The Complete Guide to Business Data Backup for New Zealand Small Businesses

Running a small business in New Zealand means wearing a lot of hats. Backup strategy is the hat most people never put on — until a hard drive dies, a phone gets stolen, or a flood destroys a home office, and suddenly years of files are gone.

This guide is for NZ small business owners who want a practical, no-jargon answer to the question: how do I actually protect my business data?

What Data Does Your Business Actually Have?

Before thinking about backup solutions, it helps to list what you'd lose if everything disappeared tomorrow.

Documents and files

• Quotes, invoices, and contracts
• Client records and contact history
• Certificates, licences, and compliance documents
• Templates, price lists, and procedures

Photos and media

• Job site before-and-after photos
• Product images and marketing materials
• Receipts and documentation photos

Emails

• Client correspondence and agreements
• Supplier threads with pricing history
• Compliance-related communications

Accounting data

• Transaction history
• GST records
• Payroll records

The Risks That Actually Happen to NZ Businesses

Hardware failure. The IRD recommends keeping business records for seven years. A laptop hard drive has an average lifespan of three to five years. At some point, the drive fails.

Theft. Office break-ins are not uncommon in New Zealand. A stolen laptop or phone takes everything on it. If the thief also grabs the external drive sitting on the desk — which burglars do — your "backup" is gone too.

Ransomware. Ransomware attacks on NZ businesses have increased sharply since 2020. CERT NZ's quarterly reports consistently list ransomware among the top threats. Ransomware encrypts every file it can reach — including drives plugged into the infected machine.

Fire and flood. Canterbury earthquakes, Hawke's Bay floods, Wellington storms — New Zealand has had a string of significant natural events. If your home office or business premises are affected, anything in that building is at risk.

What the NZ Privacy Act 2020 Requires

New Zealand's Privacy Act 2020 has practical implications for businesses handling personal information.

Information Privacy Principle 5 requires that personal information is protected by security safeguards reasonable in the circumstances. This includes protection against accidental loss. Backup is part of that obligation.

The Act doesn't prescribe specific technical controls. But "reasonable security safeguards" in 2024 clearly includes offsite backup. A sole trader with one laptop and no backup would struggle to defend that as reasonable if a loss occurred.

What a Real Backup Looks Like for a Small Business

A reliable backup has three properties. Professionals call this the 3-2-1 rule:

• 3 copies of your data
• 2 different storage media types
• 1 copy stored offsite — physically separate from the others

For a small NZ business, this translates practically to:

1. Your working files — on your laptop, phone, or desktop
2. A local copy — on an external hard drive at your premises
3. An offsite copy — in the cloud, not in the same building

Setting Up Offsite Backup

Automatic sync — If you have to remember to run a backup, it won't happen consistently.

File and folder backup — Not just photos. A business backup needs to cover documents, spreadsheets, PDFs, and the whole directory structure you've built up.

Email backup — Most cloud services don't include email. Your Outlook or Gmail inbox may not be backed up at all.

Photo backup — Before-and-after job photos, site photos, and documentation photos. These are business records and often the only evidence of how a job looked at completion.

TPT Backup is built for NZ and Australian small business owners who want solid backup without IT complexity. The free plan gives you 5 GB. The Pro plan at $5/month gives you 200 GB. Setup for most businesses takes under 15 minutes.

Get started with 5 GB free — no credit card required →

Frequently Asked Questions

Do I need a backup if I'm already using Dropbox or Google Drive?

Dropbox and Google Drive are sync services, not backups. If you delete a file, the deletion syncs to the cloud. A real backup is an independent, separate copy.

Does the NZ Privacy Act require me to have a backup?

Not explicitly. But Information Privacy Principle 5 requires reasonable security safeguards, and the Privacy Commissioner has consistently interpreted that to include protection against accidental loss.

How long should I keep business records?

IRD requires financial records for 7 years. Employment records should be kept for at least 6 years after an employee leaves.