy

Backup drives are not immortal. Replace external hard drives every three to four years, watch for warning signs like clicking noises or slow copying, and plug the NAS into a UPS so a power cut does not damage it mid-write. A weak laptop or drive that has been slow for months is often warning you. My article on why your laptop is slow and how to make it fast again explains the signs of a failing drive.

What to do when the data is already gone

Sometimes you are reading this after the damage is done. Do not panic, and do not make it worse. The first ten minutes matter more than anything else.

The first ten minutes

1. Stop using the device. Every new file you save can overwrite the data you want to recover.
2. Do not reformat, reinstall or “repair” the drive. These steps destroy the information that recovery tools need.
3. Do not install recovery software on the same drive. Use another computer, or ask an expert.
4. If the drive makes clicking or grinding sounds, switch it off immediately. Continued use can cause permanent physical damage.
5. Check your other copies. Cloud recycle bins, old external drives, email attachments, phones, WhatsApp chats and a colleague’s laptop may hold what you need.

What recovery costs in Nigeria

As at 2026, simple recovery from an accidentally deleted or formatted drive may cost around ₦25,000 to ₦80,000. A drive with electronic or mechanical faults may cost ₦100,000 to ₦300,000 or more, and success is never guaranteed. Recovery is always slower and more expensive than a backup. If you need help, my data recovery service can assess the drive and give you an honest chance of success before any large payment.

Learn from it, then fix it

Once you have recovered what you can, do not just breathe out and move on. Treat the loss as a free lesson in how your business works. Where were the files kept? Who had them? Which copy failed? Then build your 3-2-1 plan straight away, while the pain is still fresh.

A church administrator in Owerri came to me after their finance office computer stopped starting. Ten years of membership and offering records were on it. The drive was physically damaged, and we recovered about 85 percent after several days of specialist work. The rest was gone. The pastor’s comment stayed with me: “We prayed for it to work. We should also have paid for a backup.” Today they run a simple 3-2-1 setup, and a volunteer checks it monthly.

Common backup mistakes and a simple checklist

Most of what goes wrong with backups goes wrong in the same ways. Here are the mistakes I see, and the checklist I give clients at the end of every setup.

The mistakes

• Keeping the backup drive next to the computer, or in the same bag.
• Believing that Google Drive sync is a backup.
• Relying on one person to “remember” every Friday.
• Never testing a restore.
• Leaving out phones, WhatsApp chats and accounting exports.
• Ignoring warnings or error emails from the backup tool.
• Forgetting the passwords and encryption keys needed to open the backup.
• Using cracked backup software, which may itself carry malware.

Your backup checklist

1. I know which data is critical, and where it lives.
2. I have three copies: working data and two backups.
3. They sit on two different types of storage.
4. One copy is off-site, or in the cloud with version history.
5. One copy is offline or cannot be changed by malware.
6. Backups run automatically and I get a report.
7. Drives that leave the office are encrypted.
8. I test a restore every month and a full recovery once a year.
9. Someone specific owns the job, and a deputy covers them.
10. Passwords and recovery keys are stored safely and written down for an emergency.

If you tick eight or more, you are ahead of most Nigerian offices. If you tick fewer than five, start this week. If you use business software such as an ERP or POS, ask the vendor how its database is backed up and how you would restore it.

Key takeaways

• The 3-2-1 backup rule means three copies of your data, on two types of storage, with one copy off-site.
• A copy on the same computer, or an external drive left beside it, is not a real backup.
• Most data loss comes from ordinary causes: failing drives, NEPA surges, theft, fire, flood and honest mistakes.
• Back up what you cannot reinstall: accounting files, customer lists, contracts, designs, POS databases, emails and WhatsApp chats.
• Cloud syncing is not backup. Choose a service that keeps versions, and remember that it may take days to upload the first time.
• Budget as at 2026: about ₦60,000 for a solo setup, ₦150,000 to ₦400,000 plus monthly fees for a small office, and more for larger teams.
• Automate your backups, encrypt drives that leave the office, and keep one copy offline against ransomware.
• Test a restore every month and rebuild from backups once a year. A backup you have never restored is only a hope.
• If data is already lost, stop using the drive and get professional help before you try to fix it yourself.

Frequently asked questions

Your next step: build your 3-2-1 backup this week

You do not need a big budget to start. You need a decision, a weekend and someone to check the backups every month. I can help you plan and set up a proper backup for your office, test that it works, and train your team to keep it running. Start by reading how my IT support for offices covers backups and monthly checks, and if data is already lost, my data recovery service can look at the drive first. The easiest way to begin is to book a free consultation, or message me on WhatsApp from the site. Tell me what you use today, and I will show you the smallest setup that follows the 3-2-1 rule.