How Often Should You Back Up Your Data?

Back up your most important data regularly, and make a fresh backup before anything goes wrong: before a repair, a factory reset, a big software update or a house move. The National Cyber Security Centre (NCSC) describes a backup as a copy of your important data stored in a separate safe location, usually on the internet (cloud storage) or on removable media such as a USB stick, SD card or external hard drive¹. What matters is that the copy exists, that it is recent, and that you could get your files back from it.

For most households the practical routine is simple. Set cloud backups to run automatically so the copy stays up to date, and keep an offline copy of your most important files that ransomware cannot reach¹. Check the backup actually contains your recent photos and files, and protect the account that holds it with a strong password and two-step verification¹.

The rest of this page sets out what to back up first, how the two main methods compare, how to restore files after an infected device, and what to check and change after a data breach.

Back up regularly, and again before anything goes wrong

The NCSC's core advice is to back up your most important data, and to do it often enough that the copy is worth having⁶. A backup made a year ago will not bring back this month's photographs. Automatic cloud backups help here because they run without you remembering, which means you are more likely to have an up-to-date copy of your data¹.

The second half of the rule is the one people forget: make a backup before a known risk, not after. The clearest example is a device you are about to reset. The NCSC warns that you should not back up your data before you perform a factory reset on an infected device, because the backup will also contain the malware⁵. In that situation the backup you rely on must be one made earlier, when the device was clean.

A sensible household rhythm looks like this:

• Automatically, continuously: cloud backup for photos, documents and anything you would miss¹.
• Regularly, by hand: plug in the external drive and let it copy across, then unplug it¹.
• Before a risky step: a repair, a reset, a major update or handing a device on. Check the last good backup is complete first⁴.
• Before an emergency: keep digital copies of key documents with your household paperwork, so they are ready if you have to leave in a hurry⁷.

That last point connects backups to the rest of your household planning. The emergency kit guidance for grab bags suggests keeping photographs or digital copies of important documents on your mobile phone as a back-up⁷. A phone backup that includes those images is doing double duty.

Keep a copy that ransomware cannot reach

Ransomware is malicious software that blocks access to your data or computer system, usually by encrypting it, until a ransom is paid⁹. In an attack you simply cannot open your files². The NCSC's advice is blunt: it is important that you always have a recent offline backup of your most important files and data².

"Offline" is the key word. A backup that is permanently connected to your computer, or permanently signed in on the same account, can be encrypted along with everything else. An external drive that you plug in, copy to, and then unplug is out of reach when an attack happens. The National Cyber Security Centre advises that you always have a recent offline backup of your most important files and data¹.

The same principle applies to your backup account as to your email. The NCSC advises protecting cloud accounts, and access to your backups, with strong passwords and two-factor authentication¹. If a criminal can get into the account that holds your only copy, you have no backup at all. Turn on two-step verification for your email, your cloud storage and any password manager you use; the NCSC describes it as the first and most important step for protecting an account if your password is phished or otherwise compromised¹¹.

For more on how these attacks work and what they mean for households, see Ransomware: What It Is and How It Affects Households and How to Protect Your Backups From Ransomware.

What to back up first: photos, documents and account details

You do not need to back up everything at once. The NCSC's test is simple: back up anything that you value, meaning anything that would inconvenience you if you could no longer access it¹. For most households that means a short list, and it is worth working through it in order.

The NCSC specifically names photos and key documents as the most important data to safeguard, backing them up to an external hard drive or a cloud-based storage system⁶. Local emergency planners make the same point from the other direction: when advising households to prepare a grab bag, they suggest keeping photographs or digital copies of important documents such as passports and insurance policies on your mobile phone as a back-up⁷. Flood advice is to ensure important documents are safe, including your home insurance details⁸, and reservoir emergency guidance stresses being able to pick up key pieces of information such as insurance documents and passports quickly¹⁴.

Account details deserve their own line because they are what let you get back into everything else. If a criminal can access your email account, they could reach private information about you, including banking details, send messages pretending to be from you, and reset your other account passwords¹⁵. A backup of your account recovery information, kept somewhere safe and offline, is part of protecting the rest.

Cloud storage or an external drive: which suits your home?

The National Cyber Security Centre sets out both routes, backing your most important data up to an external hard drive or to a cloud-based storage system¹. The choice comes down to your circumstances rather than to any product.

Many households end up with both, and that is the strongest position: an automatic cloud copy for everyday, and an offline drive for the copy ransomware cannot touch¹. If you are weighing them up for your own home, Cloud Backup or External Hard Drive: Which Suits Your Home? goes through the comparison in more detail, and Backing Up Files and Photos at Home covers the practical steps.

Whichever you choose, check the result. Once you have made your backup, the NCSC says it is important to check that it contains all your important data, such as recently taken photos or recently created files or folders¹. A backup you have never opened is a hope, not a copy.

Restoring your files after an infected device

If a device has been infected, the backup is what makes recovery possible, but the order of steps matters. The NCSC's guidance is to restore your backed-up data from the last known good backup⁴. You will lose any data that was not backed up, but trying to rescue data while the device is still infected risks carrying the infection through after wiping and reinstalling⁴.

That is the trade-off to accept calmly: some recent files may go, and that is better than reinstalling malware along with them.

Two conditions decide whether you can restore at all. The NCSC says that when you are given the option to restore backups, you should only do so if you are confident the backup was created before you installed the malware; if you cannot be sure, perform a factory reset and do not restore any backups⁵. And do not make a fresh backup of the infected device first, because that backup will contain the malware too⁵.

After fixing an infection, the NCSC lists the follow-up steps: keep your device and programs up to date, back up your data, check your device is encrypted, and for PCs and laptops make sure you have antivirus that is updating regularly¹⁷. Antivirus should always be used and kept up to date to protect your data and devices¹⁸, and if you think you have opened a suspicious link, open your antivirus software if you have it and run a full scan, allowing it to clean up any problems it finds¹⁶.

For a step-by-step walk-through, see How to Restore Files Safely After Ransomware or a Virus and the After Fixing an Infected Device: Checklist.

After a data breach: what to check and change

A data breach means your details may be in someone else's hands, and the backup routine changes slightly: you want to secure the accounts first, then make sure your copies are intact.

Start with the organisation. The NCSC says the organisation should be able to confirm if a breach has actually occurred, how you are affected and what else you need to do¹⁹. Then work through your own accounts:

1. Change a quoted password immediately. If you receive a message that includes a password you have used in the past and still use, change it as soon as you can²⁰. Change any other accounts using the same password, and consider using a passkey instead²¹.
2. Check for other breaches. Use an online tool such as haveibeenpwned.com to see if your details have appeared in other public data breaches; similar services are often included in antivirus or password manager tools²¹.
3. Watch for follow-up scams. Be alert for suspicious messages after a breach, as cyber criminals may try to take advantage of it¹⁹.
4. Protect the accounts that hold your backups. Strong password and two-step verification on cloud storage and email¹.

If you receive a sextortion email, forward it to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk²³. For the full picture on breach follow-up, see Your Details in a Data Breach: What to Do Next and How to Spot Scam Messages After a Data Breach.