How to Back Up Your Data: The 3-2-1 Rule Explained (Computers and Phones)

Your phone could be stolen tomorrow. Your laptop's hard drive could fail without warning. Ransomware could lock every file on your computer. If that happened today, would you lose your certificates, CV, project files, business records or family photos? For many people the answer is yes, because they have never set up a proper backup.

A backup is simply a copy of your data stored somewhere else, so you can restore it if the original is lost, damaged or locked. This guide explains the widely recommended 3-2-1 backup rule, how to back up a Windows PC, a Mac, an Android phone and an iPhone, how to protect backups against ransomware, and how to build a simple routine that actually works.

Run a restore drill before you rely on a backup

Create a small folder with three harmless sample files. Back it up, then restore it to a different folder. Open all three files and check that the newest version is present. Repeat the test from your off-site copy. If you needed a password or recovery key, check that you could still find it if your main device were lost.

Why Backups Matter

Data can be lost in many ways: hardware failure, theft, accidental deletion, water or fire damage, power surges, and malware such as ransomware, which encrypts files and demands payment. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends that organisations maintain offline, encrypted backups of critical data and regularly test that they can be restored. The same principle protects individuals and small businesses.

The 3-2-1 Backup Rule Explained

The 3-2-1 rule is a simple, widely recommended strategy, described for example by the US Chamber of Commerce's small business resource CO:

Why it works: one problem (a stolen bag, a fire, a ransomware attack, a failed drive) is very unlikely to destroy all three copies at once.

What to Back Up

• Academic certificates, transcripts, ID scans (stored securely)
• CVs, cover letters and job application documents
• Work and school projects, reports and research
• Business records: sales, invoices, receipts and bookkeeping files (see our bookkeeping guide)
• Photos and videos
• Contacts, messages and important chat backups
• Website files and databases, if you run a website
• Password manager recovery codes and two-step verification backup codes (store very securely)

Backup Options Compared

Important: file sync services (where deleting a file on your laptop also deletes it in the cloud) are not the same as true backups. Check whether your service keeps version history and deleted files for a period.

How to Back Up Your Devices

Windows PC

• Use the built-in backup tools in Windows (such as Windows Backup or File History, depending on your version) to copy files to an external drive or cloud storage.
• Keep important documents in a cloud-synced folder with version history as an extra layer.

Mac

• Use Time Machine with an external drive for automatic backups.
• Use iCloud Drive or another cloud service for an offsite copy.

Android phone

• Turn on the built-in backup in Settings (usually linked to your Google account) for contacts, settings and app data.
• Back up photos with a photo backup service or copy them to a computer.
• Turn on chat backup within messaging apps if you want to keep messages.

iPhone

• Turn on iCloud Backup, or back up to a computer.
• Check storage space so backups don't stop silently.

Menu names vary by device and version; check your manufacturer's official help pages.

Protecting Backups From Ransomware

• Keep at least one backup offline: disconnect the external drive after each backup. Ransomware can encrypt drives that stay connected.
• Use version history: cloud services that keep earlier versions let you restore files from before an attack.
• Secure your backup accounts: strong unique passwords and two-step verification. See our guide to protecting your online accounts.
• Encrypt backups containing sensitive data, especially portable drives.
• Test restores: CISA stresses regularly testing backups. A backup you can't restore is not a backup.

A Simple Backup Routine

Example: A Small Business Backup Plan

Example (fictional): Juma runs a small printing shop. His invoices and designs are on one desktop computer. He sets up automatic cloud backup with version history for his business folder, runs a weekly backup to an encrypted external drive that he disconnects and keeps at home, and once a month restores a random file to check it works. When the shop computer's drive later fails, he restores everything onto a replacement machine within a day.

Backup Checklist

• ☐ Listed the files that matter most
• ☐ Three copies on two types of storage, one offsite
• ☐ Automatic backups switched on
• ☐ One backup kept offline
• ☐ Backup accounts protected with two-step verification
• ☐ Sensitive backups encrypted
• ☐ Test restore done in the last month

Frequently Asked Questions

Is cloud storage enough on its own?

It's a good offsite copy, but relying on one service creates a single point of failure (for example, if you lose access to the account). Combining cloud with a local backup follows the 3-2-1 rule.

How often should I back up?

As often as you can't afford to lose work. For active documents, automatic daily backup is ideal; at minimum, back up weekly.

How long do external hard drives last?

All drives can fail, sometimes without warning. That's why you should keep more than one backup and check them regularly.

Should I pay a ransom to get my files back?

Authorities such as CISA advise against paying ransoms, as payment doesn't guarantee recovery and funds criminal activity. Good backups are the best protection. Report attacks to the relevant authorities.

Sources

• CISA: #StopRansomware Guide
• US Chamber of Commerce CO: The 3-2-1 backup rule

Note: Backup features and menu names vary by device and software version. Examples are fictional. Last reviewed: November 2026.