In this guide · 8 sections
- 1.What Microsoft and Google already keep for you
- 2.When built-in recovery isn't enough
- 3.The 3-2-1 rule, made practical for a small business
- 4.Backup options and what they cost
- 5.Test your restore, or you don't have a backup
- 6.How backups fit into your security and PDPA plans
- 7.Do it yourself or get help?
- 8.Frequently asked questions
What Microsoft and Google already keep for you
Both providers replicate your data across data centres, so you won't lose it because one of their servers fails. What they don't do is keep long-term copies you can roll back to after something goes wrong on your side. The built-in recovery windows, from their own documentation as of October 2026:
| What was lost | Built-in recovery | Source |
|---|---|---|
| Email permanently deleted in Outlook (Microsoft 365) | Kept in Recoverable Items for 14 days by default; can be raised to 30 days maximum | Microsoft: deleted item retention |
| Files deleted from OneDrive (work account) | Restorable within 93 days; whole OneDrive can be rolled back up to 30 days | Microsoft: restore OneDrive files |
| A deleted Google Workspace user | Admin can restore within 20 days, then the data is gone | Google: restore a deleted user |
| Drive files after the user empties their trash | Admin can recover within 25 days | Google: recover deleted Drive files |
Google Vault is sometimes mistaken for a backup. Google's own Vault FAQ says plainly that Vault isn't designed to be a backup or archive tool, and that deleting a user also deletes the data Vault retained for them.
When built-in recovery isn't enough
- Ransomware or a malicious insider encrypts or deletes large amounts of data, and synced copies on OneDrive or Drive change too.
- A deletion noticed late, such as a client folder removed months ago that is suddenly needed for a dispute or an audit.
- A leaver's account deleted to save a licence, before anyone exported the mailbox and files.
- A hacked account where the attacker deleted mail and emptied the bin to cover their tracks.
- Sync mistakes, such as a laptop wiping a shared folder that then syncs the deletion to everyone.
- Records you must keep, for example business and tax records you're required to retain for several years.
Microsoft's own Microsoft 365 Backup overview describes the same scenarios: ransomware that encrypts large amounts of data, and accidental or malicious deletion or overwriting.
The 3-2-1 rule, made practical for a small business
The 3-2-1 rule is a long-standing rule of thumb: keep 3 copies of important data, on 2 different types of storage, with 1 copy off-site or separate from the main system. For a cloud-based SME it translates into:
- Copy 1: the live data in Microsoft 365 or Google Workspace.
- Copy 2: a cloud-to-cloud backup service that copies mail, OneDrive or Drive, SharePoint and Teams or Shared Drives every day, with its own retention.
- Copy 3: a separate copy of the few things you couldn't trade without, such as accounting exports, key contracts and client files, held where a compromised work account can't delete it.
Two details matter more than the brand of tool. The backup must use separate credentials from your everyday admin account, so an attacker who takes over Microsoft 365 can't also delete the backups. And it must keep enough history: 30 days plus monthly copies for a year is a sensible starting point for most SMEs.
Don't delete a leaver's account on their last day. Remove their access, then export or archive their mailbox and files first. Google recommends an Archived User licence if you need to keep a former employee's data available.
Backup options and what they cost
| Option | What it covers | Cost model (approximate, October 2026) |
|---|---|---|
| Microsoft 365 Backup | Exchange, OneDrive and SharePoint, restored inside Microsoft 365 | Pay as you go; list price US$0.15 per GB of protected content a month, per Microsoft's pricing page |
| Third-party cloud-to-cloud backup | Microsoft 365 or Google Workspace, often including Teams and Shared Drives | Usually per user per month; compare retention, restore options and where data is stored |
| Manual exports | Mailbox exports or Google Takeout downloads | Free, but easy to forget and hard to restore from |
| Website backup | Your website files and database (separate from email) | Often included by good hosts; otherwise a plugin or service |
For a small team, a third-party tool priced per user is often simpler to budget than per-GB pricing, especially if mailboxes are large. Whichever you choose, keep the subscription in your company's name.
Backup software is also one of the solutions listed under the EDGE Grant. Our guide to the EDGE Grant for IT explains the conditions.
Test your restore, or you don't have a backup
A backup you have never restored from is a hope, not a plan. Every three months:
- Pick one mailbox folder, one OneDrive or Drive folder and, if you have one, one website page.
- Restore them to a test location (not over the live data).
- Open a few emails and files to check they are complete and readable.
- Note how long the restore took; this is your real recovery time.
- Record the date and result, so you can show it to an insurer, a customer or an assessor.
The Singapore Police Force's ransomware advisory adds an important point: restore onto a clean system that is free of the malware, because ransomware can re-encrypt data if it hasn't been fully removed.
How backups fit into your security and PDPA plans
Backups are part of the CSA Cyber Essentials requirements, and many cyber insurance questionnaires ask whether you back up and test restores. They also help under the PDPA, which expects reasonable security arrangements to protect personal data, including against loss.
If you are hit by ransomware, a tested backup is what lets you recover without considering the criminals' demands. See our step-by-step guide on what to do after a ransomware attack.
Do it yourself or get help?
If you have one or two users, a reputable backup tool and a quarterly restore test are something you can set up yourself in an afternoon.
Backup & Ransomware Recovery (S$290) sets up daily off-site website backups and a Microsoft 365 or Google Workspace backup, agrees a retention plan, runs a test restore with proof, and writes a one-page recovery guide. The backup service subscription is billed to you. To plan who does what on a bad day, add the Incident & Ransomware Response Plan (S$390).
Frequently asked questions
Microsoft keeps your data resilient against its own failures, and offers short recovery windows such as 14 days (up to 30) for permanently deleted email and 93 days for deleted OneDrive files. It does not keep long-term, independent backups unless you add Microsoft 365 Backup or a third-party tool.
No. Google's Vault FAQ says Vault isn't designed to be a backup or archive tool, and deleting a user also deletes the data Vault kept for them. Use a dedicated backup service for Google Workspace.
An administrator can restore a deleted user account for up to 20 days. After that, Google says the data is gone and can't be restored.
Microsoft lists Microsoft 365 Backup as pay as you go at US$0.15 per GB of protected content a month (list price, October 2026). Third-party tools usually charge per user per month instead.
At least every three months, by restoring a sample of email and files to a test location and checking they open. Record the date and result, and test again after any change to your setup.