Data backup in SMEs: obligations and proven practice

In an SME, data backup is not a voluntary extra but part of entrepreneurial due care: the GDPR requires personal data to be protected against loss and to be restorable quickly after an incident, and tax retention obligations presuppose that documents remain readable for years. The proven core of every backup strategy is the 3-2-1 rule – three copies, two types of media, one copy off site. The most important and most frequently forgotten building block, however, is the restore test, because a backup that cannot be restored in an emergency is not a backup.

In brief

• Art. 32 GDPR requires, among other things, the ability to restore the availability of personal data quickly after a physical or technical incident.
• Responsibility for a working backup concept lies with management – the execution can be delegated, the responsibility cannot.
• The 3-2-1 rule is the proven minimum standard: three copies of the data, two different storage media, one copy off site.
• Against encryption attacks (ransomware), at least one copy needs additional protection: stored offline or immutably.
• Without a regular restore test, every data backup is flying blind – what is tested is restoring, not saving.
• The backup concept should be documented in writing and filed where it can be found in the company – not just in the head of the IT support person.

What data backup obligations does an SME have?

There is no dedicated “backup law” – the obligation to back up data arises from several directions at once. The most important is the GDPR: Art. 32 obliges every company that processes personal data to take technical and organisational measures appropriate to the risk. This expressly includes the ability to restore the availability of and access to the data quickly after a physical or technical incident. Customer data, personnel files and supplier contacts fall under this in practically every company.

Then there are the retention obligations under tax and company law: in Austria, books, records and receipts must in principle be kept for seven years, and longer in certain cases. If you lose your accounting data through a hard disk failure, you do not just have an IT problem, but one with the tax office too.

And finally there is the general duty of care: management is expected to exercise the care of a prudent businessperson. By today’s understanding, dealing appropriately with IT risks is part of this – a total loss of company data without any backup concept would be difficult to present as careful management. Practical guides to IT security for companies are offered by the Austrian Economic Chamber, among others (wko.at). This article provides general guidance and does not replace legal advice in individual cases.

How does the 3-2-1 rule work?

The 3-2-1 rule is a simple mnemonic that covers the most common loss scenarios at the same time:

Number	Meaning	What it protects against
3	Three copies of the data: the original plus two backups	A single failure or operating error never destroys the latest version.
2	Two different storage media, e.g. network storage on site plus cloud backup	A series fault or failure of one technology does not affect both copies.
1	One copy off site, physically separate from the company	Fire, water damage, burglary or lightning strike at the site.

Since encryption attacks have become an everyday risk, the rule is often extended by two points: at least one copy should be offline or immutable – that is, stored in such a way that an attacker who gets into the network cannot encrypt or delete it as well. And the number of errors in the restore test should be zero. An external hard drive that is permanently plugged into the server is therefore not an offline copy: whatever is connected can be attacked.

The distinction from syncing is also important. Services that continuously mirror folders to the cloud also transfer deletions and encrypted files – within seconds, both sides are then unusable. A real backup keeps several versions staggered over time, so that you can go back to the state of yesterday or last week.

Why is management responsible?

You can and should delegate the technology – to an internal IT person or an external support provider. What cannot be delegated is the decision about what the company can cope with in an emergency. Only management can answer two questions:

1. How much data loss can be tolerated? If the answer is “half a working day at most”, a weekly backup is not enough.
2. How long may the company be at a standstill? If quotes, orders and plans are inaccessible for three days, that has different consequences from three hours – technology and effort are based on this.

The answers form the backup concept: which data is backed up, how often, how long versions are kept, where the copies are stored and who takes over checking. This concept should be recorded in writing and approved by management. If you commission an external service provider, you should have them report regularly on backup runs and test results – an annual meeting with minutes is often enough to avoid nasty surprises. If personal data is held by the service provider, the appropriate contractual basis under the GDPR is also required.

Why is the restore test more important than the backup itself?

The classic emergency looks like this: the backup ran for years, apparently without errors – and at the first real restore attempt it turns out that a folder was never included, the backup medium is defective or nobody knows the password for the backup’s encryption. That is why the rule is: the proof is not saving, but restoring. A useful test runs like this:

1. Define the scenario: for example “The file server has failed” or “A folder was deleted by mistake” – think small once and big once.
2. Carry out the restore: to a test system or into a separate folder, never over the live data.
3. Measure the time: How long does it really take until people can work? This figure belongs in the concept.
4. Check completeness: Open samples – are the files readable, up to date and complete?
5. Record the result: date, scenario, duration, shortcomings, remedial measures. The record is also your evidence for the insurer, customers or the authorities.

At least one test per year has proved its worth as a rhythm, two are better – and additionally after every change of server, backup software or service provider.

Which mistakes happen most often in practice?

All copies in the same building. The network storage in the next room protects against hard disk failure, but not against fire or burglary. Without an external copy, the 3-2-1 rule is not met.

Syncing confused with backup. The cloud folder is practical, but it mirrors errors in real time. If you only sync, you have no fallback.

No offline copy. Modern malware specifically looks for reachable backups and encrypts them first. A separate copy that is not permanently connected is your life insurance.

Nobody tests. The backup reports “successful” – whether a system can ever be restored from it, nobody has ever tried.

The knowledge depends on one person. Only the IT support person knows where the backups are, how the restore works and which order must be followed. If this person is unavailable, the company comes to a standstill despite intact backups.

How do you document your data backup in a traceable way?

The last point in particular is underestimated: in an emergency, what counts is not only that the data exists, but that the knowledge about restoring it can be found. The documented backup concept includes the scope of the backup, the intervals, the storage locations, the responsibilities, the step-by-step restore instructions and the test records. These documents are of little use if nobody can find them in an emergency – under stress, possibly without the usual contact person.

This is where the circle closes to knowledge management: an AI knowledge base that answers from your own documents and names the source document for every answer makes exactly such documents accessible with a simple question – for example “How do we restore the file server, and who is responsible?”. The AI does not replace the backup system; it makes the documented how-to findable and verifiable at the decisive moment.

At the same time, data backup is only one of several building blocks of GDPR-compliant IT use – alongside server location, access control and data processing by third parties. How these building blocks work together is shown in the overview article AI and the GDPR in Austria.

The next step is unspectacular but effective: check this week when your last restore was tested – and record the result in writing. If you want to make your backup concept and the rest of your company knowledge permanently findable, the page Process of the introduction shows how a knowledge base comes into the company step by step.