Data backup in SMEs: obligations and proven practice

In an SME, data backup is not a voluntary extra but part of running a business with due care: the GDPR requires personal data to be protected against loss and to be restorable quickly after an incident, and tax retention obligations require documents to remain readable for years. The proven core of every backup strategy is the 3-2-1 rule – three copies, two types of media, one copy off site. The most important and most frequently forgotten building block, however, is the restore test, because a backup that cannot be restored in an emergency is not a backup.

In brief

• Art. 32 GDPR requires, among other things, the ability to restore the availability of personal data quickly after a physical or technical incident.
• Responsibility for a working backup plan lies with management – the execution can be delegated, the responsibility cannot.
• The 3-2-1 rule is the proven minimum standard: three copies of the data, two different storage media, one copy off site.
• Against encryption attacks (ransomware), at least one copy needs additional protection: stored offline or immutably.
• Without a regular restore test, every backup is a leap of faith – what you need to test is restoring, not saving.
• The backup plan should be written down and filed where people in the company can find it – not just kept in the head of the IT support person.

What data backup obligations does an SME have?

There is no dedicated “backup law” – the obligation to back up data comes from several directions at once. The most important is the GDPR: Art. 32 obliges every company that processes personal data to take technical and organisational measures appropriate to the risk. This expressly includes the ability to restore the availability of and access to the data quickly after a physical or technical incident. Customer data, personnel files and supplier contacts fall under this in practically every company.

Then there are the retention obligations under tax and company law: in Austria, books, records and receipts must in principle be kept for seven years, and longer in certain cases. If you lose your accounting data through a hard disk failure, you do not just have an IT problem, but one with the tax office too.

And finally there is the general duty of care: management is expected to exercise the care of a prudent businessperson. By today’s standards, dealing appropriately with IT risks is part of this – a total loss of company data without any backup plan would be difficult to present as careful management. The Austrian Economic Chamber, among others, offers practical guides to IT security for companies (wko.at). This article provides general guidance and does not replace legal advice in individual cases.

How does the 3-2-1 rule work?

The 3-2-1 rule is a simple mnemonic that covers the most common loss scenarios at the same time:

Number	Meaning	What it protects against
3	Three copies of the data: the original plus two backups	A single failure or operating error never destroys the latest version.
2	Two different storage media, e.g. network storage on site plus cloud backup	A batch defect or failure of one technology does not affect both copies.
1	One copy off site, physically separate from the company	Fire, water damage, burglary or lightning strike at the site.

Since encryption attacks have become an everyday risk, the rule is often extended to include two more points: at least one copy should be offline or immutable – that is, stored in such a way that an attacker who gets into the network cannot encrypt or delete it as well. And the number of errors in the restore test should be zero. An external hard drive that is permanently plugged into the server is therefore not an offline copy: whatever is connected can be attacked.

It is also important to distinguish backups from syncing. Services that continuously mirror folders to the cloud also transfer deletions and encrypted files – within seconds, both sides are then unusable. A real backup keeps several versions staggered over time, so that you can go back to the state of yesterday or last week.

Why is management responsible?

You can and should delegate the technology – to an internal IT person or an external support provider. What cannot be delegated is the decision about what the company can cope with in an emergency. Only management can answer two questions:

1. How much data loss can be tolerated? If the answer is “half a working day at most”, a weekly backup is not enough.
2. How long may the company be at a standstill? If quotes, orders and plans are inaccessible for three days, that has different consequences from three hours – the technology and effort required depend on this.

The answers shape the backup plan: which data is backed up, how often, how long versions are kept, where the copies are stored and who is responsible for checking. This plan should be written down and approved by management. If you commission an external service provider, you should have them report regularly on backup runs and test results – an annual meeting with minutes is often enough to avoid nasty surprises. If personal data is held by the service provider, the appropriate contractual basis under the GDPR is also required.

Why is the restore test more important than the backup itself?

The classic emergency looks like this: the backup ran for years, apparently without errors – and at the first real restore attempt it turns out that a folder was never included, the backup medium is defective or nobody knows the password for the backup’s encryption. That is why the rule is: the proof lies in restoring, not in saving. A useful test runs like this:

1. Define the scenario: for example “The file server has failed” or “A folder was deleted by mistake” – test one small and one large scenario.
2. Run the restore: to a test system or into a separate folder, never over the live data.
3. Measure the time: How long does it really take until people can work? This figure belongs in the plan.
4. Check completeness: Open samples – are the files readable, up to date and complete?
5. Record the result: date, scenario, duration, shortcomings, remedial measures. The record is also your evidence for the insurer, customers or the authorities.

At least one test a year is a good rhythm, two are better – plus one after every change of server, backup software or service provider.

Which mistakes happen most often in practice?

All copies in the same building. The network storage in the next room protects against hard disk failure, but not against fire or burglary. Without an external copy, the 3-2-1 rule is not met.

Syncing confused with backup. The cloud folder is practical, but it mirrors errors in real time. If you only sync, you have no fallback.

No offline copy. Modern malware specifically looks for reachable backups and encrypts them first. A separate copy that is not permanently connected is your life insurance.

Nobody tests. The backup reports “successful”, but nobody has ever tried restoring a system from it.

The knowledge depends on one person. Only the IT support person knows where the backups are, how the restore works and which order must be followed. If this person is unavailable, the company comes to a standstill despite intact backups.

How do you document your backups so that others can follow them?

That last point is especially underestimated: in an emergency, what counts is not only that the data exists, but that people can find out how to restore it. A documented backup plan covers the scope of the backup, the intervals, the storage locations, the responsibilities, the step-by-step restore instructions and the test records. These documents are of little use if nobody can find them in an emergency – under stress, possibly without the usual contact person.

This is where knowledge management comes in: an AI knowledge base that answers from your own documents and names the source document for every answer makes documents like these accessible with a simple question – for example “How do we restore the file server, and who is responsible?”. The AI does not replace the backup system; it makes the documented how-to findable and verifiable at the decisive moment.

At the same time, data backup is only one of several building blocks of GDPR-compliant IT use – alongside server location, access control and data processing by third parties. The overview article AI and the GDPR in Austria shows how these building blocks work together.

The next step is unspectacular but effective: check this week when your last restore was tested – and record the result in writing. If you want to make your backup plan and the rest of your company knowledge permanently findable, the How it works page shows step by step how a knowledge base is introduced.