# Encrypting and Backing Up Sensitive Data Without the Headache

A practical guide to combining encryption and backups so your sensitive files are protected both from strangers who steal your device and from the disasters that destroy it.

Backups and encryption[↗](/encryption) solve two different problems, and people often think about only one. A **backup[↗](/backup)** protects you from losing your data. **Encryption** scrambles data so only someone with the right key or password can read it, which protects you from others reading it. You need both, and setting them up together is easier than it sounds.

## Why one without the other leaves a gap

An unencrypted backup on an external drive protects you from a hard drive failure. But if that drive is lost or stolen, whoever finds it now has your tax documents, family photos, and perhaps a spreadsheet of passwords. Encryption without a backup keeps your files from prying eyes but does nothing if your laptop is destroyed in a fire or the only copy is locked by ransomware[↗](/ransomware).

|  | Backup only | Encryption only | Both |
| --- | --- | --- | --- |
| Laptop is stolen | You can restore, but the thief can read your files | The thief cannot read your files, but you may lose them | You restore, and the thief reads nothing |
| Hard drive fails | You restore | Data is gone | You restore |
| Ransomware | You restore if the backup was out of reach | Data may be locked, with no backup | You restore from an offline, encrypted copy |

## Encrypting data at rest: the easy way

"At rest" means stored on a device or drive, not moving over the internet.

- **Full-disk encryption.** Windows (BitLocker or device encryption, depending on your edition), macOS (FileVault), and most modern Linux systems offer built-in, free encryption of the whole drive. Turning it on protects everything on the device if it is lost or stolen. Turn it on today if you have not.

- **Encrypted backup drives.** Most backup software, including the built-in tools on Windows and macOS, has a checkbox to encrypt the backup itself, protected by a password separate from your device login.

- **Cloud backup encryption.** Reputable cloud backup services encrypt data both while it travels and while it is stored. Check whether the provider offers "zero-knowledge" or "end-to-end" encryption, meaning even the provider cannot read your files without your key.

## The 3-2-1 backup rule, encrypted

The classic rule is: **3** copies of important data, on **2** different kinds of media, with **1** copy offsite. Add encryption to every copy and the rule gets much stronger:

- **Copy 1, the working copy.** Your laptop or desktop with full-disk encryption on.

- **Copy 2, a local backup.** An encrypted external drive, disconnected when you are not backing up. This also protects it from ransomware, which cannot lock what it cannot reach.

- **Copy 3, an offsite or cloud backup.** An encrypted cloud service, protecting you if your home or office is hit by fire, flood, or theft.

## Key management: the part people skip

Encryption is only as strong as the password or key that protects it, and losing the key means losing the data as thoroughly as if it had been destroyed. Windows and macOS generate a **recovery key** when you turn on disk encryption. Store it somewhere separate from the device: in a password manager[↗](/password-manager), or printed and kept in a safe place. Never store the only copy of your recovery key on the drive it protects.

## A worked example

You turn on FileVault on your laptop and save the recovery key in your password manager. You also back up weekly to an encrypted external drive that lives in a drawer, and your photos upload to an encrypted cloud service. Then your bag is stolen on a train. The thief gets a locked laptop and nothing readable. You buy a new one and restore everything from the drive and the cloud within an evening.

## For small businesses: a few extra considerations

- Test restoring from backup at least twice a year. A backup nobody has restored from is a hope, not a plan.

- If you hold customer personal data, encrypted backups are not optional. Regulators increasingly expect them as a baseline, and an unencrypted backup that is lost or stolen can turn a minor incident into a reportable data breach[↗](/data-breach).

- Keep at least one backup copy that is fully offline or cannot be changed, so a ransomware infection on your live network cannot also lock your safety net.

## Your setup checklist

- ☐ Disk encryption on for laptops and, where offered, phones

- ☐ Recovery keys saved separately from the device

- ☐ Backups running automatically and encrypted

- ☐ One copy offline and one offsite

- ☐ A test restore completed in the last six months

## Related reading

[Back Up Your Important Files RegularlyPhotos, documents and memories can disappear in an instant. A simple approach to backing up your phone (Android/iPhone) and computer.](/back-up-your-important-files-regularly) [Cryptography Basics: How Encryption Protects YouYou rely on encryption dozens of times a day without noticing. Here's a practical, non-mathematical explanation of how it works and why it matters for secure design.](/cryptography-basics-how-encryption-protects-you) [Backup and Business Continuity Beyond the BasicsA backup that's never been tested for restoration, or an asset nobody knew existed, can undo months of planning. Here's how to build real continuity, not just a backup schedule.](/backup-and-business-continuity-beyond-the-basics)