Data backup

Data backup for a business means keeping separate, restorable copies of the information the organization cannot work without: shared files, laptops, Microsoft 365 or Google Workspace mail and documents, accounting files, line of business databases and the website. A backup only counts if it has been restored successfully in a test, and if someone knows which systems come back first. This page is for owners, office managers and finance leads who want a written plan rather than a hopeful assumption. Canada Create is a Toronto agency that plans and sets up backups for organizations across Canada.

Contents

• What to back up
• The three, two, one rule in plain language
• Immutable and offline copies
• Where copies live and how they are encrypted
• Retention periods the owner sets
• Testing restores on a schedule
• Backup versus disaster recovery
• A written recovery plan with priorities
• Privacy, health records and data residency
• How we set up and review backups
• What data backup costs
• How backup fits with the rest of your IT
• How to choose a backup partner
• Your next step

What to back up

The first job is an honest inventory. Many offices believe “everything is in the cloud” and discover during a restore that the estimating spreadsheets lived on one partner’s laptop, or that the accounting company file was on a desktop under reception. Walk through each place data is created and stored, and decide for each one whether it needs its own copy.

Servers and shared drives

An on site file server, a network storage box in the supply room or a shared drive on a single desktop is often where years of client folders sit. These need image level copies, so the whole machine can be rebuilt, as well as file level copies for restoring a single folder someone deleted on Tuesday.

Laptops and desktops

Staff save to the desktop and the downloads folder no matter what the policy says. Either redirect those folders to a location that is already backed up, or back up the devices themselves. Laptops that leave the office need copies that run over any internet connection, not only when plugged in at the desk.

Microsoft 365 or Google Workspace

Cloud productivity suites keep their service running and offer recycle bins, but those features are not an independent copy you control. Mailboxes, shared drives, personal file storage and chat files should be included in a separate backup, with new users added automatically. The Microsoft 365 support page in this batch covers the tenant side of this in more detail.

Accounting and line of business data

Accounting company files, payroll exports, practice management databases, inventory systems, CAD drawings and dispatch records each have their own way of being copied safely. Some databases must be quiesced or exported before a copy is consistent, and some cloud hosted business software lets you export data on a schedule. List each system with who supplies it and how its data is protected today.

Phones, tablets and scanned paper

Field staff often photograph signed work orders, delivery slips or site conditions on a phone and never upload them. If those images are business records, the plan should say where they go, usually a shared folder that is already backed up. The same applies to scanned paper: once the paper file is shredded, the scan is the only copy and deserves the same care as any other record.

Websites

Your website files and database need copies kept somewhere other than the hosting account. Website backups and restores are handled as part of our website maintenance and security work, so a business backup plan should simply record where those copies live and who restores them.

The three, two, one rule in plain language

The three, two, one rule is an old and still useful starting point: keep three copies of important data, on two different kinds of storage, with one copy kept off site.

Three copies

The live data people work on counts as one. Two more copies mean a single failed disk, a deleted folder or a corrupted backup set does not leave you with nothing.

Two kinds of storage

If every copy lives on the same type of device in the same rack, one fault or one mistake can affect them all. Pairing a local storage device with cloud storage, or with removable media rotated away from the office, avoids that shared weakness.

One copy off site

A fire, a flood from the unit upstairs or a break in should not take the backups along with the originals. The off site copy can be in a cloud service, at a second office, or on media taken off the premises. Many organizations now add one more element: at least one copy that cannot be changed or deleted for a set period, described next.

Immutable and offline copies

Ransomware and similar attacks often try to find and encrypt or delete backups as well as the original files. The practical answer is to keep at least one copy that the attacker cannot reach or alter, even with stolen admin credentials.

Immutable storage

Immutable means a backup, once written, cannot be modified or deleted until a retention period you set has passed. Many cloud storage services and some backup appliances offer this as a setting. It should be switched on deliberately and its retention period recorded, because it also means a mistaken backup cannot be removed early.

Offline and separated copies

An offline copy is one that is physically or logically disconnected from your network most of the time, such as rotated drives kept in a locked cabinet off site. A separated copy lives in a backup account with its own sign in, protected by multi factor authentication, that is not tied to your everyday admin accounts. Either approach limits how far a single compromised password can reach.

