What Data Should a Small Business Back Up?

A small business should back up the data it needs to keep operating, recover money, serve customers, meet obligations, and prove what happened. That usually includes financial records, customer and supplier information, operational documents, email and collaboration data, line-of-business application data, website assets, configuration details, and selected endpoint data. The goal is not to back up everything blindly. The goal is to protect the information that would be expensive, risky, or impossible to recreate.

Start With Business Functions

Data matters because a business function depends on it. Sales needs quotes, proposals, CRM records, and order history. Finance needs invoices, payroll files, tax records, banking exports, and accounting data. Operations may need schedules, dispatch notes, inventory, project documents, and vendor portals. Leadership needs contracts, insurance documents, policies, and decision records.

When backup planning starts with folders and devices, important data is missed. Staff may store key files in cloud apps, email, local desktops, shared drives, phones, or vendor systems. A business-function view asks what information is needed to run the company tomorrow morning if a system fails today.

Core Data Most Small Businesses Should Review

Most small businesses should review these categories:

• Accounting, invoicing, payment, payroll, and tax records.
• Customer, supplier, contract, and service history information.
• Email, calendars, Teams or collaboration content, and shared cloud files.
• Line-of-business databases and application exports.
• Project files, drawings, proposals, photos, and operational documents.
• Website content, domain records, DNS settings, and marketing assets.
• Device data that is not already stored in a protected company location.
• System configuration, licence keys, admin procedures, and recovery instructions.

Some of these may already be protected by a managed platform. Others may require a separate backup because sync, retention, or vendor availability is not the same as recoverability from deletion, corruption, or malicious change.

A Business Scenario: The Missing Estimating Files

A trade contractor keeps accounting records in a cloud platform, project photos in a shared drive, estimates on individual laptops, and signed change orders in email. The company believes it has backups because the shared drive is protected. After one laptop fails, the team discovers that several active estimates were saved locally and never synced. The work is not impossible to recreate, but doing so delays bids and burns senior estimator time.

The fix is not to back up every personal file forever. The fix is to decide where estimating work must live, protect that location, train staff to use it, and test that a sample estimate can be restored. The backup plan should reinforce the business process, not chase scattered files forever.

Use A Data Criticality Framework

Classify data with four questions:

• Would losing this data stop sales, service delivery, payroll, billing, or customer support?
• Could staff recreate it accurately, and how long would that take?
• Does it contain confidential, regulated, contractual, or commercially sensitive information?
• Where does the authoritative version live, and who is allowed to change it?

Data that scores high on operational impact, low on recreatability, or high on sensitivity deserves stronger protection. Data that is easy to recreate and low impact may need simpler retention. This keeps the backup plan affordable and focused.

Common Backup Scope Mistakes

One mistake is assuming cloud storage means backup. Many cloud tools protect availability and synchronization, but they may not provide the restore depth, retention, or separation the business expects. Another mistake is protecting servers while ignoring SaaS platforms. A third is backing up user desktops because files are scattered, instead of fixing the storage habit that caused the scattering.

Businesses also forget configuration data. During recovery, knowing how systems were set up can matter as much as restoring documents. Admin settings, network configurations, mailbox rules, application integrations, and vendor contact information can shorten recovery work.

Backups should also reflect data ownership. If a department creates a dataset, that department should help decide whether it is authoritative, temporary, confidential, or replaceable. IT can protect the location, but the business owner must say whether the content matters. This prevents two opposite problems: expensive protection for low-value clutter and weak protection for a quiet spreadsheet that actually drives payroll, scheduling, or customer commitments.

Do not forget seasonal or deadline-driven data. Year-end accounting packages, annual renewal lists, grant files, tax support, and audit evidence may sit quietly for months, then become urgent on a specific date. Backup priority should consider when data becomes important, not only how often it is opened or modified by staff.

Sources And Further Reading

• Canadian Centre for Cyber Security: Back up and encrypt data

Protect The Data The Business Actually Uses

The next step is to inventory your critical business functions and trace the data each one needs. OnlineV can help turn that inventory into a focused plan through Backup and Disaster Recovery. Related pages include Business Continuity Planning, Cloud Management, and Business Continuity insights.