The 3-2-1 rule is the closest thing data protection has to a universal standard, and it's usually explained as a slogan rather than a system. Here's what each number is defending against, and four concrete setups that satisfy it.
The rule
3 copies of your data 2 different types of storage 1 copy off-site
Your working files count as copy one. So you need two more, one of which is somewhere else.
Why each number exists
Three copies, because two isn't enough.
With two copies, any single failure leaves you with no margin. Your laptop dies, and now your backup drive is the only copy in existence — and that's precisely when you'll be handling it, plugging it in, copying from it. The moment you're most dependent on a drive is the moment you're most likely to discover it's failing too.
Three copies means one failure still leaves you with redundancy.
Two different media, because identical things fail identically.
Two hard drives bought at the same time from the same batch have correlated failure rates. Two copies on the same machine share one power supply, one controller, one exposure to whatever damages it. Two copies in the same cloud account share one account.
"Different media" is looser now than when the rule was written — the practical intent is different failure modes. An external drive plus a cloud service qualifies. Two USB drives in the same drawer does not.
One off-site, because location-based disasters take everything in the location.
Fire, flood, burglary, a burst pipe. The best-organized backup in the world is worthless if it was on the shelf above the machine it was backing up.
Off-site also covers a subtler case: you spill something across your desk, and the drive that was plugged into the laptop takes the same coffee.
The modern addition: 3-2-1-1-0
The rule was formulated before ransomware. The updated version adds:
1 copy offline or immutable — a copy that malware cannot reach and cannot modify. A drive that's unplugged, or storage with a write-lock that can't be overridden.
0 errors — verified restores. A backup you haven't tested is a hypothesis.
Those two additions do more for most people than anything else in this article. Ransomware encrypts everything reachable, including connected drives and synced cloud folders. A drive sitting in a drawer is immune by virtue of being in a drawer.
Four setups that satisfy the rule
Setup 1: The minimum (about £60/$70 one-time)
- Copy 1: your computer
- Copy 2: external drive, automated backup, plugged in weekly then unplugged
- Copy 3: cloud sync for your documents and photos folder — off-site
Media: local drive plus cloud. Off-site: the cloud. Offline: the unplugged drive.
Cheapest arrangement that genuinely works. The weakness is that cloud sync propagates deletions, so copy 3 is weaker than it looks — but combined with an offline drive holding history, the set is sound.
Setup 2: The two-drive rotation (about £120/$140 one-time)
- Copy 1: your computer
- Copy 2: external drive A, at home, backed up weekly
- Copy 3: external drive B, at a relative's house or your workplace, swapped monthly
No subscription. Complete control. Works on a slow internet connection, which matters if you have a large library.
The weakness is the swap discipline: the off-site copy is only as current as your last swap. Set a calendar reminder or it becomes a six-month-old copy.
Setup 3: Local plus cloud backup (drive cost plus a subscription)
- Copy 1: your computer
- Copy 2: external drive, automated, unplugged between runs
- Copy 3: a cloud backup service — not storage, backup — running continuously
The best balance for most people. The cloud backup service keeps version history, retains deleted files far longer than sync services, and handles off-site automatically with no discipline required.
The local drive gives you fast restores for the common case; the cloud handles the disaster case. This is what I'd recommend to most households and solo businesses.
Setup 4: Small business
- Copy 1: working files on machines and a shared drive
- Copy 2: a network drive on-site, backing up nightly
- Copy 3: cloud backup, running continuously, off-site
- Copy 4: monthly archive to a drive stored off-site, retained for a year
Adds a longer retention tier, because businesses need to recover from mistakes discovered months later — a corrupted file discovered at year-end, a client dispute, a deletion nobody noticed.
What to actually back up
Not everything. Backing up your entire machine including the operating system and applications is the "image backup" approach — good for rapid recovery of a whole system, and large.
The tiered approach:
Tier 1 — irreplaceable. Photos and video of people, documents, financial records, contracts, identity documents, business records, personal projects. Usually a few gigabytes to a few hundred. This gets all three copies without exception.
Tier 2 — painful to lose. Working files, media libraries you've curated, application settings and configurations. Two copies is fine.
Tier 3 — replaceable. Software installers, downloaded media, cached files, anything you could re-acquire. Back up if it's free to do so, don't build a system around it.
Most people's tier 1 is far smaller than they assume, and that's the useful discovery. Protecting the pile that matters properly is cheap. Protecting everything equally well is what makes backup feel expensive and complicated.
The categories people forget
Even good backup setups miss these, because they're not in the documents folder:
- Phone data — photos, messages, app data. Separate backup path, covered elsewhere in this series.
- Email — if it lives only on a provider's servers, you don't have a copy. Export annually.
- Cloud-only files — anything created in a browser-based tool and never downloaded.
- Website and online business data — the site, the database, the shop, customer records.
- Application databases — photo library packages, accounting data files, note apps with proprietary storage.
- Password manager vault — usually synced, rarely exported.
- Authenticator app codes and recovery keys.
- Purchased software licences and keys.
- Scanned documents that exist nowhere else.
Write a list of everything you'd need after a total loss, then check each item against your backup. The gaps are usually in this list.
Automation is the whole game
A backup that requires you to remember is a backup that stops happening in about six weeks. Everyone believes they'll be the exception. Nobody is.
Automate what can be automated:
- Backup software running on a schedule to the local drive
- Cloud backup running continuously
- Phone backing up automatically overnight
The only manual step in a good setup is the physical one — swapping the off-site drive — and that gets a recurring calendar reminder.
Verify, or it doesn't count
Two checks, and they're the difference between a backup and a belief:
Restore one file, now. Pick a file, restore it from your backup, open it. This finds silent failures, dead drives, forgotten encryption passwords, and files that backed up empty.
Check that backups are still running, monthly. Backup software fails quietly. A backup that stopped in February and never mentioned it is one of the most common findings in any audit.
Set a calendar reminder: monthly status check, annual restore test.
Start here this week
If you have nothing:
- Identify your tier 1 pile. An hour, and it's usually smaller than you feared.
- Buy an external drive at least twice the size of what you're backing up.
- Turn on your operating system's built-in backup pointed at it. Let the first run complete.
- Copy tier 1 to a second drive and put it somewhere that isn't your home.
- Restore one file and open it.
- Set two reminders: monthly status check, annual restore test.
That's 3-2-1, achieved in a weekend, for the price of two drives. Everything after that is refinement.
Next in this series: How to Set Up an Automatic Backup in Under an Hour