Keeping it calm

None of this requires alarm. It is the same logic as keeping a spare house key with a neighbour rather than under the doormat: one copy sits where a problem at home cannot touch it.

Where copies live and how they are encrypted

Choosing where backups are stored is a balance between restore speed, cost, privacy obligations and how far the copy is from the original.

Local copies

A storage device in the office restores large amounts of data quickly because nothing travels over the internet. It is the copy you reach for when a server disk fails or a big folder is deleted. On its own it is not enough, because it shares the building with the originals.

Cloud copies

Cloud backup stores copies in a provider’s data centre. It handles the off site part of the rule well and suits laptops that travel. Restoring a whole server over an office connection can be slow, so many plans pair cloud with a local copy.

Canadian storage options

Some organizations prefer, or must, keep data in Canada. Microsoft and other cloud providers offer Canadian data centre regions, and many backup services let you choose the storage region. The region should be chosen at setup and recorded in the plan.

Encryption and keys

Backups should be encrypted while travelling and while stored. Ask who holds the encryption key. If your organization holds it, the provider cannot read your data, but losing the key means losing the backups, so the key itself needs a documented safe home with more than one person able to reach it.

Retention periods the owner sets

Retention is how long each backup is kept before it is removed. It is a business decision, shaped by how your organization works and by any legal or professional record keeping obligations that apply to you.

Short and lengthy retention

Daily copies kept for a few weeks let you recover a file deleted last Thursday. Monthly or yearly copies kept longer let you recover something deleted or corrupted months ago that nobody noticed. A typical plan keeps frequent copies briefly and fewer copies for longer.

Records you must keep

Accounting records, client files and health records may carry retention requirements from tax rules, professional bodies or privacy law. Your accountant, lawyer or regulator is the right source for those periods; the backup plan then records them so the settings match.

Not keeping data forever

Keeping every backup indefinitely is not automatically safer. Old copies cost money to store and may contain personal information your organization no longer needs. Retention should end somewhere on purpose.

Testing restores on a schedule

A backup that has never been restored is a guess. Restore testing turns it into something you know works.

What a test looks like

Pick a sample: a folder from the file server, a mailbox, a laptop’s documents, the accounting company file. Restore each to a safe location, open the files, confirm they are complete and current, and write down how it went. Rotate which systems are tested so every part of the plan is checked over the year.

Full rebuild tests

Less often, test restoring a whole server or business system to separate hardware or a cloud environment. This is where missing licence keys, forgotten passwords and undocumented settings surface, which is exactly why it is worth doing before a real event.

Who runs the test

The person who set up the backups should not be the only one who knows how to restore them. Have someone else, perhaps the office manager with written steps, carry out a simple file restore now and then. If the steps make sense to them, they will make sense on a stressful day when the usual person is unavailable.

Recording results

Each test should leave a short record: what was restored, from which date, whether it worked and anything that needs fixing. The owner or office manager should see these records, because they are the evidence the backups are real.

Backup versus disaster recovery

Backup is having copies. Disaster recovery is the plan and the practised steps for getting the organization working again after a serious event, using those copies.

What disaster recovery adds

Recovery planning asks which systems matter most, how much lost work the organization can live with for each, how long each can reasonably be unavailable, what has to happen in which order, and who does what. Those are targets the owner sets for planning; no partner can promise them, because real events vary.

When a recovery plan is activated

A plan is usually activated when a core system cannot be restored with a simple file restore: a server failure, a building that cannot be used, a ransomware event, a cloud account that has been taken over. The plan should name who decides to activate it, so nobody wastes the opening stretch debating.

A written recovery plan with priorities

A recovery plan does not need to be long. It needs to be accurate, current and reachable when the office network is down.

Priorities in order

List systems in the order they come back: perhaps email and phones first so staff can talk to clients, then accounting and the client file system, then everything else. An accounting firm in tax season and a distributor in its busy quarter will order these differently, and the plan should reflect your real calendar.

Who to call

Write down the internal decision maker, the person who handles IT, each software vendor’s support contact and account number, your insurer, your internet provider and anyone who holds keys to the office. Keep a printed copy and a copy outside your own systems.

