Imagine arriving on Monday to find that every file is locked, or that a client calls to say their personal details have appeared online. For many small businesses this is not hypothetical. Data protection is the discipline of making sure that information stays available, accurate and private, and it is one of the most practical investments you can make.
What is at stake
- Money. Recovery, downtime, legal advice and lost work add up quickly. See how to calculate the cost of a data breach.
- Trust. Clients share information because they believe you will protect it. Once broken, that trust is hard to rebuild.
- Operations. If you cannot reach client files, you cannot work.
- Legal duties. Privacy law, professional rules and contracts set obligations, with notification requirements after a breach.
- Insurance. Cyber insurance requirements increasingly demand specific controls such as multi-factor authentication, tested backups and endpoint protection.
How data is lost
- Attack. Phishing, stolen passwords and ransomware.
- Mistakes. Deleting a folder, sending the wrong file, sharing with the wrong person.
- Failure. Hardware breaks, devices are lost, systems corrupt.
- Disasters. Fire, flood or theft.
- Insiders. Departing staff taking or deleting information.
The core protections
Control access
Use MFA everywhere you can, give people only the access they need and remove accounts when staff leave.
Stop the common attacks
Good email filtering, current software and trained staff block most threats. Ransomware protection also depends on tested backups that attackers cannot reach. Read our summary of current threats.
Back up and test
Keep copies in a separate location, and test restoring. Cloud backup for business is a straightforward way to do this. See our remote backup service.
Encrypt
Encryption on laptops, phones and removable drives turns a loss into an inconvenience.
Monitor and respond
Know who to call and what to do. A short written plan prevents panic.
| Risk | Main protection |
|---|---|
| Phishing and stolen passwords | MFA, email security, training |
| Ransomware | Backup, endpoint protection, patching |
| Lost device | Encryption, device management |
| Human error | Access controls, versioning, backup |
| Disaster | Offsite or cloud backup |
Where to start
You do not need to do everything at once. In order of impact: turn on MFA, make sure backups work, update software, train staff, then document a response plan. Our data breach prevention tips expand on this. A cybersecurity assessment shows which items matter most for you.
We assess your current controls and give you a clear, prioritised plan.
Explore cyber securityFrequently asked questions
Is my business too small to be targeted?
No. Automated attacks target any organisation with exposed accounts or unpatched systems.
What is the most effective first step?
Turn on multi-factor authentication for email and remote access.
How often should backups be tested?
At least quarterly, and after major changes.
Related service: Cyber Security Assessment
Last updated
