What UK law and guidance say about backups
Insurers and auditors write their own questions. These are the UK rules and guidance that cover backups, and what each one actually says.
| Source | What it says about backups |
|---|---|
| UK GDPR, Article 32(1)(c) | You must be able to restore the availability of, and access to, personal data in a timely manner after a physical or technical incident. |
| UK GDPR, Article 32(1)(d) | You need a process for regularly testing, assessing and evaluating how well your security measures work. |
| ICO: A guide to data security | The UK GDPR doesn’t define “timely”; it depends on your organisation, your systems and the risk to people if their data is unavailable. An appropriate backup process helps give assurance. In a worked example, the ICO describes an organisation that follows the “well-known ‘3-2-1’ backup strategy”. The ICO says this guidance is under review following the Data (Use and Access) Act 2025. |
| NCSC: Back up your organisation’s critical data | Don’t rely solely on a cloud service’s versioning or recycle bin mechanisms; keep an independent copy in another safe place or service. |
| NCSC: Prepare for incidents | Back up essential information daily or weekly, regularly test that you can restore from it, and make sure you can meet any operational requirements your insurer places on you. |
| NCSC: 10 Steps, Data security | Test your backups regularly and know how to restore before you need to. The NCSC describes the 3-2-1 rule (at least three copies, on two devices, with one offsite) as “a popular strategy that can be used in most scenarios”. |
| Cyber Essentials requirements v3.3 | Backing up is not a technical requirement of Cyber Essentials, but the NCSC highly recommends an appropriate backup solution. |
Evidence that commonly helps answer those questions
- Backups that run regularly. Dated records of what was backed up and when, ideally for each mailbox, drive and site rather than for a whole backup job.
- An independent copy. Where your backups are kept, and confirmation that they sit outside the services they protect.
- Proof you can restore. A record of restore tests and their results, which also supports the regular testing UK GDPR expects.
- How backups are protected. How backup data is encrypted, and who can access it.
- A plan for incidents. Who restores your data and how, so you can meet any operational requirements in your insurance policy.
This isn’t a complete list: your insurer or auditor may ask for more.
Questions to ask your insurer or auditor
Because every questionnaire is different, ask for the specifics in writing:
- Which services must be backed up: email, files, accounting data?
- How often must backups run, and how long must they be kept?
- Must a copy be kept separately from your live systems, offline or offsite?
- Do you require restore tests, how often, and in what format should results be recorded?
- How far back do you want to see evidence?
How CloudVision can help with this evidence
| Evidence | From CloudVision |
|---|---|
| Backups that run regularly | The Daily Backup Report, every morning: every protected object checked against a 24-hour backup SLA. Every report is kept in your portal and exports to PDF or Excel. |
| An independent copy | Backups kept independently of Microsoft, Google and Intuit, stored in the UK by default, in ISO 27001 certified, SOC 2 Type 2 audited data centres. |
| How backups are protected | Encrypted at rest and in transit. CloudVision is registered with the ICO and handles your data under UK GDPR, with a data protection agreement for every customer. |
| A plan for incidents | Managed restores by our UK team, 24/7. |
| Proof you can restore | The report shows that backups exist, not that a restore works. Keep a record of any restores and their results. |
Whether this meets a particular insurer’s or auditor’s requirements is for them to decide.
See the CloudVision Daily Backup Report, how we protect your data and what a backup compliance score is.
Backup evidence: common questions
Is backup required for Cyber Essentials?
No. The Cyber Essentials requirements (v3.3, April 2026) say backing up your data is not a technical requirement, but the NCSC highly recommends an appropriate backup solution. Insurers and auditors may still ask about backups separately.
Does UK GDPR require backups?
The UK GDPR doesn’t use the word backup, but Article 32 requires the ability to restore the availability of, and access to, personal data in a timely manner after a physical or technical incident. The ICO says an appropriate backup process helps give that assurance.
What counts as a timely restore of personal data?
The UK GDPR doesn’t define it. The ICO says it depends on who you are, what systems you have and the risk to individuals if their personal data is unavailable for a period of time.
Are Microsoft 365 or Google Workspace recycle bins enough?
The NCSC advises against relying solely on a cloud service’s versioning or recycle bin mechanisms, and recommends keeping an independent copy in another safe place or service. The built-in windows are also limited: see our guides to Microsoft 365 retention and Google Vault.
Sources used in this guide
This guide is general information, not legal or insurance advice. Requirements and product limits change, so check the linked sources and your own policies, and take professional advice where needed. Sources last checked on 28 October 2026.
- UK GDPR, Article 32: Security of processing (legislation.gov.uk)
- A guide to data security (ICO)
- Back up your organisation’s critical data (NCSC)
- Step 1: Prepare for incidents (NCSC)
- 10 Steps to Cyber Security: Data security (NCSC)
- Cyber Essentials: Requirements for IT Infrastructure v3.3 (NCSC)