Credentials and access

The plan should say where the backup account credentials, encryption keys and admin passwords are kept, and who can reach them if the usual person is away. A backup nobody can log in to is not much help.

Keeping the plan current

Review the plan when systems change, when key staff change and after every restore test. A plan written once and filed away goes stale quickly.

Privacy, health records and data residency

Backups hold the same personal information as the originals, so the same obligations apply to them.

Breaches and records

Federal privacy law treats a lost or exposed backup like any other loss of personal information. Under PIPEDA, where a breach of security safeguards creates a real risk of significant harm, the organization reports it to the Privacy Commissioner of Canada and tells the people affected, and every breach goes into the organization’s own breach records. A backup drive left in a car is the classic example, and encryption is what keeps such a loss from exposing anything readable. Organizations in Quebec have further obligations under Law 25, and Ontario health custodians follow PHIPA for personal health information, including copies held in backups. This is a marketing observation, not legal advice.

Choosing the storage region

If clients, funders or regulators expect data to stay in Canada, choose a Canadian storage region for cloud backups and record it. Backup software and storage subscriptions are paid to the vendor and shown separately from our fees.

How we set up and review backups

Canada Create follows plain steps for backup work, whether you need a first plan or a review of something already running.

A free review

We ask where your data lives, what is backed up today, where copies go, when a restore was last tested and which systems the organization cannot do without. Rough answers are fine; finding the gaps is the point.

A custom proposal

You receive a custom proposal: the inventory of what to back up, where each copy will live, retention, encryption and key handling, restore test schedule and recovery priorities, with fees quoted in writing and storage subscriptions as separate lines.

Setup and first restore test

Backups are configured in accounts owned by your organization, the first full copies are taken and a first restore test is run and recorded before anyone relies on them.

Monthly reporting

Each month you receive a summary of backup jobs, any failures and how they were resolved, restore tests carried out and anything that has changed, such as a new system that needs adding.

What data backup costs

Every backup arrangement gets a written quote once the free review has shown how much data you hold and where it sits. Whatever you pay for storage space or backup software goes to that vendor on its own invoice line, apart from our fees.

What drives the quote

• How much data you hold and how quickly it grows.
• How many servers, laptops, cloud tenants and business systems need covering.
• Whether you need local, cloud, immutable and offline copies, or a subset.
• Retention periods, since longer retention means more storage.
• How often restores are tested and whether full rebuild tests are included.
• Whether a written disaster recovery plan is part of the scope.

An office with one shared drive and a dozen laptops is a very different quote from a firm with a database server, design files and two locations.

How backup fits with the rest of your IT

Backup is one part of looking after your technology. It sits within managed IT services for organizations that want ongoing care, and the IT outsourcing page in this batch explains how to hand over parts of that work. If you want an independent view of your whole setup before deciding, an IT consulting assessment includes backup planning. Protecting the systems themselves sits with our cyber security team, cloud tenant settings with cloud security reviews, and website copies with your website hosting arrangement.

How to choose a backup partner

A backup partner should be able to show you, not just tell you, that your data can come back.

Questions worth asking

• Who owns the accounts? The answer should be you, including the backup service account and the storage account.
• Who holds the encryption key, and where is it documented?
• Which of our systems are covered, and which are not?
• How often will restores be tested, and will we see the results?
• Is at least one copy immutable or offline, and which one?
• Where is the data stored, and can it stay in Canada?
• What does the monthly report show when a backup job fails?

Warning signs

Be cautious if a provider cannot say when a restore was last tested, keeps backups in its own account rather than yours, or describes file sync as a backup. Sync copies deletions and damage as faithfully as it copies good files.

Your next step

Start with a free backup review. Before the call, jot down where your shared files, mail, accounting data and business databases live, and the last time anyone restored something on purpose. Call (416) 273-9030, Monday to Friday, 9 am to 6 pm, and Saturday, 10 am to 2 pm. After hours, our 24/7 AI agent answers the toll-free line, +1 (800) 808-9235, and we’ll follow up the next business morning. You can also reach us through our contact page. We reply within one business day. Visit us at 126 Willowdale Avenue, Suite 3, Toronto, or read about who we are first.