Ask ten people where their important files live and most will describe a single place: the laptop, or the phone, or one folder in a cloud account. That works right up until the day the laptop is stolen, the phone falls into water, or a sync client quietly deletes a folder. The 3-2-1 rule is a simple way to make sure that day is an inconvenience instead of a disaster.
What the rule actually says
The 3-2-1 backup rule is usually credited to the photographer Peter Krogh, who wrote about it for people whose entire livelihood was digital images. It has three parts:
- 3 copies of your data: the original plus two backups.
- 2 different types of storage: for example an internal disk and an external drive, or a drive and the cloud, so that one kind of failure can't take out every copy.
- 1 copy offsite: stored somewhere physically separate from the other two, so a fire, flood or burglary at home or in the office can't destroy everything at once.
Nothing in the rule depends on a particular product. It's a way of thinking about failure: every copy you keep should be exposed to a different set of risks.
Why each number matters
Why three copies?
Any single storage device has some chance of failing in a given year. Two independent devices failing at the same moment is far less likely than one failing alone, and the third copy covers the awkward situation where you discover the first backup was already broken when you needed it. Backups fail silently more often than people expect: a drive that stopped being powered, a backup job that has been erroring for months, a cloud folder you stopped syncing after changing your password.
Why two kinds of storage?
Copies on the same type of device tend to fail for the same reasons. Two external drives bought together and plugged into the same power strip can be damaged by the same surge. A laptop and the USB drive attached to it can be encrypted by the same piece of ransomware. Mixing media, such as a local drive plus cloud storage, means different failure modes apply to each copy.
Why one offsite?
Everything that lives in one building shares the same fire, flood, theft and electrical risks. One copy that lives somewhere else, whether at a relative's house or in a provider's data center, is the only protection against those events.
A worked example
Here's how the rule looks for a freelance designer with a laptop and a phone.
| Copy | Where it lives | What it protects against |
|---|---|---|
| 1 (original) | Laptop internal disk | Day-to-day work; nothing else |
| 2 (local backup) | External hard drive at home, backed up weekly | Laptop failure, accidental deletion, a bad software update |
| 3 (offsite) | Cloud storage account, uploaded automatically | Theft, fire, flood, and failure of the home drive |
That's three copies on different kinds of media, with one offsite. Photos and WhatsApp media from the phone follow the same pattern: the phone is copy one, a periodic transfer to the laptop or drive is copy two, and the cloud upload is copy three.
Sync is not backup
The most common mistake is treating a synced folder as a backup. A sync tool's job is to make several places look identical. If you delete a file on one device, the deletion is copied to the others. If a program corrupts a document, the corrupted version is copied too. A true backup keeps history, so you can go back to how the file looked last week.
So when you choose where the cloud copy lives, check three things: whether it keeps previous versions of files, whether deleted files can be recovered and for how long, and whether you can restore a single file without restoring everything. Version history is what turns a synced folder into something that can actually undo a mistake.
Make it automatic, then test it
A backup that depends on remembering will eventually be forgotten. Schedule the local backup (most operating systems have a built-in tool for this), keep cloud uploads running for the folders that matter, and put a recurring reminder in your calendar to check that everything is still working.
Testing matters more than most people admit. Once a quarter, pick a handful of random files and one whole folder, restore them to a different location, and open them. It takes ten minutes and it's the only way to know the backup is usable rather than merely present.
Common mistakes
- Backing up only the Documents folder and forgetting photos, desktop files, or project folders stored elsewhere on the disk.
- Leaving the external drive permanently plugged in next to the laptop, so the same accident or malware reaches both.
- Never testing a restore.
- Using one account and one password for everything, so a single locked account takes out both the original and the cloud copy.
- Encrypting a backup and then losing the password.
A short checklist
- List the folders and devices that hold files you can't replace.
- Make sure each has a second copy on a different kind of storage.
- Make sure one copy is offsite, such as in cloud storage.
- Confirm the cloud copy keeps version history and lets you recover deleted files.
- Automate the backups, then schedule a quarterly restore test.
None of this needs expensive equipment. A spare external drive and a cloud account are enough to move from one copy to three, which is the difference between losing a file and merely having a bad afternoon. If you're deciding where the offsite copy should live, NGDS gives every account 30GB free, enough to start with your most important documents and photos before deciding whether you need more.